GIAC Certified Intrusion Analyst GCIA Practice Questions with Explanations

Correct answer: B

BootX is the default bootloader for Mac OS X systems. It is responsible for loading the kernel and initializing the boot process on Apple Macintosh computers. LILO and GRUB are Linux bootloaders, while NT Loader is used by Windows systems.

Why the other options are wrong:

• A. LILO is the Linux Loader used on Linux systems, not Mac OS X.
• C. NT Loader is the bootloader for Windows NT-based systems, not Mac OS X.
• D. GRUB is the Grand Unified Bootloader used primarily on Linux systems, not Mac OS X.

Correct answer: C

MX (Mail Exchange) records are used in DNS to specify the mail servers responsible for receiving email for a domain. They are essential for directing email traffic to the correct mail server. ANAME is not a standard DNS record type, SOA defines zone parameters, and CNAME creates aliases for hostnames.

Why the other options are wrong:

• A. ANAME is not a standard DNS resource record type.
• B. SOA records define Start of Authority parameters for a DNS zone, not mail server entries.
• D. CNAME records create canonical name aliases but are not used specifically for mail server entries.

Correct answer: D

Intercepting proxy servers, also called transparent proxies or forced proxies, intercept client requests without requiring explicit client configuration. They transparently handle traffic by intercepting it at the network level, forcing all traffic through the proxy without the user's knowledge or manual configuration. The other proxy types require explicit configuration or serve different purposes.

Why the other options are wrong:

• A. Tunneling proxy servers establish encrypted tunnels for secure communication but are not referred to as transparent proxies.
• B. Reverse proxy servers handle requests from clients on behalf of backend servers and are not transparent proxies.
• C. Anonymous proxy servers hide the client's identity but require explicit configuration and are not the same as transparent proxies.

Correct answer: A

A hash function, also called a message digest algorithm, is a cryptographic function that produces a fixed-size string of bytes from input data. The output is commonly referred to as a message digest. While hashing algorithm (option B) describes the same concept, hash function is the more precise and commonly accepted terminology for what produces a message digest. Spider and message authentication code serve different purposes.

Why the other options are wrong:

• B. Hashing algorithm describes the process but is less precise than hash function as the answer to what produces a message digest.
• C. A spider is a web crawler used for indexing web pages, unrelated to message digests.
• D. A message authentication code (MAC) is used for authentication and integrity verification but is distinct from a simple message digest/hash function.

Correct answer: D

The exploit code is submitted to a forum and stored on the site, so it is served back to every visitor of the infected page and executes automatically without the victim clicking a crafted link. Injecting script that is saved in the application's data store (message boards, comments, profiles) and replayed to other users is the defining characteristic of a persistent, or stored, XSS attack, and it enables session hijacking and history theft as described.

Why the other options are wrong:

• A. DOM-based XSS occurs entirely in client-side script manipulating the document object model; the payload is not stored on the server and delivered to all forum visitors.
• B. Non-persistent (reflected) XSS requires the victim to follow a specially crafted request; the payload is not saved on the site as it is here.
• C. SAX is an event-driven XML parsing API, not a category of cross-site scripting.

Correct answer: B

The correct order for collecting forensic evidence on Windows systems prioritizes volatile data first (which is lost when powered down), then progresses to less volatile sources. Volatile data comes first, followed by file slack, file system, registry, memory dumps, system state backup, and finally internet traces. This sequence ensures that the most perishable evidence is captured before examining more persistent storage artifacts.

Why the other options are wrong:

• A. Places registry before file system, which is incorrect; file system should be examined before registry in the standard forensic order.
• C. Incorrectly positions internet traces early in the sequence; they should be examined later after core system artifacts.
• D. Places memory dumps after system state backup and internet traces, which violates the principle of capturing volatile data before less volatile sources.

