GIAC Systems and Network Auditor GSNA Exam Questions

Page: 1 / 14
Total 416 questions
Question 1

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to fix partitions on a hard drive. Which of the following Unix commands can you use to accomplish the task?



Answer : D

The fdisk command is a menu-based command available with Unix for hard disk configuration. This command can perform the following tasks:

Delete a partition on a hard disk.

Create a partition on a hard disk.

Change the partition type.

Display the partition table.

Answer B is incorrect. In Unix, the exportfs command is used to set up filesystems to export for nfs (network file sharing).

Answer A is incorrect. In Unix, the fdformat command formats a floppy disk.

Answer C is incorrect. In Unix, the fsck command is used to add new blocks to a filesystem. This command must not be run on a

mounted file system.


Question 2

You work as the Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are a root user on the Red Hat

operating system. You want to keep an eye on the system log file /var/adm/messages. Which of the following commands should you use to

read the file in real time?



Answer : B

Using the -f option causes tail to continue to display the file in real time, showing added lines to the end of the file as they occur.


Question 3

George works as an office assistant in Soft Well Inc. The company uses the Windows Vista operating system. He wants to disable a program running on a computer. Which of the following Windows Defender tools will he use to accomplish the task?



Answer : D

Software Explorer is used to remove, enable, or disable a program running on a computer.

Answer A is incorrect. Allowed items contains a list of all the programs that a user has chosen not to monitor with Windows Defender.

Answer C is incorrect. Options is used to choose how Windows Defender should monitor all the programs running on a computer.

Answer B is incorrect. Quarantined items is used to remove or restore a program blocked by Windows Defender.


Question 4

Mark works as the Network Administrator for McNeil Inc. The company has a Unix-based network. Mark wants to scan one of the Unix systems to detect security vulnerabilities. To accomplish this, he uses TARA as a system scanner. What can be the reasons that made Mark use TARA?

Each correct answer represents a complete solution. Choose all that apply.



Answer : B, C, D

Tiger Analytical Research Assistant (TARA) is a set of scripts that scans a Unix system for security problems. Following are the pros and cons of using TARA.

Pros:

It is open source.

It is very modular.

It can work on a wide variety of platforms.

It is composed mostly of bash scripts; hence, it can run on any Unix platform with little difficulty.

Cons:

It has a very specific function of seeking paths to root.

Answer A is incorrect. It is a limitation of TARA that reduces its flexibility to be used for different

purposes.


Question 5

Which of the following statements are true about locating rogue access points using WLAN discovery software such as NetStumbler, Kismet, or MacStumbler if you are using a Laptop integrated with Wi-Fi compliant MiniPCI card? Each correct answer represents a complete solution. Choose two.



Answer : B, D

WLAN discovery software such as NetStumbler, Kismet, or MacStumbler can be used to detect rogue access points if the victim is using IEEE

802 frequency bands. However, if the victim is using non-IEEE 802.11 frequency bands or unpopular modulations, these tools might not detect

rogue access. NetStumbler, kismet, or MacStumbler also gives the authorization status of an access point. A Rogue access point (AP) is set up

by the attackers in an Enterprise's network. The attacker captures packets in the existing wireless LAN (WLAN) and finds the SSID and

security keys (by cracking). Then the attacker sets up his own AP using the same SSID and security keys. The network clients unknowingly use

this AP and the attacker captures their usernames and passwords. This can help the attacker to intrude the security and have access to the

Enterprise data.

Answer C and A are incorrect. The WLAN software such as NetStumbler, Kismet, or MacStumbler can search rogue access points even

when the victim is using data encryption. However, these tools cannot determine the rogue access point even when it is attached to a wired

network.


Question 6

In a network, a data packet is received by a router for transmitting it to another network. In order to make decisions on where the data packet should be forwarded, the router checks with its routing table. Which of the following lists does a router check in a routing table?

Each correct answer represents a complete solution. Choose all that apply.



Answer : A, D

A Routing table stores the actual routes to all destinations; the routing table is populated from the topology table with every destination

network that has its successor and optionally feasible successor identified (if unequal-cost load-balancing is enabled using the variance

command). The successors and feasible successors serve as the next hop routers for these destinations. Unlike most other distance vector

protocols, EIGRP does not rely on periodic route dumps in order to maintain its topology table. Routing information is exchanged only upon the

establishment of new neighbor adjacencies, after which only changes are sent.

Answer C is incorrect. A routing table does not contain any list of protocols.

Answer B is incorrect. A routing table does not contain any list of packets.


Question 7

In which of the following techniques does an attacker take network traffic coming towards a host at one port and forward it from that host to another host?



Answer : D

Port redirection is a technique by which an attacker takes network traffic coming towards a host at one port and redirects it from that host to

another host. For example, tools such as Fpipe and Datapipe are port redirection tools that accept connections at any specified port and

resend them to other specified ports on specified hosts. For example, the following command establishes a listener on port 25 on the test

system and then redirects the connection to port 80 on the target system using the source port of 25.

C .\>fpipe -l 25 -s 25 -r 80 IP_address

Answer C is incorrect. Firewalking is a technique for gathering information about a remote network protected by a firewall. This

technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL

value that is set to expire one hop past the firewall. If the firewall allows this crafted packet through, it forwards the packet to the next hop.

On the next hop, the packet expires and elicits an ICMP 'TTL expired in transit' message to the attacker. If the firewall does not allow the

traffic, there should be no response, or an ICMP 'administratively prohibited' message should be returned to the attacker.

A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall. To use firewalking, the

attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall. The

main drawback of this technique is that if an administrator blocks ICMP packets from leaving the network, it is ineffective.

Answer A is incorrect. Snooping is an activity of observing the content that appears on a computer monitor or watching what a user is

typing. Snooping also occurs by using software programs to remotely monitor activity on a computer or network device. Hackers or attackers

use snooping techniques and equipment such as keyloggers to monitor keystrokes, capture passwords and login information, and to intercept

e-mail and other private communications. Sometimes, organizations also snoop their employees legitimately to monitor their use of

organizations' computers and track Internet usage.

Answer B is incorrect. In UDP port scanning, a UDP packet is sent to each port of the target system. If the remote port is closed, the

server replies that the remote port is unreachable. If the remote Port is open, no such error is generated. Many firewalls block the TCP port

scanning, at that time the UDP port scanning may be useful. Certain IDS and firewalls can detect UDP port scanning easily.


Page:    1 / 14   
Total 416 questions