Get GIAC GSNA Exam Practice Questions - Real and Updated

Answer : D

Routinely doing site surveys (or better still, having them automatically conducted frequently) is the only way to know what is connected to

your network. And it will reveal any rogue access points.

Answer B is incorrect. While anti virus software is always a good idea, it will do nothing to prevent rogue access points.

Answer A is incorrect. While anti-spyware software is always a good idea, it will do nothing to prevent rogue access points.

Answer C is incorrect. A protocol analyzer will help you analyze the specific traffic on a given node, but won't be much help in directly

detecting rogue access points.

Answer : D

Configuration of VPN access is not mandatory. It is configured on the basis of requirement.

Answer C, B, and A are incorrect. All these steps are mandatory for the configuration of the ISA Server 2006 firewall.

Answer : B, C

For security, you will have to rename the Administrator account and disable the Guest account.

Renaming the Administrator account will ensure that hackers do not break into the network or computer by guessing the password of the

Administrator account. You can also create a fake Administrator account that has no privileges and audit its use to detect attacks.

Disabling the Guest account will prevent users who do not have a domain or local user account from illegally accessing the network or

computer.

By default, the Guest account is disabled on systems running Windows 2000 Server. If the Guest account is enabled, you will have to disable

it.

Answer : B, C, D

NetBIOS NULL session vulnerabilities are hard to prevent, especially if NetBIOS is needed as part of the infrastructure. One or more of the

following steps can be taken to limit NetBIOS NULL session vulnerabilities:

1.Null sessions require access to the TCP 139 or TCP 445 port, which can be disabled by a Network Administrator.

2.A Network Administrator can also disable SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from the interface.

3.A Network Administrator can also restrict the anonymous user by editing the registry values:

a.Open regedit32, and go to HKLM\SYSTEM\CurrentControlSet\LSA.

b.Choose edit > add value.

Value name: RestrictAnonymous

Data Type: REG_WORD

Value: 2

Answer A is incorrect. TCP port 53 is the default port for DNS zone transfer. Although disabling it can help restrict DNS zone transfer

enumeration, it is not useful as a countermeasure against the NetBIOS NULL session enumeration.

Answer : C

John is performing cookie poisoning. In cookie poisoning, an attacker modifies the value of cookies before sending them back to the server. On

modifying the cookie values, an attacker can log in to any other user account and can perform identity theft. The following figure explains how

cookie poisoning occurs:

For example:

The attacker visits an online shop that stores the IDs and prices of the items to buy in a cookie. After selecting the items that he wants to

buy, the attacker changes the price of the item to 1.

Original cookie values:

ItemID1= 2

ItemPrice1=900

ItemID2=1

ItemPrice2=200

Modified cookie values:

ItemID1= 2

ItemPrice1=1

ItemID2=1

ItemPrice2=1

Now, the attacker clicks the Buy button and the prices are sent to the server that calculates the total price.

Another use of a Cookie Poisoning attack is to pretend to be another user after changing the username in the cookie values:

Original cookie values:

LoggedIn= True

Username = Mark

Modified cookie values:

LoggedIn= True

Username = Admin

Now, after modifying the cookie values, the attacker can do the admin login.

Answer A is incorrect. A cross site scripting attack is one in which an attacker enters malicious data into a Website. For example, the

attacker posts a message that contains malicious code to any newsgroup site. When another user views this message, the browser

interprets this code and executes it and, as a result, the attacker is able to take control of the user's system. Cross site scripting attacks

require the execution of client-side languages such as JavaScript, Java, VBScript, ActiveX, Flash, etc. within a user's Web environment. With

the help of a cross site scripting attack, the attacker can perform cookie stealing, sessions hijacking, etc.