Correct answer: B

A network-based Intrusion Detection System (IDS) is specifically designed to monitor all traffic on a network segment in real-time and generate alerts when suspicious patterns or known attacks are detected. It operates at the network level, analyzing traffic across multiple hosts, making it ideal for monitoring an entire local network. Host-based IDS monitors individual systems, firewalls control access rather than detect attacks, and DMZ firewalls are architectural components, not monitoring tools.

Why the other options are wrong:

• A. Verbose firewall logging records events but does not actively detect and alert on attacks in real-time.
• C. A DMZ firewall is a network architecture component used for segmentation, not for monitoring suspicious activities.
• D. Host-based IDS monitors individual systems only, not all network traffic across the local network.

Correct answer: E

The tool described is NetStumbler, a Windows-based wireless network detector. While it can be used for some of the mentioned purposes, its primary and defining feature is the ability to display signal strength, MAC addresses, SSIDs, and channel details, and to create graphs and alarms based on 802.11 data including signal strength visualization. This capability distinguishes it from other tools and is its most characteristic use case for legitimate WLAN troubleshooting and analysis.

Why the other options are wrong:

• A. War driving is an unauthorized activity; the tool can be misused for this but it is not a legitimate primary purpose.
• B. While unauthorized access point detection is a use case, it is not the primary defining feature of the tool.
• C. Detecting WLAN interference causes is a use case, but not the most characteristic primary feature.
• D. WEP ICV error tracking is a specific function, but not the primary comprehensive feature set of the tool.

Correct answer: C

ZFS (Zettabyte File System) is a file system designed by Sun Microsystems. It is known for its advanced features including copy-on-write functionality, snapshots, and built-in data integrity checking. NTFS was designed by Microsoft, CIFS is a network protocol, and ext2 was designed for Linux systems.

Why the other options are wrong:

• A. NTFS is the New Technology File System designed by Microsoft, not Sun Microsystems.
• B. CIFS is the Common Internet File System, a network protocol, not a file system designed by Sun.
• D. ext2 is the second extended file system designed for Linux by Rémy Card, not by Sun Microsystems.

Correct answer: B

Global unicast addresses in IPv6 are equivalent to publicly routable IPv4 addresses. They are assigned by IANA and are globally unique and routable on the internet. Site-local addresses are deprecated and limited to a site, link-local addresses are only for local communication, and loopback addresses are for testing only.

Why the other options are wrong:

• A. Site-local addresses are not globally routable and are limited to a specific site.
• C. Link-local addresses are only used for communication on the same local network segment.
• D. Loopback addresses are reserved for testing and do not provide publicly routable connectivity.

Correct answer: D

SNMP (Simple Network Management Protocol) agents listen on UDP port 161 for polling requests from management stations. This is the standard port for SNMP query operations. TCP port 110 is for POP3, port 25 is for SMTP, and port 80 is for HTTP-none of which are used for SNMP management.

Why the other options are wrong:

• A. TCP port 110 is used for POP3 email protocol, not SNMP.
• B. TCP port 25 is used for SMTP email protocol, not SNMP.
• C. TCP port 80 is used for HTTP web protocol, not SNMP.

Correct answer: D

MessenPass is a Helix utility designed to recover passwords stored by instant messenger programs on Windows systems, including the specific credentials needed for forensic investigation. Asterisk Logger displays hidden passwords represented by asterisks, Access PassView recovers passwords from web browsers, and Mail PassView recovers email passwords-none of which are designed for instant messenger password recovery.

Why the other options are wrong:

• A. Asterisk Logger is used to reveal passwords hidden by asterisks, not recover instant messenger passwords.
• B. Access PassView is designed to recover passwords from web browsers and applications, not specifically instant messengers.
• C. Mail PassView is used to recover email account passwords, not instant messenger credentials.

Correct answer: D

Device Seizure is a specialized tool designed to recover deleted data from multimedia- enabled mobile phones, including text messages, photos, and call logs. FAU is a file analysis utility, FTK Imager is used for disk imaging and data recovery on computers rather than phones, and Galleta is designed specifically to recover cookies from Internet Explorer, not mobile phone data.

