GIAC GSNA Exam Questions

The TCP 172.16.1.0/24 any any 443 HTTPs permit rule is used to allow internal users to access secure external websites.

Answer A is incorrect. The TCP 172.16.1.0/24 any any 80 HTTP permit rule is used to allow internal users to access external

websites (secure & unsecure both).

Answer C is incorrect. The TCP 172.16.1.0/24 any any 80 HTTP deny rule is used to deny internal users to access external websites.

Answer B is incorrect. The TCP 172.16.1.0/24 any any 25 SMTP permit rule is used to allow internal mail servers to deliver mails to

external mail servers.

Following are the limitations of cross site request forgeries to be successful:

Following are the limitations of cross site request forgeries to be successful:

1.The attacker must target either a site that doesn't check the Referer header (which is common) or a victim with a browser or plugin bug

that allows Referer spoofing (which is rare).

2.The attacker must find a form submission at the target site that does something useful to the attacker (e.g., transfers money, or

changes the victim's e-mail address or password).

3.The attacker must determine the right values for all the form inputs: if any of them are required to be secret authentication values or

IDs that the attacker can't guess, the attack will fail.

4.The attacker must lure the victim to a Web page with malicious code while the victim is logged in to the target site.

Since, the attacker can't see what the target Web site sends back to the victim in response to the forged requests, unless he exploits a cross-

site scripting or other bug at the target Web site. Similarly, the attacker can only 'click' any links or submit any forms that come up after the

initial forged request, if the subsequent links or forms are similarly predictable. (Multiple 'clicks' can be simulated by including multiple images

on a page, or by using JavaScript to introduce a delay between clicks).

Answer C and D are incorrect. These two options are the preventions from cross site request forgeries. Web sites can be prevented

from cross site request forgeries (CSRF) by applying the following countermeasures available:

Requiring authentication in GET and POST parameters, not only cookies.

Checking the HTTP Referer header.

Ensuring there's no crossdomain.xml file granting unintended access to Flash movies.

Limiting the lifetime of authentication cookies.

Requiring a secret, user-specific token in all form submissions prevents CSRF; the attacker's site can't put the right token in its submissions.

Individual Web users can do relatively little to prevent cross-site request forgery. Logging out of sites and avoiding their 'remember me'

features can mitigate CSRF risk; not displaying external images or not clicking links in 'spam' or unreliable e-mails may also help.

In the pre-attack phase, there are seven steps, which have been defined by the EC-Council, as follows:

1.Information gathering

2.Determining network range

3.Identifying active machines

4.Finding open ports and applications

5.OS fingerprinting

6.Fingerprinting services

7.Mapping the network

Answer C is incorrect. In the enumeration phase, the attacker gathers information such as the network

user and group names, routing

tables, and Simple Network Management Protocol (SNMP) data. The techniques used in this phase are as follows:

1.Obtaining Active Directory information and identifying vulnerable user accounts

2.Discovering NetBIOS names

3.Employing Windows DNS queries

4.Establishing NULL sessions and queries

According to the scenario, John can replace the TAB characters with single space characters with the expand command. With the expand -t 1

data.txt > data.txt command, the TABs of data.txt are changed into single spaces and are redirected by using the > command into the

data.txt file. Now, John can use the data.txt file as the input file for his data mining software.

In order to take a snapshot of the router running configuration and archive running configuration of the router to persistent storage, you

should secure the boot configuration of the router using the secure boot-config command.

Answer D is incorrect. You can enable the image resilience, if you want to secure the Cisco IOS image.

Answer C is incorrect. By verifying the security of bootset, you can examine whether or not the Cisco IOS Resilient Configuration is

enabled and the files in the bootset are secured.

Answer B is incorrect. By restoring an archived primary bootset, you can restore a primary bootset from a secure archive after an

NVRAM has been erased or a disk has been formatted.