GIAC Exam GSNA Topic 2 Question 21 Discussion

Actual exam question for GIAC's GSNA exam

Question #: 21
Topic #: 2

You are concerned about rootkits on your network communicating with attackers outside your network. Without using an IDS how can you detect this sort of activity?

ABy setting up a DMZ.

BYou cannot, you need an IDS.

CBy examining your domain controller server logs.

DBy examining your firewall logs.

Show Suggested Answer

Suggested Answer: D

Firewall logs will show all incoming and outgoing traffic. By examining those logs you can detect anomalous traffic, which can indicate the presence of malicious code such as rootkits.

Answer B is incorrect. While an IDS might be the most obvious solution in this scenario, it is not the only one.

Answer C is incorrect. It is very unlikely that anything in your domain controller logs will show the presence of a rootkit, unless that

rootkit is on the domain controller itself.

Answer A is incorrect. A DMZ is an excellent firewall configuration but will not aid in detecting rootkits.

by Kanisha at May 06, 2022, 02:39 PM

Limited Time Offer

25%

Off

Get Premium GSNA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!