Why the other options are wrong:

• A. FAU is a general file analysis utility, not specialized for mobile phone data recovery.
• B. FTK Imager is primarily designed for computer disk imaging and forensics, not mobile phone recovery.
• C. Galleta is used to recover Internet Explorer cookies, not mobile phone data like text messages and photos.

Correct answer: A

Hping2 can craft ICMP packets and hide data or scan results inside them, and ICMP type 13 (timestamp request) traffic is one of the message types it uses to probe hosts and tunnel through a firewall that only permits port 80. Blocking ICMP type 13 messages at the firewall removes that covert channel and the associated host discovery capability, protecting the internal network while leaving the required web service reachable.

Why the other options are wrong:

• B. Port 21 is FTP control traffic; Hping2's ICMP-based probing and tunneling does not depend on it.
• C. Blocking outgoing port 53 breaks DNS resolution and does nothing to stop ICMP- based scanning.
• D. ICMP type 3 (destination unreachable) messages are error responses needed for normal path and MTU behavior, and blocking them does not close the scanning channel Hping2 uses here.

Correct answer: C

Nikto is a web server scanner that performs comprehensive testing against web servers. It checks for over 6,100 potentially dangerous files, outdated server software, server configuration issues, and other vulnerabilities. It is specifically designed for web server assessment and is widely used in security testing. Dsniff is a sniffing tool, Snort is an IDS, and Sniffer is a packet capture tool-none of which specialize in web server vulnerability scanning.

Why the other options are wrong:

• A. Dsniff is a network sniffing and spoofing tool, not a web server vulnerability scanner.
• B. Snort is an intrusion detection system focused on network traffic analysis, not web server scanning.
• D. Sniffer is a packet capture tool for network traffic analysis, not a web vulnerability assessment tool.

Correct answer: C

Statistical anomaly detection is a behavior-based IDS detection method that establishes a baseline of normal network behavior and flags deviations from that baseline as potential attacks. This approach does not rely on signatures or known attack patterns but instead detects unusual behavior patterns. Knowledge-based, protocol, and pattern matching detection are all signature-based or rule-based methods that rely on predefined attack signatures rather than behavioral analysis.

Why the other options are wrong:

• A. Knowledge-based detection is signature-based detection that matches known attack patterns, not behavior-based.
• B. Protocol detection relies on protocol analysis rules, not behavioral anomalies.
• D. Pattern matching detection uses predefined signatures to identify attacks, which is signature-based, not behavior-based.

Correct answer: D

In Microsoft ISA Server, intrusion detection features must be explicitly enabled through the 'Enable Intrusion detection' checkbox on the General tab page of the IP Packet Filters Properties dialog box. If this checkbox is not selected, all intrusion detection capabilities remain disabled regardless of other configurations. The other options relate to PPTP access, IP routing, and packet logging-none of which directly control whether intrusion detection is enabled.

Why the other options are wrong:

• A. PPTP firewall settings control VPN access, not intrusion detection capability.
• B. IP routing settings control packet forwarding, not intrusion detection functionality.
• C. Packet logging from allow filters controls audit logging, not whether intrusion detection is active.

Correct answer: B

Code injection attacks involve manipulating programming language code (such as SQL, Perl, Java, or Python) embedded in web pages to execute malicious instructions. This includes SQL injection, command injection, and other variants where attacker-supplied input is interpreted as executable code. While command injection is a specific type of code injection focusing on OS commands, the broader category that encompasses manipulation of multiple programming languages is code injection attack.

Why the other options are wrong:

• A. Command injection is a subset of code injection focusing specifically on operating system commands.
• C. Cross-Site Request Forgery (CSRF) tricks users into performing unwanted actions, not manipulating code.
• D. Cross-Site Scripting (XSS) injects scripts into web pages but is not primarily about manipulating existing code languages like SQL or Perl.

