GPPA Sample Questions Answers

Jain works as a professional Ethical Hacker. He has been assigned the project of testing the security of testing the security of www.abc.com. Jain notices that the ABC network is vulnerable to a man-in-the-middle attack since the key exchange process of the cryptographic algorithm it is using does not authenticate participants.

Which of the following cryptographic algorithms is being used by the ABC server?

Which of the following protocols does IPsec use to perform various security functions in the network?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following is like a malicious cache poisoning where fake data is placed in the cache of the name servers?

Which of the following honeypots is a low-interaction honeypot and is used by companies or corporations for capturing limited information about malicious hackers?

Which of the following configuration schemes in IPv6 allows a client to automatically configure its own IP address with or without IPv6 routers?

A scenario involves a pool of users with private IP addresses who need to access the Internet; however, the company has a limited number of IP addresses and needs to ensure users occupy only one public IP address.

Which technology is used to allow a pool of users to share one global IP address for Internet access?

Which of the following methods is a behavior-based IDS detection method?

At which of the following layers of the OSI reference model does a Proxy firewall, also known as Application Gateway Firewall, filter information?

Each correct answer represents a part of the solution. (Choose all that apply.)

Adam works as a Network Administrator for ABC Inc. He wants to prevent the network from DOS attacks.

Which of the following is most useful against DOS attacks?

Which of the following types of audit constructs a risk profile for existing and new projects?

In which of the following situations does legal and authorized traffic cause an intrusion detection system (IDS) to generate an alert and slow down performance?

Each correct answer represents a complete solution. (Choose all that apply.)

You work as a Network Administrator for ABC Inc. You want to configure Snort as an IDS for your company's wireless network, but you are concerned that Snort does not support all types of traffic.

What traffic does Snort support?

Each correct answer represents a complete solution. (Choose all that apply.)

Jacob is worried about sniffing attacks and wants to protect his SMTP transmissions from this attack.

What can he do to accomplish this?

You have to ensure that your Cisco Router is only accessible via telnet and ssh from the following hosts and subnets:

10.10.2.103

10.10.0.0/24

Which of the following sets of commands will you use to accomplish the task?

Fill in the blank with the appropriate tool name.

______________ is a network protocol analyzer tool that is used to capture packet data from an existing network or examine packet data from a pre-saved file.

Your customer is concerned about security. He wants to make certain no one in the outside world can see the IP addresses inside his network.

What feature of a router would accomplish this?

The simplest form of a firewall is a packet filtering firewall. Typically, a router works as a packet-filtering firewall and has the capability to filter on some of the contents of packets.

On which of the following layers of the Open System Interconnection (OSI) reference model do these routers filter information?

Each correct answer represents a complete solution. (Choose all that apply.)

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to send malicious data packets in such a manner that one packet fragment overlaps data from a previous fragment so that he can perform IDS evasion on the We-are-secure server and execute malicious data.

Which of the following tools can he use to accomplish the task?

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred.

Which of the following switches will she use with CHKDSK command to accomplish the task?

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports.

Which of the following tools works as a firewall for the Linux 2.4 kernel?

You work as a Network Administrator for Rick International. The company has a TCP/IP-based network. A user named Kevin wants to set an SSH terminal at home to connect to the company's network. You have to configure your company's router for it.

By default, which of the following standard ports does the SSH protocol use for connection?

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server.

Which of the following tools will John use to accomplish his task?

You work as a Network Administrator for Blue Bell Inc. The company has a TCP-based network. The company has two offices in different cities. The company wants to connect the two offices by using a public network. You decide to configure a virtual private network (VPN) between the offices.

Which of the following protocols is used by VPN for tunneling?

Which of the following fields is 13 bits long and specifies the offset of a particular fragment relative to the beginning of the original un-fragmented IP datagram?

Which of the following are the types of intrusion detection systems?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following tools allows an attacker to intentionally craft the packets to gain unauthorized access?

Each correct answer represents a complete solution. (Choose two.)

Which of the following vulnerability scanners detects vulnerabilities by actually performing attacks?

Jain works as a Security Manager for ABC Inc. The company has a Windows-based network.

Jain has been assigned a project to detect the services used by an attack to access the network. For this purpose, he is required to use the predefined service objects of the rulebase. This predefined service object defines the services used in the attack to access the network.

