GSNA Online Practice Questions and Answers

Correct Answer:

In order to ensure that the laptop users use smart cards for authentication, you will have to configure IEEE 802.1X authentication using the EAP-TLS protocol on the network.

Correct Answer: A

Magic Lantern works both as an encryption-cracking tool and as a keylogger. Answer: C is incorrect. Alchemy Remote Executor is a system management tool that allows Network Administrators to execute programs on remote network

computers without leaving their workplace. From the hacker's point of view, it can be useful for installing keyloggers, spyware, Trojans, Windows rootkits and such. One necessary condition for using the Alchemy Remote Executor is that the

user/attacker must have the administrative passwords of the remote computers on which the malware is to be installed. Answer: B is incorrect. The KeyGhost keylogger is a hardware keylogger that is used to log all keystrokes on a computer.

It is a tiny device that clips onto the keyboard cable. Once the KeyGhost keylogger is attached to the computer, it quietly logs every key pressed on the keyboard into its own internal Flash memory (just as with smart cards). When the log

becomes full, it overwrites the oldest keystrokes with the newest ones.

Answer: D is incorrect. SocketShield provides a protection shield to a computer system against malware, viruses, spyware, and various types of keyloggers. SocketShield provides protection at the following two levels:

1. Blocking: In this level, SocketShield uses a list of IP addresses that are known as purveyor of exploits. All http requests for any page in these domains are simply blocked. 2.Shielding: In this level, SocketShield blocks all the current and past IP addresses that are the cause of unauthorized access.

Correct Answer: D

According to the question, the output displays that the interface is administratively down. Administratively down means that the interface is shut down. In order to up the interface, you will have to open the interface with the no shutdown

command.

Answer: A is incorrect. Had there been a physical problem with the interface, the output would not have displayed "administratively down". Instead, the output would be as follows: serial0 is down, line protocol is down

Answer: B is incorrect. You cannot run this command on a router that is powered off. Answer: C is incorrect. Encapsulation has nothing to do with the output displayed in the question.

Correct Answer: B

The Annualized Rate of Occurrence (ARO) is a number that represents the estimated frequency at which a threat is expected to occur. It is calculated based upon the probability of the event occurring and the number of employees that could

make that event occur.

Answer: C is incorrect. The Exposure Factor (EF) represents the % of assets loss caused by a threat. The EF is required to calculate the Single Loss Expectancy (SLE). Answer: A is incorrect. The Single Loss Expectancy (SLE) is the value in

dollars that is assigned to a single event. SLE = Asset Value ($) X Exposure Factor (EF) Answer: D is incorrect. Safeguard acts as a countermeasure for reducing the risk associated with a specific threat or a group of threats.

Correct Answer: C

The basic Unix printing commands are as follows:

banner: It is used to print a large banner on a printer.

lpr: It is used to submit a job to the printer.

lpc: It enables one to check the status of the printer and set its state. lpq: It shows the contents of a spool directory for a given printer.

lprm: It is used to remove a job from the printer queue.

gs: It works as a PostScript interpreter.

pr: It is used to print a file.

tunelp: It is used to set various parameters for the lp device.

Correct Answer: ABC

eBox Platform is an open source unified network server (or a Unified Network Platform) for SMEs. eBoxPlatform can act as a Gateway, Network Infrastructure Manager, Unified Threat Manager, Office Server, Unified Communications Server or a combination of them. Besides, eBox Platform includes a development framework to ease the development of new Unix-based services. Answer: D is incorrect. eBox Platform cannot act as a sandbox. A sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs, from unverified third-parties, suppliers, and untrusted users.

Correct Answer: D

The fdisk command is a menu-based command available with Unix for hard disk configuration. This command can perform the following tasks: Delete a partition on a hard disk. Create a partition on a hard disk. Change the partition type.

Display the partition table. Answer: B is incorrect. In Unix, the exportfs command is used to set up filesystems to export for nfs (network file sharing).