Correct answer: A

PING is the standard utility used to verify connectivity to a host on a network. It sends ICMP Echo Request packets and waits for Echo Reply responses, confirming that a host is reachable and responding. TELNET is used to establish remote sessions, NETSTAT displays network statistics and connections, and TRACERT traces the path to a host- none of which are primary connectivity verification tools.

Why the other options are wrong:

• B. TELNET establishes remote terminal sessions, not simply verify connectivity.
• C. NETSTAT displays network statistics, connection states, and routing information, not basic connectivity.
• D. TRACERT traces the route to a destination but is more complex than simple connectivity verification.

Correct answer: B

The CHKDSK command with switches /R /F is used to check a hard disk for bad sectors and fix errors. The /R switch locates bad sectors and recovers readable information, while the /F switch fixes errors found on the disk. Together, these switches accomplish the task of checking for bad sectors and fixing errors. The /I, /C, /L, /V, and /X switches serve other purposes such as skipping cycle checking, logging, or verbosity.

Why the other options are wrong:

• A. CHKDSK /I skips checking of cycles within the file system, not a repair option for bad sectors.
• C. CHKDSK /C /L controls cycle checking and logging but does not repair bad sectors.
• D. CHKDSK /V /X displays verbose output and fixes errors on external drives, but /V alone is not sufficient for bad sector repair.

Correct answer: B

On Mac OS X systems, holding the 'N' key during startup initiates network boot from the Network Interface Controller (NIC), allowing the system to boot from a network-based image or server. The 'D' key boots to diagnostics, 'Z' is not a standard boot key, and 'C' boots from an optical disc-none of these are used for network booting on Mac OS X.

Why the other options are wrong:

• A. The 'D' key initiates the Apple Diagnostics utility, not network boot.
• C. The 'C' key boots from an optical disc (CD/DVD), not from the network.
• D. The 'Z' key is not a recognized Mac OS X startup key for any standard function.

Correct answer: C

Secure Authentication for EnCase (SAFE) is the server component of EnCase Enterprise that authenticates examiners, administers rights and manages encrypted, authenticated sessions with servlets installed on target machines. It allows an investigator to preview and acquire a forensic image of a remote system across the network while the transmitted evidence is protected by encryption and verified by hashing, which is precisely the secure over-the-network acquisition method described.

Why the other options are wrong:

• A. A Linux Live CD is booted locally at the suspect machine and provides no built-in secure, authenticated network acquisition framework.
• B. A DOS boot disk is a legacy local-boot imaging method and offers no encrypted network transport or authentication.
• D. EnCase with a hardware write blocker is a local, physically attached acquisition of a drive rather than an image taken over the network.

Correct answer: C

Fpipe is a Windows utility specifically designed to redirect network traffic from one port to another, allowing attackers to redirect TCP port 80 traffic to UDP port 40 to bypass firewall rules. PsExec is used for remote process execution, PsList displays running processes, and Cain is a password recovery and network sniffing tool-none of these perform port redirection.

Why the other options are wrong:

• A. PsExec is for remote command execution, not port redirection.
• B. PsList displays process information, not port redirection capabilities.
• D. Cain is a password cracking and network analysis tool, not a port redirection utility.

Correct answer: D

Signature-based detection identifies attacks by looking for known patterns or signatures within network traffic and URLs. The question describes searching for specific strings that identify attacks, which is the definition of signature-based detection. Anomaly-based detection looks for deviations from normal behavior, policy-based detection enforces security policies, and honeypot detection uses decoy systems-none match the described string-matching approach.

Why the other options are wrong:

• A. Anomaly-based detection identifies deviations from normal behavior, not specific attack signatures.
• B. Policy-based detection enforces predefined security policies, not signature pattern matching.
• C. Honeypot detection uses decoy systems to trap attackers, not URL string analysis.