Which of the following objects will he create when he finds that the attack is not defined in the predefined service objects?

Which of the following IPv6 transition technologies is used by the DirectAccess if a user is in a remote location and a public IPv4 address, instead of public IPv6 address, has been assigned to the computer?

Adam works on a Linux system. He is using Sendmail as the primary application to transmit emails. Linux uses Syslog to maintain logs of what has occurred on the system.

Which of the following log files contains e-mail information such as source and destination IP addresses, date and time stamps etc?

Which of the following is a Windows-based tool used for packet analysis?

This is a Windows-based tool that is used for the detection of wireless LANs using the IEEE 802.11a, 802.11b, and 802.11g standards. The main features of these tools are as follows:

• It displays the signal strength of a wireless network, MAC address, SSID, channel details, etc.

• It is commonly used for the following purposes:

a) War driving

b) Detecting unauthorized access points

c) Detecting causes of interference on a WLAN

d) WEP ICV error tracking

e) Making Graphs and Alarms on 802.11 Data, including Signal Strength

This tool is known as __________.

In which of the following locations can the Cisco IOS file reside?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following ICMPv6 neighbor discovery messages is sent by hosts to request an immediate router advertisement, instead of waiting for the next scheduled advertisement?

Which of the following attacks are prevented from a mutual authentication solution?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following tools can be used for passive OS fingerprinting?

The general form of the Cisco IOS is a.b.c.de.

Which of the following indicates the major version number of the Cisco IOS?

In which of the following conditions is the SYN Protector rule base activated in passive mode?

Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer and logs activities of the network that is matched with the predefined signatures? (Choose two.)

As a professional hacker, you want to crack the security of secureserver.com. For this, in the information gathering step, you performed scanning with the help of nmap utility to retrieve as many different protocols as possible being used by the secureserver.com so that you could get the accurate knowledge about what services were being used by the secure server.com.

Which of the following nmap switches have you used to accomplish the task?

Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?

Suppose you are working as a Security Administrator at ABC Inc. The company has a switched network. You have configured tcpdump in the network which can only see traffic addressed to itself and broadcast traffic.

What will you do when you are required to see all traffic of the network?

Which of the following information must the fragments carry for the destination host to reassemble them back to the original unfragmented state?

Each correct answer represents a complete solution. (Choose all that apply.)

Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN.

What steps can be used as a countermeasure of ARP spoofing?

Each correct answer represents a complete solution. (Choose all that apply.)

You work as a technician for ABC Inc. You are troubleshooting a connectivity issue on a network. You are using the ping command to verify the connectivity between two hosts. You want ping to send larger sized packets than the usual 32-byte ones.

Which of the following commands will you use?

Which of the following wireless security features provides the best wireless security mechanism?

Which of the following can provide security against man-in-the-middle attack?

Which of the following methods will allow data to be sent on the Internet in a secure format?

In which of the following steps of firewall log analysis process is aggregation for nodes defined?

Which of the following IDs is used to reassemble the fragments of a datagram at the destination point?

Which of the following is an attack with IP fragments that cannot be reassembled?

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008 network environment. The network is configured as a Windows Active Directory-based single forest single domain network. The network is configured on IP version 6 protocol. All the computers on the network are connected to a switch device. One day, users complain that they are unable to connect to a file server. You try to ping the client computers from the server, but the pinging fails. You try to ping the server's own loopback address, but it fails to ping. You restart the server, but the problem persists.

What is the most likely cause?

Which of the following tools is used to detect wireless LANs using the 802.11b, 802.11a, and 802.11g WLAN standards on the Windows platform?

Which of the following protocols is used with a tunneling protocol to provide security?

Which of the following types of firewall functions by creating two different communications, one between the client and the firewall, and the other between the firewall and the end server?

You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic, etc.) and to monitor for conditions above that baseline.

This type of IDS is called __________.

Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

You work as the Security Administrator for Prodotxiss Inc. You want to ensure the security of your Wi-Fi enterprise network against the wireless snooping attacks.

Which of the following measures will you take over the site network devices of the network?

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.abc.com. You have searched all open ports of the ABC server. Now, you want to perform the next information-gathering step, i.e., passive OS fingerprinting.

Which of the following tools can you use to accomplish the task?

Which of the following tools performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs?

