GIAC GCED Quiz 1 Topic 9 Questions 1-5

Question: 1

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

AThey did not eradicate tools left behind by the attacker

BThey did not properly identify the source of the breach

CThey did not lock the account after changing the password

DThey did not patch the database server after the event

Show Answer

Question: 2

What should happen before acquiring a bit-for-bit copy of suspect media during incident response?

AEncrypt the original media to protect the data

BCreate a one-way hash of the original media

CDecompress files on the original media

DDecrypt the original media

Show Answer

Question: 3

A security device processes the first packet from 10.62.34.12 destined to 10.23.10.7 and recognizes a malicious anomaly. The first packet makes it to 10.23.10.7 before the security devices sends a TCP RST to 10.62.34.12. What type of security device is this?

AHost IDS

BActive response

CIntrusion prevention

DNetwork access control

Show Answer

Question: 4

Which of the following is an SNMPv3 security feature that was not provided by earlier versions of the protocol?

AAuthentication based on RSA key pairs

BThe ability to change default community strings

CAES encryption for SNMP network traffic

DThe ability to send SNMP traffic over TCP ports

Show Answer

Question: 5

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

AThe network connections and open ports

BThe contents of physical memory

CThe current routing table

DA list of the running services

Show Answer

GIAC GCED Quiz:1 Topic:9 Questions:1-5