GIAC Certified Enterprise Defender Practice Test: GCED

Analyze the screenshot below. Which of the following attacks can be mitigated by these configuration settings?

A. A Denial-of-Service attack using network broadcasts

B. A Replay attack

C. An IP masquerading attack

D. A MAC Flood attack

Which of the following attacks would use ".." notation as part of a web request to access restricted files and directories, and possibly execute code on the web server?

A. URL directory

B. HTTP header attack

C. SQL injection

D. IDS evasion

E. Cross site scripting

The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?

A. alert tcp any 22 < > any 22 (msg:SSH connection; class type:misc-attack;sid: 122:rev:1;)

B. alert tcp any any < > any 6000: (msg:X-Windows session; flow:from_server,established;nocase;classtype:misc-attack;sid:101;rev:1;)

C. alert tcp any 23 < > any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;)

D. alert udp any any < > any 5060 (msg:VOIP message; classtype:misc-attack;sid:113; rev:2;)