GIAC MCQ Questions

The IP range 192.0.0.0 to 223.255.255.255 defines the entire Class C address space in the traditional IPv4 classification system. When combined with a subnet mask of 255.255.255.0, this configuration isolates the network portion to the first three octets, leaving only the final octet for host addresses. This specific combination is the standard definition for identifying Class C networks, which historically supported up to 254 hosts per network. Consequently, this option correctly identifies the technical parameters that distinguish Class C from Class A or Class B ranges. Understanding this structure is fundamental for network segmentation and routing decisions in legacy and modern IP addressing schemes.

Wardriving involves driving or walking through an area while using a wireless network interface to detect and log available Wi-Fi networks. This activity specifically focuses on mapping wireless access points and their security settings by moving physically through the environment. The term originates from the practice of driving around to find open networks, making it the precise definition for this scenario. It is a common reconnaissance technique used to identify potential security vulnerabilities in wireless infrastructure. Therefore, this action directly matches the description of going around with equipment to detect wireless networks.

This statement describes the resource reservation mechanism inherent in connection-oriented protocols like ATM or MPLS, where switches along a path negotiate bandwidth before data transmission begins. When the network confirms that every switch on the route has sufficient capacity, the virtual circuit is successfully established and ready for use. This process ensures guaranteed Quality of Service by reserving specific network resources prior to sending any actual user data packets. The setup phase is critical because it transforms a best-effort network into a dedicated path with predictable performance characteristics. Therefore, the description accurately applies to the initial configuration and validation steps of creating a virtual circuit.

A Local Area Network (LAN) is defined as a small network confined to a single location where all equipment is owned by one entity, making it highly susceptible to internal threats and logic bombs. Unlike wide area networks, the centralized ownership means security controls rely heavily on trust within that specific group, leaving the system vulnerable if an insider acts maliciously. The description provided in the question directly matches the fundamental characteristics and inherent risks associated with a LAN environment. Understanding this definition is crucial for recognizing why organizations must implement strict internal access controls and monitoring. This concept forms the basis of network segmentation and internal threat management strategies. Therefore, identifying a LAN based on these specific constraints is the correct response.

The five threat vectors represent the primary pathways attackers use to compromise systems, including external network attacks, telephone-based intrusions, local network breaches, local system exploits, and malicious code infections. This classification covers the full spectrum of entry points from outside sources to insider threats and software-based attacks. Understanding these distinct categories helps organizations implement targeted security controls for each specific risk. It provides a foundational framework for analyzing how different attack methods originate and propagate within an IT environment. Recognizing these vectors is essential for developing a comprehensive incident response and prevention strategy.

Protecting the cryptographic key is the critical step that ensures data remains secure both at rest and in transit. Without a robust key protection strategy, even the strongest encryption algorithms can be easily compromised by unauthorized access. This involves using secure storage mechanisms like Hardware Security Modules (HSMs) or Trusted Platform Modules (TPMs) to prevent key theft. Proper key management ensures that only authorized entities can decrypt sensitive information, maintaining the integrity of the entire security architecture. Consequently, focusing on key protection directly addresses the core requirement of maintaining confidentiality across all data states.

A Wide Area Network (WAN) is defined by its ability to span large geographical distances, connecting multiple Local Area Networks (LANs) and Metropolitan Area Networks (MANs) across dispersed regions. It achieves this extensive reach by utilizing public infrastructure like telephone lines or dedicated leased lines to transmit data between distant locations. This architecture specifically addresses the need for connectivity beyond the limits of local networks, making it the only option that fits the description of a large-scale network using public or leased connections.

The network layer is responsible for managing logical addressing through schemes like IP, enabling devices across different segments to locate one another. It handles routing decisions to determine the best path for data packets to travel between these diverse network segments. By establishing end-to-end connectivity, this layer ensures that communication can occur effectively regardless of the underlying physical topology. Consequently, it serves as the fundamental foundation for inter-network communication and data forwarding.

This calculation represents the standard structure of an Asynchronous Transfer Mode (ATM) cell, which is a fundamental unit of data transmission in ATM networks. The 5-byte header contains routing and control information, while the remaining 48 bytes form the fixed-size payload used to carry user data. This rigid 53-byte total size is a defining characteristic of ATM technology, ensuring efficient switching and low latency for real-time applications.

Class A networks are defined by the first octet ranging from 1 to 126, which corresponds to the IP address block starting at 1.0.0.0 and ending at 127.255.255.255. This range utilizes a subnet mask of 255.0.0.0, allocating the first bit for the network portion and the remaining 31 bits for host addresses. The value 127 is reserved for loopback testing, making 126 the highest usable number for this class. Therefore, the specified range accurately describes the standard definition of a Class A network address space.

Remote maintenance refers to the legitimate capability that permits administrators to connect to a system from a distance to perform troubleshooting or updates. Tools like VNC or PC Anywhere facilitate this by creating secure, authenticated tunnels that allow IT staff to view the desktop and execute commands without physical presence. This functionality is a standard feature in modern operating systems and enterprise management software to ensure rapid issue resolution. It represents a controlled administrative privilege rather than a security vulnerability when properly configured with access controls. Consequently, this definition directly aligns with the description of allowing remote access for system maintenance tasks.

Stateful firewalls are specifically designed to track the state of active network connections, such as TCP sessions or UDP flows, within a dedicated memory table. By maintaining this context, the firewall can intelligently allow return traffic for established connections without inspecting every single packet individually. This mechanism provides a significant security advantage over simple packet filtering because it ensures that only legitimate responses to internal requests are permitted through the network boundary. Consequently, the device described in the question is definitively identified as a stateful firewall due to its core ability to manage connection states dynamically.

