Easter Sale Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

GIAC Certified Enterprise Defender Question and Answers

GIAC Certified Enterprise Defender

Last Update May 18, 2024
Total Questions : 88

We are offering FREE GCED GIAC exam questions. All you do is to just go and sign up. Give your details, prepare GCED free exam questions and then go for complete pool of GIAC Certified Enterprise Defender test questions that will help you more.

GCED pdf

GCED PDF

$35  $99.99
GCED Engine

GCED Testing Engine

$42  $119.99
GCED PDF + Engine

GCED PDF + Testing Engine

$56  $159.99
Questions 1

Monitoring the transmission of data across the network using a man-in-the-middle attack presents a threat against which type of data?

Options:

A.  

At-rest

B.  

In-transit

C.  

Public

D.  

Encrypted

Discussion 0
Questions 2

Which action would be the responsibility of the First Responder once arriving at the scene of a suspected incident as part of a Computer Security Incident Response Plan (CSIRP)?

Options:

A.  

Making the decision of whether or not to notify law enforcement on behalf of the organization.

B.  

Performing timeline creation on the system files in order to identify and remove discovered malware.

C.  

Copying critical data from suspected systems to known good systems so productivity is not affected by the investigation.

D.  

Conducting initial interviews and identifying the systems involved in the suspected incident.

Discussion 0
Questions 3

To detect worms and viruses buried deep within a network packet payload, Gigabytes worth of traffic content entering and exiting a network must be checked with which of the following technologies?

Options:

A.  

Proxy matching

B.  

Signature matching

C.  

Packet matching

D.  

Irregular expression matching

E.  

Object matching

Discussion 0
Questions 4

The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?

Options:

A.  

alert tcp any 22 < > any 22 (msg:SSH connection; class type:misc-attack;sid: 122:rev:1;)

B.  

alert tcp any any < > any 6000: (msg:X-Windows session; flow:from_server,established;nocase;classtype:misc-attack;sid:101;rev:1;)

C.  

alert tcp any 23 < > any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;)

D.  

alert udp any any < > any 5060 (msg:VOIP message; classtype:misc-attack;sid:113; rev:2;)

Discussion 0
Questions 5

What would be the output of the following Google search?

filetype:doc inurl:ws_ftp

Options:

A.  

Websites running ws_ftp that allow anonymous logins

B.  

Documents available on the ws_ftp.com domain

C.  

Websites hosting the ws_ftp installation program

D.  

Documents found on sites with ws_ftp in the web address

Discussion 0
Questions 6

In order to determine if network traffic adheres to expected usage and complies with technical standards, an organization would use a device that provides which functionality?

Options:

A.  

Stateful packet filtering

B.  

Signature matching

C.  

Protocol anomaly detection

D.  

CRC checking

E.  

Forward error correction

Discussion 0
Questions 7

If a Cisco router is configured with the “service config” configuration statement, which of the following tools could be used by an attacker to apply a new router configuration?

Options:

A.  

TFTPD

B.  

Hydra

C.  

Ettercap

D.  

Yersinia

Discussion 0
Questions 8

Who is ultimately responsible for approving methods and controls that will reduce any potential risk to an organization?

Options:

A.  

Senior Management

B.  

Data Owner

C.  

Data Custodian

D.  

Security Auditor

Discussion 0
Questions 9

When an IDS system looks for a pattern indicating a known worm, what type of detection method is it using?

Options:

A.  

Signature-based

B.  

Anomaly-based

C.  

Statistical

D.  

Monitored

Discussion 0
Questions 10

When running a Nmap UDP scan, what would the following output indicate?

Options:

A.  

The port may be open on the system or blocked by a firewall

B.  

The router in front of the host accepted the request and sent a reply

C.  

An ICMP unreachable message was received indicating an open port

D.  

An ACK was received in response to the initial probe packet

Discussion 0
Questions 11

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

Options:

A.  

They did not eradicate tools left behind by the attacker

B.  

They did not properly identify the source of the breach

C.  

They did not lock the account after changing the password

D.  

They did not patch the database server after the event

Discussion 0
Questions 12

Which of the following is an outcome of the initial triage during incident response?

Options:

A.  

Removal of unnecessary accounts from compromised systems

B.  

Segmentation of the network to protect critical assets

C.  

Resetting registry keys that vary from the baseline configuration

D.  

Determining whether encryption is in use on in scope systems

Discussion 0
Questions 13

From a security perspective, how should the Root Bridge be determined in a Spanning Tree Protocol (STP) environment?

Options:

A.  

Manually selected and defined by the network architect or engineer.

B.  

Defined by selecting the highest Bridge ID to be the root bridge.

C.  

Automatically selected by the Spanning Tree Protocol (STP).

D.  

All switch interfaces become root bridges in an STP environment.

Discussion 0