Correct answer: D

DHCP (Dynamic Host Configuration Protocol) operates on UDP port 67 for the server side. When a workstation boots and broadcasts a DHCP Discover message to obtain an IP address configuration, it sends the request to UDP port 67. TCP 161 is for SNMP, UDP 69 is for TFTP, and TCP 21 is for FTP-none are used for dynamic IP address assignment.

Why the other options are wrong:

• A. TCP 161 is used for SNMP (Simple Network Management Protocol), not DHCP.
• B. UDP 69 is used for TFTP (Trivial File Transfer Protocol), not DHCP.
• C. TCP 21 is used for FTP (File Transfer Protocol), not DHCP.

Correct answer: B

Cryptography is the primary technique for modifying messages (encrypting them) and protecting communications against hacking attacks during transmission over the Internet. It provides confidentiality, integrity, and authentication. Risk analysis is an assessment methodology, firewall security is a network perimeter defense, and the OODA loop is a decision-making framework-none are techniques for directly modifying and protecting messages in transit.

Why the other options are wrong:

• A. Risk analysis is an assessment process, not a message modification or security technique.
• C. Firewall security protects network perimeters but does not modify or encrypt messages in transit.
• D. OODA loop is a decision-making framework, not a message security technique.

Correct answer: D

Firewalls inspect both transport layer port numbers (TCP/UDP ports) and application layer headers to determine whether to allow or block packets. This dual-layer inspection enables firewalls to make granular decisions about which ports and applications can access the enterprise network. The presentation and session layers (options B and C) are not typically where port-level filtering occurs, and option A incorrectly combines network layer headers with transport layer port numbers.

Why the other options are wrong:

• A. Network layer headers do not contain port information; ports are a transport layer concept.
• B. The presentation and session layers are not where firewall port filtering occurs.
• C. Network layer headers lack port numbers, and session layer is not involved in port- level packet filtering.

Correct answer: D

The tcpdump -A flag displays the contents of packets in ASCII format, allowing analysts to view the actual payload data within captured packets. The -q flag produces quiet output with less detail, -v increases verbosity but focuses on header information, and -n prevents DNS name resolution-none of these display packet contents like -A does.

Why the other options are wrong:

• A. The -q flag enables quiet mode, showing less information, not packet contents.
• B. The -v flag increases verbosity of header information, not payload content display.
• C. The -n flag disables DNS name resolution but does not display packet contents.

Correct answer: D

The ping -l command (lowercase L) is used to specify the packet size to be sent. On Windows and Linux systems, this flag allows you to set a custom packet size larger than the default 32 bytes. Option A (-a) resolves addresses to hostnames, B (-4) forces IPv4, and C (-t) sets continuous ping mode.

Why the other options are wrong:

• A. The -a flag is used for address resolution, not packet size specification.
• B. The -4 flag forces IPv4 protocol selection, not packet size control.
• C. The -t flag enables continuous ping mode on Windows, not packet size adjustment.

Correct answer: D

SSH (Secure Shell) protocol uses port 22 as its standard default port for secure remote connections. Port 80 is used for HTTP, port 21 for FTP, and port 443 for HTTPS/SSL, none of which are SSH protocols.

Why the other options are wrong:

• A. Port 80 is the standard port for unencrypted HTTP web traffic.
• B. Port 21 is the standard port for File Transfer Protocol (FTP).
• C. Port 443 is the standard port for HTTPS/SSL encrypted web traffic.

Correct answer: A

A valid MAC address consists of 48 bits represented as six pairs of hexadecimal digits separated by hyphens or colons (A3-07-B9-E3-BC-F9 is correct). Option B is an IP address format, C uses an incorrect notation with periods and longer segments, and D uses binary representation with incorrect separators for MAC addresses.

Why the other options are wrong:

• B. This is an IPv4 address format with decimal octets, not a MAC address.
• C. This format uses periods and groups of four hexadecimal characters, which is not valid MAC address notation.
• D. This appears to be binary representation with incorrect separators; MAC addresses use hexadecimal with hyphens or colons.

