GCED Certification Questions – GIAC Certified Enterprise Defender

1. When an IDS system looks for a pattern indicating a known worm, what type of detection method is it using?

2. Why would an incident handler acquire memory on a system being investigated?

3. Which could be described as a Threat Vector?

4. A security device processes the first packet from 10.62.34.12 destined to 10.23.10.7 and recognizes a malicious anomaly. The first packet makes it to 10.23.10.7 before the security devices sends a TCP RST to 10.62.34.12.

What type of security device is this?

5. Which tool uses a Snort rules file for input and by design triggers Snort alerts?

6. Network administrators are often hesitant to patch the operating systems on CISCO router and switch operating systems, due to the possibility of causing network instability, mainly because of which of the following?

7. A company estimates a loss of $2,374 per hour in sales if their website goes down. Their webserver hosting site’s documented downtime was 7 hours each quarter over the last two years. Using the information, what can the analyst determine?

8. To detect worms and viruses buried deep within a network packet payload, Gigabytes worth of traffic content entering and exiting a network must be checked with which of the following technologies?

9. When identifying malware, what is a key difference between a Worm and a Bot?

10. Monitoring the transmission of data across the network using a man-in-the-middle attack presents a threat against which type of data?