Exam (elaborations)
SANS GISCP and GIAC Exam | Questions with 100% Correct Answers
- Course
- Institution
SANS GISCP and GIAC Exam | Questions with 100% Correct Answers
[Show more]
Seller
Follow
Content preview
SANS GISCP and GIAC Exam | Questionswith 100% Correct Answers
What is Wardriving? - ✔Going around with equipment to detect wireless networks
What is War Dialing? - ✔- trying to ID modems in a telephone exchange that may
be susceptible to compromise
What are some Pen Test techniques? - ✔- War dialing
- war driving
- Sniffing
- eavesdropping
- dumpster diving
- social engineering
What is IDS? - ✔- intrusion detection system
- it reports attacks against monitored systems/networks
What is IDS not? - ✔- not a replacement for firewalls, hardening, strong policies, or other DiD
methods
- low maintenance
- inexpensive
What are the four types of events reported by IDS? - ✔- true positive
,- false positive
- true negative
- false negative
How does IDS signature analysis work? - ✔- rules indicate criteria in packets that
represent events of interest
- rules are applied to packets as they are received
- alerts are created when matches are found
How does anomaly analysis work? - ✔- flags anomalous conditions in traffic on the network
- requires understanding on what is normal
- bases good traffic as a baseline
What is deep packet inspection? - ✔- slow, requires stateful data
tracking - inspects all fields, including variable-length fields
What is shallow packet inspection? - ✔- fast, with little
fidelity - examines header information and limited payload
data
What is Honeyd? - ✔- low interaction production honeypot
- network daemon that can simulate other hosts
- each host can appear as a different OS
What is a netcat listener? - ✔- simplest form of a research honeypot
- useful in identifying nature of TCP scans, allows attacker to complete 3-way handshake
- listens on a defined port, logs incoming requests for analysis
,What are some disadvantages of honeypots? - ✔- improper deployment can increase
attack risk - if production systems aren't sufficiently protected, they can be vulnerable from a
honeypot
- legal liability
What are some honeypot advantages? - ✔- provides insight into the tactics, motives,
and attacker tools
What is a honeypot? - ✔- a system resource that has no legitimate purpose or reason
for someone to connect to it
- its purpose is to draw in attackers to understand how they break into a system
What is a proxy or application gateway? - ✔- maintains complete TCP connection state
and sequencing through 2 connections
- address translation built-in by virtue of second connection above
What is a stateful firewall? - ✔Stateful firewalls maintain state of traffic flows
What is No State Inspection ACK flag set? - ✔packet filter firewalls rely on TCP flags
to determine connection state. Attacker can send ACK packets only to bypass firewall.
What is IDS data normalization? - ✔- used by IDS for a baseline before analysis
- attackers will try to de-normalize traffic to evade detection
- IDS will normalize data for understood protocols
What are NIDS advantages? - ✔- provides insight into traffic on the network
- help detect problems with network operations
- provides auditing for other security measures
, What are NIDS challenges? - ✔- deployment challenges including topology and
access limitations
- analyzing encrypted traffic
- quantity vs. quality of signatures
- performance limitations with extensive analysis techniques
- very costly for proper management
What are some NIDS topology limitations? - ✔- switches networks make it difficult to
monitor traffic in promiscuous mode
- topology must be able to support traffic aggregation for monitoring
What is Snort? - ✔- open source tool for monitoring
- can be used as a NIDS
- has quick updates and flexibility for custom rules
What is a stateless packet filter? - ✔A low end firewall that can quickly be deployed
using existing hardware. They examine packets themselves with no content.
What are some firewall benefits? - ✔- protects internal/external systems from attack
- filters communications based on content
- performs NAT
- encrypts communications for VPN
- logging to aid in intrusion detection
What are some firewall challenges? - ✔- application layer attacks may get
through - dialup, VPN, extranet connections may bypass firewalls
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller KenAli. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $13.49. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81298 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now