Correct answer: B

vCard (Virtual Card) is the standard file format used to store contact information on Apple devices including iPods. vCard files have a .vcf extension and are widely supported across platforms. HFS+ is Apple's filesystem, FAT32 is a general file system, and hCard is an HTML microformat, none of which are used for storing contact data on iPods.

Why the other options are wrong:

• A. HFS+ is Apple's file system format, not a contact information storage format.
• C. FAT32 is a general-purpose file system, not a contact information format.
• D. hCard is an HTML microformat for representing contact information in web pages, not used by iPods.

Correct answer: D

The correct sequence of a digital investigation Standard Operating Procedure is: Request for service (initiating the investigation), initial analysis (preliminary assessment), data collection (gathering evidence), data analysis (examining the collected data), and data reporting (documenting findings). This logical flow ensures proper documentation, chain of custody, and systematic investigation progression.

Why the other options are wrong:

• A. This sequence places initial analysis too early before requesting service, disrupting proper procedure initiation.
• B. This places initial analysis before the formal request for service, violating proper investigation protocol.
• C. This places data reporting before data analysis, which is illogical since findings must be analyzed before reporting.

Correct answer: C

The IP identification number (also called the Identification field in the IP header) is used to reassemble fragmented datagrams at the destination. Each datagram is assigned a unique identification number, allowing the receiving host to match fragments belonging to the same original datagram. MAK ID is not a networking concept, IP address identifies hosts but not fragments, and SSID is for wireless networks.

Why the other options are wrong:

• A. MAK ID (Microsoft Activation Key ID) is not related to IP packet fragmentation or reassembly.
• B. While IP addresses identify source and destination, they do not specifically identify individual fragments for reassembly.
• D. SSID (Service Set Identifier) is used to identify wireless networks, not for IP fragment reassembly.

Correct answer: B

SSL (Secure Sockets Layer) operates at the transport layer (Layer 4), providing encryption for all data passing through it, while S-HTTP (Secure HyperText Transfer Protocol) operates at the application layer (Layer 7) and encrypts only HTTP messages. This fundamental difference means SSL protects all protocols above it, whereas S-HTTP provides application-specific encryption for HTTP only.

Why the other options are wrong:

• A. SSL does not operate at the network layer; it operates at the transport layer, not Layer 3.
• C. This reverses the correct layer assignments; SSL is at transport layer, not application layer.
• D. S-HTTP does not operate at the network layer; it operates at the application layer, and SSL is not at the application layer.

Correct answer: A

NIDS (Network Intrusion Detection System) cannot proactively detect anomalies related to a specific computer because it operates at the network level monitoring traffic flow, not the individual computer's internal processes or behaviors. HIDS (Host-based IDS) monitors a specific computer, firewalls protect individual computers, and anti-virus scanners actively scan for threats on the computer itself-all of which can proactively detect local anomalies.

Why the other options are wrong:

• B. A firewall installed on a computer can proactively block suspicious connections and detect anomalous network behavior on that host.
• C. HIDS (Host Intrusion Detection System) specifically monitors individual computer activity and can proactively detect local system anomalies.
• D. Anti-virus scanners proactively scan files and processes on a computer to detect malware and suspicious behavior.

Correct answer: B

IPv6 addresses are 128 bits long and are written in colon-hexadecimal notation: eight groups of four hexadecimal digits separated by colons, for example 2001:0db8:0000:0000:0000:ff00:0042:8329, with leading zeros omitted and one run of zero groups optionally compressed to a double colon.

Why the other options are wrong:

• A. Colon-dot is not a defined address format for IPv6.
• C. Hexadecimal-dot notation is not used; hexadecimal groups in IPv6 are separated by colons, not dots.
• D. Dot (dotted decimal) notation is the four-octet format used for IPv4 addresses.

Correct answer: B

WinHex is a comprehensive hexadecimal editor and disk utility used extensively in digital forensics. It can examine deleted files, fragmented files, corrupted data, analyze network- captured data, and access physical RAM and virtual memory contents. These capabilities align precisely with the investigative tasks described in the scenario.

