GIAC Certified Enterprise Defender - GCED FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

An internal host at IP address 10.10.50.100 is suspected to be communicating with a command and control whenever a user launches browser window. What features and settings of Wireshark should be used to isolate and analyze this network traffic?

A. Filter traffic using ip.src = = 10.10.50.100 and tcp.dstport = = 53, and use Expert Info B. Filter traffic using ip.src = = 10.10.50.100 and tcp.dstport = = 80, and use Follow TCP stream C. Filter traffic using ip.src = = 10.10.50.100, and use Follow TCP stream D. Filter traffic using ip.src = = 10.10.50.100 and tcp.srcport = = 80, and use Expert Info

Discussion 0

Correct Answer: B Vote an answer

Question 2

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

A. They did not lock the account after changing the password B. They did not patch the database server after the event C. They did not eradicate tools left behind by the attacker D. They did not properly identify the source of the breach

Discussion 0

Correct Answer: B Vote an answer

Question 3

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

A. Ensure that the MAC times are identical before and after copying the file B. Establish the chain of custody with the system description to prove it is the same image C. Create hash of the file before and after copying the image verifying they are identical D. Write down the file size of the file before and after copying and ensure they match

Discussion 0

Correct Answer: C Vote an answer

Question 4

What are Browser Helper Objects (BHO)s used for?

A. To provide multi-factor authentication support for Firefox B. To allow Internet Explorer to process multi-part URLs C. To provide a more feature-rich interface for Internet Explorer D. To allow Firefox to process JavaScript in a sandbox

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

What would be the output of the following Google search?
filetype:doc inurl:ws_ftp

A. Websites running ws_ftp that allow anonymous logins B. Documents found on sites with ws_ftp in the web address C. Websites hosting the ws_ftp installation program D. Documents available on the ws_ftp.com domain

Discussion 0

Correct Answer: B Vote an answer

Question 6

What feature of Wireshark allows the analysis of one HTTP conversation?

A. Setting a display filter to 'tcp' B. Follow UDP Stream C. Conversation list > IPV4 D. Follow TCP Stream

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which of the following is an operational security control that is used as a prevention mechanism?

A. Vibration alarms B. Heat detectors C. Labeling of assets D. Voltage regulators

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

On which layer of the OSI Reference Model does the FWSnort utility function?

A. Session Layer B. Application Layer C. Physical Layer D. Transport Layer E. Data Link Layer

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

How does an Nmap connect scan work?

A. It sends a SYN, waits for a ACK, then sends a SYN/ACK. B. It sends a SYN, waits for a SYN/ACK, then sends a ACK C. It sends a SYN, waits for a SYN/ACK, then sends a RST. D. It sends a SYN, waits for a ACK, then sends a RST.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).