Answer: A is incorrect. In Unix, the fdformat command formats a floppy disk. Answer: C is incorrect. In Unix, the fsck command is used to add new blocks to a filesystem. This command must not be run on a mounted file system.

Correct Answer: D

tag specifies a frameset used to organize multiple frames and nested framesets in an HTML document. It defines the location, size, and orientation of frames. An HTML document can either contain a tag or a

tag.

Answer: A, B, C are incorrect. There are no HTML tags such as , , and .

Correct Answer: D

According to the scenario, John wants to break the my_backup.tgz file into two files in which thesize of the first file named my_backup.tgz.aa should be 600MB and that of the second file named my_backup.tgz.ab should be 200MB. Hence,

he will use the the split --verbose -b 600 my_backup.tgz my_backup.tgz. command, which will automatically break the first file into 600MB named my_backup.tgz.aa, and the rest of the data (200MB) will be assigned to the second file named

my_backup.tgz.ab. The reason behind the names is that the split command provides suffixes as 'aa', 'ab', 'ac', ..., 'az', 'ba', 'bb', etc. in the broken file names by default. Hence, both conditions, the file names as well as the file sizes, match with

this command.

Note: If the size of the tar file my_backup.tgz is 1300MB, the command split --verbose -b 600 my_backup.tgz my_backup.tgz. breaks the my_backup.tgz file into three files,i.e., my_backup.tgz.aa of size 600MB, my_backup.tgz.ab of size

600MB, and my_backup.tgz.ac of size 100MB.

Correct Answer: AD

By default, session tracking uses cookies to associate a session identifier with a unique user. URL rewriting is used in cases where cookies are not supported by the browser.

Correct Answer: A

According to the network diagram, the IP address range used on the network is from the class C private address range. The class C IP address uses the following default subnet mask: 255.255.255.0 The question specifies that the subnet mask used in Host B is 255.255.0.0, which is an incorrect subnet mask.

Correct Answer: AB

Ptunnel and Itunnel are the tools that are used to perform ICMP tunneling. In ICMP tunneling, an attacker establishes a covert connection between two remote computers (a client and proxy), using ICMP echo requests and reply packets.

ICMP tunneling works by injecting arbitrary data into an echo packet sent to a remote computer. The remote computer replies in the same manner, injecting an answer into another ICMP packet and sending it back. The client performs all

communication using ICMP echo request packets, while the proxy uses echo reply packets. Normally, ICMP tunneling involves sending what appear to be ICMP commands but really they are the Trojan communications. Answer: C is

incorrect. WinTunnel is used to perform TCP tunneling.

Answer: D is incorrect. Ethereal is a network sniffer.

Correct Answer: C

Vulnerability scanning will be the best method to find flaws in applications allowing some attacker to get into your network. There are a number of tools available that will check Web applications for security flaws. They examine the application and identify any potential flaws due to improper coding, such as SQL injection attacks. Answer: B and A are incorrect. Penetration testing is used to test the network defenses. It is an excellent tool to check your firewall, IDS, policies, default shares, and other facets of your network infrastructure. However, it is not as useful in finding programming flaws in Web applications. Answer D is incorrect. A code review might well discover some issues with the Web applications. But it is long, tedious, and depends on the human reviewer noticing the coding flaws. So it is not as good a solution as vulnerability scanning.

Correct Answer: C

Penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known as a Black Hat Hacker, or Cracker. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known and/or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution. The intent of a penetration testing is to determine feasibility of an attack and the amount of business impact of a successful exploit, if discovered. It is a component of a full security of penetration testing.

Correct Answer: D

Blue jacking is the process of using another bluetooth device that is within range (about 30' or less) and sending unsolicited messages to the target.

Answer: B is incorrect. Blue snarfing is a process whereby the attacker actually takes control of the phone.

Perhaps copying data or even making calls.

Answer: C is incorrect. A virus would not cause unsolicited messages. Adware might, but not a virus. Answer: A is incorrect. Spam would not be limited to when the person was in a crowded area.