GIAC GSNA Exam Dumps

Packet filtering firewalls work on the first three layers of the OSI reference model, which means all the work is done between the network and

physical layers. When a packet originates from the sender and filters through a firewall, the device checks for matches to any of the packet

filtering rules that are configured in the firewall and drops or rejects the packet accordingly. In a software firewall, packet filtering is done by a

program called a packet filter. The packet filter examines the header of each packet based on a specific set of rules, and on that basis, decides

to prevent it from passing (called DROP) or allow it to pass (called ACCEPT). A packet filter passes or blocks packets at a network interface

based on source and destination addresses, ports, or protocols. The process is used in conjunction with packet mangling and Network

Address Translation (NAT). Packet filtering is often part of a firewall program for protecting a local network from unwanted intrusion. This type

of firewall can be best used for network perimeter security.

Answer B is incorrect. An Intrusion detection system (IDS) is software and/or hardware designed to detect unwanted attempts at

accessing, manipulating, and/or disabling of computer systems, mainly through a network, such as the Internet. These attempts may take the

form of attacks, as examples, by crackers, malware and/or disgruntled employees. An IDS cannot directly detect attacks within properly

encrypted traffic. An intrusion detection system is used to detect several types of malicious behaviors that can compromise the security and

trust of a computer system. This includes network attacks against vulnerable services, data driven attacks on applications, host based attacks

such as privilege escalation, unauthorized logins and access to sensitive files, and malware (viruses, trojan horses, and worms).

Answer A is incorrect. A proxy server exists between a client's Web-browsing program and a real Internet server. The purpose of the

proxy server is to enhance the performance of user requests and filter requests. A proxy server has a database called cache where the most

frequently accessed Web pages are stored. The next time such pages are requested, the proxy server is able to suffice the request locally,

thereby greatly reducing the access time. Only when a proxy server is unable to fulfill a request locally does it forward the request to a real

Internet server. The proxy server can also be used for filtering user requests. This may be done in order to prevent the users from visiting

non-genuine sites.

Answer D is incorrect. A honeypot is a term in computer terminology used for a trap that is set to detect, deflect, or in some manner

counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to

be part of a network, but is actually isolated, and monitored, and which seems to contain information or a resource of value to attackers.

Following types of servers are dedicated to provide resources to other hosts on the network:

Mail servers

Print servers

Web servers

Default gateway does not provide resources to hosts on the network.

Monitoring server is not a type of server.

Wireless Zero Configuration (WZC), also known as Wireless Auto Configuration, or WLAN AutoConfig is a wireless connection management

utility included with Microsoft Windows XP and later operating systems as a service that dynamically selects a wireless network to connect to

based on a user's preferences and various default settings. This can be used instead of, or in the absence of, a wireless network utility from

the manufacturer of a computer's wireless networking device. The drivers for the wireless adapter query the NDIS Object IDs and pass the

available network names to the service. WZC also introduce some security threats, which are as follows:

WZC will probe for networks that are already connected. This information can be viewed by anyone using a wireless analyzer and can

be used to set up fake access points to connect.

WZC attempts to connect to the wireless network with the strongest signal. Attacker can create fake wireless networks with high-

power antennas and cause computers to associate with his access point.

Answer D is incorrect. WZC does not interfere in the configuration of encryption and MAC filtering.

Answer B is incorrect. In a ping flood attack, an attacker sends a large number of ICMP packets to the target computer using the ping

command, i.e., ping -f target_IP_address. When the target computer receives these packets in large quantities, it does not respond and

hangs.

Enabling the user must change password at next logon option will make the given password a temporary password. Enabling this option

forces a user to change his existing password at next logon.

Answer B is incorrect. There is no such option in Windows Vista.

Answer D is incorrect. This option sets the password to never expire.

Answer A is incorrect. This option sets the existing password as a permanent password for the user. Only administrators can change

the password of the user.

A relational database is a collection of data items organized as a set of formally-described tables from which data can be accessed or

reassembled in many different ways without having to reorganize the database tables.

Answer B is incorrect. The standard user and application program interface to a relational database is the structured query language

(SQL).

Answer A is incorrect. In addition to being relatively easy to create and access, a relational database has the important advantage of

being easy to extend.

Answer D is incorrect. A relational database is a set of tables containing data fitted into predefined categories. Each table (which is

sometimes called a relation) contains one or more data categories in columns. Each row contains a unique instance of data for the categories

defined by the columns.