Why the other options are wrong:

• A. Vedit is a text editor, not a forensic analysis tool for examining binary data and memory.
• C. HxD is a hexadecimal editor but is primarily for basic hex editing rather than the comprehensive forensic analysis and memory examination described.
• D. Evidor does not exist as a recognized forensic tool in standard IT security frameworks.

Correct answer: A

IPTables is the packet filtering framework built on the Netfilter architecture introduced with the Linux 2.4 kernel. It allows an administrator to define chains and rules that accept, drop, or forward packets based on source and destination IP addresses, ports, protocols, and connection state, thereby acting as the firewall for a Linux 2.4 system.

Why the other options are wrong:

• C. IPChains was the packet filter used with the Linux 2.2 kernel and was superseded by IPTables in 2.4.
• D. OpenSSH provides encrypted remote login and file transfer, not firewalling.

Correct answer: D

Network enumeration is the systematic process of discovering and gathering detailed information about network resources, including usernames, group memberships, shares, and services running on networked computers. It is the active probing technique that extracts specific network configuration and resource information.

Why the other options are wrong:

• A. Network tap is a passive monitoring technique that captures traffic for analysis, not actively retrieves user and service information.
• B. Packet crafting involves creating custom network packets for testing, not specifically retrieving user and service information.
• C. Network mapping identifies network topology and connected systems but does not specifically retrieve usernames, groups, shares, and services details.

Correct answer: A

IPv6 Router Discovery (SLAAC - Stateless Address AutoConfiguration) relies on routers sending Router Advertisement messages. A properly configured IPv6 router is essential for automatic address configuration to function, as it provides the network prefix information and other configuration parameters needed for hosts to self-configure their IPv6 addresses.

Why the other options are wrong:

• B. Network load balancers are not required for basic IPv6 router discovery functionality.
• C. CAT 6 cables are physical infrastructure upgrades unrelated to IPv6 router discovery protocols.
• D. Internet Explorer 8 is a web browser; router discovery operates at the network layer independently of client applications.

Correct answer: B

Cipher Block Chaining (CBC) Mode is specified as the default encryption algorithm for the ESP (Encapsulating Security Payload) extension header in IPv6 according to IPsec standards. CBC mode provides strong encryption by making each ciphertext block dependent on the previous one, enhancing security against pattern analysis.

Why the other options are wrong:

• A. Propagating Cipher Block Chaining (PCBC) Mode is not used as the standard for IPv6 ESP encryption.
• C. Electronic Codebook (ECB) Mode is considered insecure for most purposes due to pattern preservation and is not the IPv6 ESP default.
• D. Cipher Feedback (CFB) Mode is a stream cipher mode, not the standard block cipher mode used for IPv6 ESP encryption.

Correct answer: B

WPA with 802.1X authentication (enterprise mode) is the strongest option listed because each user is authenticated individually against a RADIUS server using EAP, and unique per-session encryption keys are generated and rotated dynamically. This removes the shared secret that other modes depend on and provides centralized user-level authentication and accounting.

Why the other options are wrong:

• A. WPA with a Pre Shared Key relies on one passphrase shared by all users, which can be captured and cracked offline if it is weak and cannot identify individual users.
• C. WEP uses a static key with a weak RC4 initialization vector scheme and is broken in minutes.
• D. WPA stated generally, without 802.1X, defaults to the weaker personal shared-key deployment.

Correct answer: C

IPsec uses IP protocol 50 (ESP - Encapsulating Security Payload) for encrypted tunnels and L2TP uses UDP port 1701. When configuring IP filters at headquarters for a secure connection to Boston, you must allow source traffic FROM Boston and destination traffic TO headquarters. The filters should specify port 1701 and protocol 50 to properly handle L2TP/IPsec traffic bidirectionally.

