GIAC GCED Exam - Topic 7 Question 57 Discussion

Actual exam question for GIAC's GCED exam

Question #: 57
Topic #: 7

[All GCED Questions]

A security device processes the first packet from 10.62.34.12 destined to 10.23.10.7 and recognizes a malicious anomaly. The first packet makes it to 10.23.10.7 before the security devices sends a TCP RST to 10.62.34.12. What type of security device is this?

AHost IDS

BActive response

CIntrusion prevention

DNetwork access control

Show Suggested Answer

Suggested Answer: D

by Kayleigh at Jan 13, 2025, 08:53 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Daron

4 months ago

Pretty sure it's not Network access control.

upvoted 0 times

...

Gladys

4 months ago

Wait, how can it send a TCP RST after the packet gets through?

upvoted 0 times

...

Virgina

4 months ago

I thought it was just a Host IDS?

upvoted 0 times

...

Johna

4 months ago

Definitely an active response!

upvoted 0 times

...

Audry

5 months ago

Sounds like an Intrusion prevention system to me.

upvoted 0 times

...

Dorsey

5 months ago

I feel like this is definitely related to intrusion prevention, but I could see how it might also be interpreted as active response.

upvoted 0 times

...

Wilda

5 months ago

I’m a bit confused. Is it possible for a host IDS to send a TCP RST? I thought they just monitored traffic.

upvoted 0 times

...

Dominga

5 months ago

This sounds like a question we practiced in class! I think it might be an active response since it sends a TCP RST.

upvoted 0 times

...

Lindy

5 months ago

I remember studying about intrusion prevention systems, but I'm not sure if that's the right answer here.

upvoted 0 times

...

Lindsey

5 months ago

This has got to be an intrusion prevention system (IPS). The key giveaway is the security device actively sending the TCP RST to the source IP to block the traffic after detecting a malicious anomaly. That's the textbook behavior of an IPS.

upvoted 0 times

...

Edwin

5 months ago

I'm a little confused by this question. The details about the security device's actions don't seem to fully match the answer choices provided. I'll need to review my notes on the different types of security devices to figure out the best answer here.

upvoted 0 times

...

Evan

5 months ago

Okay, I've got this. The security device is clearly an IPS since it actively blocked the traffic by sending the TCP RST. The fact that the first packet got through is just because of the way IPS systems work - they detect and respond to threats in real-time.

upvoted 0 times

...

Whitley

5 months ago

Hmm, I'm a bit unsure about this one. The fact that the first packet still made it to the destination before the security device responded makes me think it could also be a host-based IDS. I'll need to think this through a bit more.

upvoted 0 times

...

Cherelle

5 months ago

This seems like a classic intrusion prevention system (IPS) scenario. The key details are the security device detecting a malicious anomaly and then sending a TCP RST to the source, which indicates an active response to block the traffic.

upvoted 0 times

...

Heike

10 months ago

As a security professional, I'm impressed by this device's quick reflexes. But as a cat owner, I'm a little worried it might start randomly batting at my internet packets just for fun.

upvoted 0 times

Alyce

9 months ago

D) Network access control

upvoted 0 times

...

Regenia

9 months ago

C) Intrusion prevention

upvoted 0 times

...

Ming

9 months ago

B) Active response

upvoted 0 times

...

Naomi

9 months ago

A) Host IDS

upvoted 0 times

...

Eun

10 months ago

Network access control? Nah, this is way more advanced than that. This is a security device that can see into the packets, analyze them, and respond in real-time. I'm putting my money on Intrusion Prevention System.

upvoted 0 times

...

Dexter

10 months ago

I'm going with C, Intrusion Prevention System. The fact that it recognized the anomaly and took immediate action to stop the attack, but still let the first packet through, is a dead giveaway.

upvoted 0 times

...

Nu

10 months ago

Active response, for sure! Blocking the malicious traffic and sending a reset to the source is a classic active defense move. I bet the security team high-fived each other after that one.

upvoted 0 times

...

Genevive

10 months ago

Hmm, this seems like an intrusion prevention system (IPS) to me. It detected the malicious anomaly and sent a TCP RST to the source, but the first packet still made it to the destination. Gotta love those lightning-fast response times!

upvoted 0 times