GSEC GIAC Security Essentials Study Guide
Question and answer latest update
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224
A. 27
B. 32
C. 24
D. 29
A. 27
What class is the address 170.19.82.45?
A. Class C
B. Class A
C. Class B
D. Class D
C. Class B
Which utility makes use of ICMP to function?
A. traceroute
B. whasup
C. icmpstat
D. netstat
A. traceroute
In the network 192.168.5.0/23, what would be the broadcast address?
A. 192.168.4.0
B. 192.168.1.0
C. 192.168.5.255
D. 192.168.255.255
C. 192.168.5.255
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23 indicate?
A. The address of the router
B. The number of bits in the network portion of the address
C. The position in the address where the messages should be sent
D. The host address
B. The number of bits in the network portion of the address
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67
A. 192.168.1.38
B. 173.195.74.108
C. 103.75.194.137
D. 173.194.75.103
,D. 173.194.75.103
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what?
A. There are 0s between the ::.
B. This is a delimiter between addresses.
C. This indicates empty space.
D. There are 1s between the ::.
A. There are 0s between the ::.
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal.shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096
A. This is a SYN flood.
B. These are unexpected messages.
C. This is a sequence number prediction attack.
D. This is a normal remote login sequence.
C. This is a sequence number prediction attack.
What is the order of messages in a three-way handshake?
A. SYN, ACK, ACK
B. SYN, SYN/ACK, ACK
C. SYN/ACK, ACK, SYN
D. ACK, SYN, ACK
B. SYN, SYN/ACK, ACK
Which of the following is a private address (RFC1918)?
A. 1.1.1.1
B. 192.192.192.1
C. 10.45.60.10
D. 128.15.29.0
C. 10.45.60.10
A good example of a network using a mesh topology is:
, A. The Internet
B. A bus network
C. Switched networks
D. Hybrid networks
A. The Internet
This type of routing protocol uses the same algorithm as the navigation system in your car.
A. RIP
B. Border routing
C. Distance vector
D. Link-state
D. Link-state
Your IDS sends an alert about an incident on your network. The alert indicated that there was a
packet that had the same source and destination. This might normally indicate an attempt at a Land
attack, which is a very old attack. After investigating, you see that the source address is 0.0.0.0 and
the destination is 224.0.0.1. What would you consider this alert to be?
A. A false negative
B. A false positive
C. A true negative
D. A true positive
B. A false positive
You have been asked to implement a security solution on your network to protect against employees
browsing Facebook during the work day. What would you implement?
A. An intrusion detection service
B. A session border controller
C. A deep packet inspection firewall
D. A proxy server
D. A proxy server
These can be big challenges for intrusion detection systems.
A. Deep packet inspection
B. Compression and encryption
C. Alerting
D. Anomalies
B. Compression and encryption
You are seeing a lot of ARP responses with no corresponding ARP request. What are you most likely
seeing?
A. ARP rewrites
B. Gateway redirects
C. ARP spoofing
D. ARP cache flushes
C. ARP spoofing
Question and answer latest update
How many bits are in the NETWORK portion of the following address block:
Address: 10.1.0.0
Subnet: 255.255.255.224
A. 27
B. 32
C. 24
D. 29
A. 27
What class is the address 170.19.82.45?
A. Class C
B. Class A
C. Class B
D. Class D
C. Class B
Which utility makes use of ICMP to function?
A. traceroute
B. whasup
C. icmpstat
D. netstat
A. traceroute
In the network 192.168.5.0/23, what would be the broadcast address?
A. 192.168.4.0
B. 192.168.1.0
C. 192.168.5.255
D. 192.168.255.255
C. 192.168.5.255
In the address ab00:fc87:234a:0090:5120:ffab:bc8a:0098/23, what does the /23 indicate?
A. The address of the router
B. The number of bits in the network portion of the address
C. The position in the address where the messages should be sent
D. The host address
B. The number of bits in the network portion of the address
With the following IP header, what is the destination IP address:
45 00 03 3D 1E EB 40 00 40 06 5D E8 C0 A8 01 16 AD C2 4B 67
A. 192.168.1.38
B. 173.195.74.108
C. 103.75.194.137
D. 173.194.75.103
,D. 173.194.75.103
If you see the IP address fe80::0050:8790:4554:2300/16, the :: indicates what?
A. There are 0s between the ::.
B. This is a delimiter between addresses.
C. This indicates empty space.
D. There are 1s between the ::.
A. There are 0s between the ::.
What can you say about the following packet capture?
14:18:25.906002 apollo.it.luc.edu.1000 > x-terminal.shell: S
1382726990:1382726990(0) win 4096
14:18:26.094731 x-terminal.shell > apollo.it.luc.edu.1000: S
2021824000:2021824000(0) ack 1382726991 win 4096
14:18:26.172394 apollo.it.luc.edu.1000 > x-terminal.shell: R
1382726991:1382726991(0) win 0
14:18:26.507560 apollo.it.luc.edu.999 > x-terminal.shell: S
1382726991:1382726991(0) win 4096
14:18:26.694691 x-terminal.shell > apollo.it.luc.edu.999: S
2021952000:2021952000(0) ack 1382726992 win 4096
14:18:26.775037 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:26.775395 apollo.it.luc.edu.999 > x-terminal.shell: R
1382726992:1382726992(0) win 0
14:18:27.174846 x-terminal.shell > apollo.it.luc.edu.998: S
2022080000:2022080000(0) ack 1382726993 win 4096
A. This is a SYN flood.
B. These are unexpected messages.
C. This is a sequence number prediction attack.
D. This is a normal remote login sequence.
C. This is a sequence number prediction attack.
What is the order of messages in a three-way handshake?
A. SYN, ACK, ACK
B. SYN, SYN/ACK, ACK
C. SYN/ACK, ACK, SYN
D. ACK, SYN, ACK
B. SYN, SYN/ACK, ACK
Which of the following is a private address (RFC1918)?
A. 1.1.1.1
B. 192.192.192.1
C. 10.45.60.10
D. 128.15.29.0
C. 10.45.60.10
A good example of a network using a mesh topology is:
, A. The Internet
B. A bus network
C. Switched networks
D. Hybrid networks
A. The Internet
This type of routing protocol uses the same algorithm as the navigation system in your car.
A. RIP
B. Border routing
C. Distance vector
D. Link-state
D. Link-state
Your IDS sends an alert about an incident on your network. The alert indicated that there was a
packet that had the same source and destination. This might normally indicate an attempt at a Land
attack, which is a very old attack. After investigating, you see that the source address is 0.0.0.0 and
the destination is 224.0.0.1. What would you consider this alert to be?
A. A false negative
B. A false positive
C. A true negative
D. A true positive
B. A false positive
You have been asked to implement a security solution on your network to protect against employees
browsing Facebook during the work day. What would you implement?
A. An intrusion detection service
B. A session border controller
C. A deep packet inspection firewall
D. A proxy server
D. A proxy server
These can be big challenges for intrusion detection systems.
A. Deep packet inspection
B. Compression and encryption
C. Alerting
D. Anomalies
B. Compression and encryption
You are seeing a lot of ARP responses with no corresponding ARP request. What are you most likely
seeing?
A. ARP rewrites
B. Gateway redirects
C. ARP spoofing
D. ARP cache flushes
C. ARP spoofing