Why the other options are wrong:

• A. This specifies port 80 (HTTP) instead of port 1701 (L2TP), and the source/destination directions are reversed for a headquarters perspective.
• B. While the protocol 50 is correct, port 80 is wrong for L2TP, and the port number is the primary issue here.
• D. This is incomplete as it only specifies one direction of filters and omits the destination filters needed for bidirectional communication.

Correct answer: B

John the Ripper is a widely-used, cross-platform password cracking tool that runs on Unix, Linux, Windows, and other operating systems. It is specifically designed for cracking Unix and Linux passwords and supports multiple hash types commonly found on these systems.

Why the other options are wrong:

• A. Brutus is a Windows-based password cracking tool and does not run natively on Unix/Linux environments.
• C. Cain and Abel is exclusively a Windows-based tool for password recovery and network analysis.
• D. Ophcrack is primarily designed for Windows password cracking via rainbow tables and does not effectively target Unix/Linux passwords.

Correct answer: C

The correct command to enable DNS GlobalNames Zone lookups on Windows Server 2008 is 'dnscmd <server name> /config /enableglobalnamessupport 1'. The parameter 'enableglobalnamessupport' with value '1' activates the GlobalNames Zone feature, allowing single-label DNS queries to be resolved in the GlobalNames Zone instead of relying on NetBIOS.

Why the other options are wrong:

• A. The parameter 'enableglobalnames' is incorrect; the proper parameter name is 'enableglobalnamessupport'.
• B. This uses the correct parameter name but sets the value to 0, which disables GlobalNames support instead of enabling it.
• D. The parameter 'globalnamesqueryorder' is not the correct command for enabling GlobalNames; it relates to query order, not enabling the feature.

Correct answer: A

DNS (Domain Name System) is the protocol responsible for translating domain names (like www.cisco.com) into their corresponding IP addresses. When John enters the URL, his browser queries a DNS server to resolve the domain name before establishing the connection to the web server.

Why the other options are wrong:

• B. SMTP is used for sending emails, not for domain name resolution.
• C. DHCP is used for assigning IP addresses to devices on a network, not for resolving domain names.
• D. ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network, not domain names to IP addresses.

Correct answer: A

A circuit-level firewall operates at the Session layer (Layer 5) of the OSI model. It monitors TCP/UDP sessions and relays data between the client and server without examining the actual data content, making decisions based on session information rather than packet contents.

Why the other options are wrong:

• B. Switch-level firewalls are not a standard firewall classification in the OSI model framework.
• C. Packet filtering firewalls operate at the Network layer (Layer 3), examining individual packets rather than sessions.
• D. Application-level firewalls operate at the Application layer (Layer 7) and inspect application data and protocols.

Correct answer: A

NSLOOKUP is a command-line tool specifically designed for querying DNS servers and troubleshooting DNS name resolution problems. It allows administrators to check whether a DNS server can resolve a specific hostname to its IP address, making it the ideal tool for diagnosing DNS issues.

Why the other options are wrong:

• B. IPCONFIG displays IP configuration information and can show DNS server addresses but is not used for testing DNS resolution queries.
• C. NBTSTAT is used for NetBIOS name resolution troubleshooting, not DNS resolution.
• D. NETSTAT displays network statistics and active connections but is not designed for DNS resolution testing.

Correct answer: A

DirectAccess uses IPv6-over-IPsec as its primary tunneling and security mechanism. This combination provides encrypted tunneling of traffic over public networks while enabling secure remote access to corporate resources. IPv6 with IPsec encapsulation ensures data confidentiality and integrity for traveling users connecting through untrusted networks.

Why the other options are wrong:

• B. IPSec-over-IPv4 is not the primary method DirectAccess uses; DirectAccess specifically uses IPv6 tunneling with IPsec.
• C. While VPN provides remote access, DirectAccess is a specific technology distinct from traditional VPN solutions.
• D. SSL/TLS is used for web traffic encryption but is not the core mechanism DirectAccess uses for network-level security.