QUESTION: 1

When an IDS system looks for a pattern indicating a known worm, what type of detection method is it using?

Signature-based
Anomaly-based
Statistical
Monitored

Answer(s): A

Reveal Solution Next Question

QUESTION: 2

Why would an incident handler acquire memory on a system being investigated?

To determine whether a malicious DLL has been injected into an application
To identify whether a program is set to auto-run through a registry hook
To list which services are installed on they system
To verify which user accounts have root or admin privileges on the system

Answer(s): C

Reveal Solution Next Question

QUESTION: 3

Which could be described as a Threat Vector?

A web server left6 unpatched and vulnerable to XSS
A coding error allowing remote code execution
A botnet that has infiltrated perimeter defenses
A wireless network left open for anonymous use

Answer(s): A

Explanation:

A threat vector is the method (crafted packet) that would be used to exercise a vulnerability (fragmentation to bypass IDS signature). An unpatched web server that is susceptible to XSS simply describes a vulnerability (unpatched) paired with a specific threat (XSS) and does not touch on the method to activate the threat. Similarly, the coding error that allows remote code execution is simply describing the pairing of a vulnerability with a threat, respectively. The botnet is an unspecified threat; there is no indication of how the threat was activated (or it's intention/capabilities; the threat).

Reveal Solution Next Question

QUESTION: 4

A security device processes the first packet from 10.62.34.12 destined to 10.23.10.7 and recognizes a malicious anomaly. The first packet makes it to 10.23.10.7 before the security devices sends a TCP RST to 10.62.34.12. What type of security device is this?

Host IDS
Active response
Intrusion prevention
Network access control

Answer(s): B

Explanation:

An active response device dynamically reconfigures or alters network or system access controls, session streams, or individual packets based on triggers from packet inspection and other detection devices. Active response happens after the event has occurred, thus a single packet attack will be successful on the first attempt and blocked in future attempts. Network intrusion prevention devices are typically inline devices on the network that inspect packets and make decisions before forwarding them on to the destination. This type of device has the capability to defend against single packet attacks on the first attempt by blocking or modifying the attack inline.

Reveal Solution Next Question

GIAC Certified Enterprise Defender GCED Exam

QUESTION: 1

QUESTION: 2

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

GIAC Certified Enterprise Defender
GCED Exam