The sequence lists the seven hierarchical layers of the Open Systems Interconnection (OSI) model, which is a conceptual framework used to understand network interactions. Each layer, from the physical transmission of bits at the bottom to application services at the top, performs specific functions to enable communication between different systems. This structured approach allows network engineers to design, troubleshoot, and standardize protocols without needing to know the internal details of other layers, making it the fundamental reference for networking architecture.

A rootkit is a malicious software package designed to grant an attacker unauthorized access and maintain persistent control over an operating system. By deeply integrating into the kernel or system libraries, it hides its presence and allows the attacker to execute commands, modify files, and bypass security measures as if they were the system administrator. This capability to do as they please while remaining undetected perfectly matches the description of a cracking tool inserted into the OS. Consequently, it represents a severe threat to system integrity and confidentiality.

A netcat listener serves as the simplest research honeypot by actively listening on a specific port to accept incoming TCP connections. It allows attackers to complete the full three-way handshake, which reveals the nature of the scan without exposing sensitive backend services. By logging these completed handshakes, security analysts can effectively identify and analyze the specific tools and techniques used by potential intruders. This lightweight approach provides valuable intelligence on attack vectors while maintaining a minimal attack surface. Consequently, it is the ideal choice for basic reconnaissance and understanding attacker behavior in a controlled environment.

A Trojan horse is a malicious program that disguises itself as legitimate or helpful software to deceive users into executing it. Once activated, it bypasses security measures to perform unauthorized actions such as opening network ports or installing additional malware without the user's knowledge. This behavior directly matches the description of a program pretending to be useful while secretly compromising the system. Unlike other malware types that may hide in plain sight, Trojans rely entirely on social engineering to trick the victim. The result is a loss of control over the system and potential data theft. Therefore, this definition accurately describes the concept of a Trojan horse.

Malicious code, malware, and compromised web servers represent specific types of external threats that organizations must defend against. These scenarios illustrate how outside actors can damage hardware, leak data, or harm a company's reputation. Therefore, these examples collectively categorize as various external threat concerns that security teams need to identify and mitigate.

A network protocol acts as a standardized set of rules that governs how devices communicate and exchange data across a network. It strictly defines the format, timing, and sequence of messages to ensure that different systems can understand each other reliably. Without these agreed-upon guidelines, computers would lack a common language, making seamless data transmission impossible. Therefore, the description of rules for message format and order directly identifies the concept as a network protocol.

This list enumerates standard port numbers assigned to widely used network protocols like HTTP, FTP, and DNS, which all operate over the Transmission Control Protocol. These specific ports are reserved to ensure that client applications can reliably connect to their corresponding server services using a connection-oriented approach. The sequence represents a fundamental part of the TCP/IP model where each number identifies a distinct application layer service. Understanding these mappings is essential for network administration and troubleshooting connectivity issues. Consequently, the collection clearly illustrates common TCP ports rather than physical layers or security enclaves.

The text explicitly describes the two fundamental categories of connections in Asynchronous Transfer Mode (ATM) networks, distinguishing between Permanent Virtual Circuits (PVC) and Switched Virtual Circuits (SVC). It details that PVCs are pre-configured, often manually, while SVCs are dynamically created using signaling protocols. Therefore, the content directly addresses the classification and operational differences of these specific ATM connection types.

The SQL Slammer Worm is a UDP-based infection that exploited a critical buffer overflow vulnerability in Microsoft SQL Server. It spread rapidly across saturated networks by flooding systems with denial-of-service packets, causing massive network congestion. This specific attack vector and its impact on SQL Server infrastructure make it the definitive match for the described scenario. The worm's ability to propagate without user interaction highlights its unique threat profile in early 2000s network security.

A blind FTP restricts file retrieval to specific, known filenames, preventing users from browsing the directory structure or discovering hidden files. This security mechanism ensures that sensitive data remains inaccessible unless the attacker or user possesses the exact file path and name in advance. By limiting access to predefined targets, it significantly reduces the risk of unauthorized data exfiltration through directory traversal attacks. This controlled access model makes it ideal for environments where only specific files should be downloadable by authenticated users. Consequently, this behavior accurately defines the concept described in the question.

An Intrusion Detection System (IDS) monitors network traffic and classifies every observed activity into one of four fundamental categories based on its validity and malicious nature. These categories are true positives, false positives, true negatives, and false negatives, which represent the core metrics for evaluating an IDS's accuracy and reliability. Understanding these four types is essential for security analysts to assess detection performance and minimize errors in threat identification.

TCP is the most widely used transport protocol because it guarantees reliable data delivery through built-in mechanisms like acknowledgments and retransmissions. It automatically handles errors by detecting lost packets and requesting their resend, ensuring data integrity without requiring complex application-layer fixes. This robust error handling and reliability make it the standard choice for critical internet services like web browsing and email. Consequently, it is the definitive answer for a protocol that prioritizes accuracy and connection stability over raw speed.

This attack relies on the fundamental principle that devices on a local network can often access each other's shared resources without complex authentication. By simply browsing the network, an attacker can discover vulnerable systems, shared folders, or unsecured services exposed by default configurations. The term "simple" highlights that no sophisticated tools or deep packet analysis are required, just the ability to traverse the network's accessible information. This demonstrates how basic network connectivity can be exploited if security policies are not strictly enforced.

Confidentiality, integrity, and availability are universally recognized as the three fundamental pillars of information security, often referred to as the CIA triad. Confidentiality ensures data is accessible only to authorized users, integrity guarantees that data remains accurate and unaltered, and availability ensures systems and data are accessible when needed. These three concepts collectively define the primary objectives that security measures aim to protect and maintain within any IT environment.