Mark works as a Network Security Administrator for BlueWells Inc. The company has a Windowsbased network. Mark is giving a presentation on Network security threats to the newly recruited employees of the company. His presentation is about the External threats that the company recently faced in the past.

Which of the following statements are true about external threats?

Each correct answer represents a complete solution. (Choose three.)

Which of the following responsibilities does not come under the audit process?

Each correct answer represents a complete solution. (Choose all that apply.)

When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

You work as a Network Architect for Tech Perfect Inc. The company has a corporate LAN network. You will have to perform the following tasks:

• Limit events that occur from security threats such as viruses, worms, and spyware.

• Restrict access to the network based on identity or security posture.

Which of the following services will you deploy in the network to accomplish the tasks?

Adam has installed and configured his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption, and enabling MAC filtering on his wireless router. Adam notices that when he uses his wireless connection, the speed is sometimes 16 Mbps and sometimes it is only 8 Mbps or less. Adam connects to the management utility wireless router and finds out that a machine with an unfamiliar name is connected through his wireless connection. Paul checks the router's logs and notices that the unfamiliar machine has the same MAC address as his laptop.

Which of the following attacks has been occurred on the wireless network of Adam?

Sam works as a Security Manager for ABC Inc. The company has a Windows-based network. Sam wants to prevent specific traffic from IDP processing in order to reduce false positives.

Which of the following rulebases will he use to accomplish the task?

Which of the following can be used in an extended access list to filter traffic?

Each correct answer represents a part of the solution. (Choose all that apply.)

Which of the following is used to provide hook handling facility within the Linux kernel in order to capture and manipulate network packets?

Which of the following utilities provides an efficient way to give specific users permission to use specific system commands at the root level of a Linux operating system?

Which of the following types of IP actions are supported by an IDP rulebase? (Choose three.)

Which of the following fields is NOT included in packet fragmentation?

You work as a Network Administrator for Infonet Inc. The company has a Windows Server 2008 Active Directory-based single forest multiple domain IPv4 network. All the DNS servers on the network run Windows Server 2008. The users in the network use NetBIOS name to connect network application on the network. You have migrated the network to IPv6-enabled network. Now you want to enable DNS Server to perform lookups in GlobalNames Zone.

Which of the following commands will you use to accomplish the task?

Which of the following proxy servers is also referred to as transparent proxies or forced proxies?

Which of the following steps is involved in the network planning process?

Paul works as a Technical Representative in a CSIRT for ABC Inc. His team is called to investigate the computer of an employee, who is suspected for classified data theft. Suspect's computer runs on Windows operating system. Paul wants to collect data and evidences for further analysis. He knows that in Windows operating system, the data is searched in pre-defined steps for proper and efficient analysis.

Which of the following is the correct order for searching data on a Windows based system?

Which of the following devices works as a transparent bridge between the wireless clients and the wired network?

Which of the following number ranges is used for the IP Standard ACL?

Andrew works as a Forensic Investigator for PassGuide Inc. The company has a Windows-based environment. The company's employees use Microsoft Outlook Express as their e-mail client program. E-mails of some employees have been deleted due to a virus attack on the network. Andrew is therefore assigned the task to recover the deleted mails.

Which of the following tools can Andrew use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

Jain works as a contract Ethical Hacker. He has recently got a project to do security checking for www.abc.com. He wants to find out the operating system of the ABC server in the information gathering step.

Which of the following commands will he use to accomplish the task?

Each correct answer represents a complete solution. (Choose two.)

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.abc.com. He is using a tool to crack the wireless encryption keys. The description of the tool is as follows:

It is a Unix-based WLAN WEP cracking tool that recovers encryption keys. It operates by passively monitoring transmissions. It uses Chipertext Only Attack and captures approximately 5 to 10 million packets to decrypt the WEP keys.

Which of the following tools is John using to crack the wireless encryption keys?

You work as a Network Administrator for ABC Inc.

The company's network contains five Windows 2003 servers and ninety Windows XP Professional client computers. You want to view all the incoming requests to an Internet Information Services (IIS) server and allow only requests that comply with a rule set, created by you, to be processed. You also want to detect the intrusion attempts by recognizing the strange characters in a URL on a Web server.

What will you do to accomplish the task?

What are the advantages of stateless autoconfiguration in IPv6?

Each correct answer represents a part of the solution. (Choose three.)