GCED Sample Questions Answers

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm’s artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

From a security perspective, how should the Root Bridge be determined in a Spanning Tree Protocol (STP) environment?

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

You have been tasked with searching for Alternate Data Streams on the following collection of Windows partitions; 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total Gigabytes and partitions will you need to search?

When running a Nmap UDP scan, what would the following output indicate?

A legacy server on the network was breached through an OS vulnerability with no patch available. The server is used only rarely by employees across several business units. The theft of information from the server goes unnoticed until the company is notified by a third party that sensitive information has been posted on the Internet. Which control was the first to fail?

Which action would be the responsibility of the First Responder once arriving at the scene of a suspected incident as part of a Computer Security Incident Response Plan (CSIRP)?

Which of the following is best defined as “anything that has the potential to target known or existing vulnerabilities in a system?”

What should happen before acquiring a bit-for-bit copy of suspect media during incident response?

The creation of a filesystem timeline is associated with which objective?

The matrix in the screen shot below would be created during which process?

What does the following WMIC command accomplish?

process where name=’malicious.exe’ delete

Which tasks would a First Responder perform during the Identification phase of Incident Response?

An outside vulnerability assessment reveals that users have been routinely accessing Gmail from work for over a year, a clear violation of this organization’s security policy. The users report “it just started working one day”. Later, a network administrator admits he meant to unblock Gmail for just his own IP address, but he made a mistake in the firewall rule.

Which security control failed?

What feature of Wireshark allows the analysis of one HTTP conversation?

Which tool uses a Snort rules file for input and by design triggers Snort alerts?

Which of the following tools is the most capable for removing the unwanted add-on in the screenshot below?

You are responding to an incident involving a Windows server on your company’s network. During the investigation you notice that the system downloaded and installed two files, iexplorer.exe and iexplorer.sys. Based on the behavior of the system you suspect that these files are part of a rootkit. If this is the case what is the likely purpose of the .sys file?

What attack was indicated when the IDS system picked up the following text coming from the Internet to the web server?

select user, password from user where user= “jdoe” and password= ‘myp@55!’ union select “text”,2 into outfile “/tmp/file1.txt” - - ’

Which of the following would be included in a router configuration standard?

Michael, a software engineer, added a module to a banking customer’s code. The new module deposits small amounts of money into his personal bank account. Michael has access to edit the code, but only code reviewers have the ability to commit modules to production. The code reviewers have a backlog of work, and are often willing to trust the software developers’ testing and confidence in the code.

Which technique is Michael most likely to engage to implement the malicious code?

The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?

A company classifies data using document footers, labeling each file with security labels “Public”, “Pattern”, or “Company Proprietary”. A new policy forbids sending “Company Proprietary” files via email. Which control could help security analysis identify breaches of this policy?