GIAC Security Essentials GSEC Practice Questions with Explanations

Correct answer: C

A network intrusion detection system watches traffic on the wire, so one well placed sensor covers every host on that segment instead of needing software on each machine. Because it works from the network rather than from the victim, it sees reconnaissance, scanning and attacks against hosts that carry no agent at all, and it keeps a record even when the targeted host has logging turned off or has been compromised and its logs tampered with. Option C states all three of those advantages. Options A, B and D each claim that a NIDS can read the contents of encrypted sessions, which it cannot without a decryption point, and they also claim it can confirm whether an attack actually succeeded on the target, which is a host-based strength rather than a network one. Options A, D and E further describe per-host agents and single-host coverage, which is the host-based model and the opposite of what a NIDS provides.

Why the other options are wrong:

• A. Does not include all the correct advantages; missing D and E.
• B. Does not include advantage D about detecting attacks that bypass host logging.
• D. Does not include advantage E about inexpensive management; also missing D from the correct set.

Correct answer: A

RARP (Reverse Address Resolution Protocol) is specifically designed for a host to discover its own IP address when it knows its MAC address. A host with a known MAC address sends a RARP request to obtain the corresponding IP address from a RARP server.

Why the other options are wrong:

• B. ARP does the opposite-it resolves IP addresses to MAC addresses, not MAC to IP.
• C. DNS resolves domain names to IP addresses, not MAC addresses to IP addresses.
• D. RDNS (Reverse DNS) performs reverse lookups of IP addresses to domain names, not MAC to IP resolution.

Correct answer: C

SYN/FIN scanning exploits the unusual combination of flags (SYN and FIN set simultaneously) to craft packets that may evade firewall rules and filtering routers. Many firewalls are configured to block standard connection attempts but may not properly handle or filter these non-standard packet combinations, allowing them to pass through.

Why the other options are wrong:

• A. SYN/FIN packets are not a standard signaling mechanism for Trojans.
• B. While SYN floods are used in DoS attacks, SYN/FIN combinations are not a typical DoS vector, nor are they specifically targeted at BSD hosts.
• D. Session hijacking uses sequence number prediction and packet injection, not SYN/FIN scanning techniques.

Correct answer: D

The Network Access or Link Layer (the bottom layer of the TCP/IP model) handles the physical transmission of data and defines how devices interface with network hardware. This includes procedures for interfacing with Ethernet devices, managing MAC addresses, and handling physical frame transmission.

Why the other options are wrong:

• A. This is a function of the Transport or Application layer, which provides end-to-end services for applications.
• B. Routing is performed at the Internet layer, not the Link layer.
• C. IP addressing is an Internet layer function, and encryption can occur at multiple layers but is not a primary Link layer responsibility.

Correct answer: C

RFC 1918 defines three ranges of private IP addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.254.1.50 falls within the 10.0.0.0/8 range and is a valid private address suitable for DHCP assignment on a private LAN.

Why the other options are wrong:

• A. 127.0.0.100 is a loopback address, not a private RFC 1918 address.
• B. 169.254.1.50 is in the link-local range (169.254.0.0/16), not an RFC 1918 private range.
• D. 172.35.1.100 falls outside the RFC 1918 private range of 172.16.0.0/12; it is a public address.

Correct answer: C

SHA-1 (Secure Hash Algorithm 1) is one of the cryptographic hash algorithms used by PGP for creating digital signatures. PGP uses SHA-1 to hash the message before encrypting the hash with the sender's private key to create the digital signature.

Why the other options are wrong:

• A. Blowfish is a symmetric encryption cipher, not a hash algorithm used by PGP for signatures.
• B. DES is a symmetric encryption algorithm, not a hash algorithm used in PGP's signature process.
• D. CAST is a symmetric encryption cipher, not a hash algorithm used by PGP for digital signatures.

Correct answer: A

Running a vulnerability scanner against production banking systems carries significant risk of causing harm to otherwise healthy systems. Vulnerability scanners perform active probing and testing that can crash services, cause data corruption, or trigger resource exhaustion on sensitive production systems, making pre-scan impact assessment critical.

Why the other options are wrong:

• B. False negatives are a technical limitation but not the primary business concern when deciding whether to run a scanner.
• C. False positives are a technical issue requiring validation but are less critical than the risk of system damage.
• D. While cost-benefit analysis is important, the immediate risk of harming production systems is a more critical business factor.

Correct answer: B

Cygwin provides Windows users with access to GNU/Linux utilities and tools, enabling much more powerful command-line scripting and Unix-like capabilities on Windows systems. This includes bash shells, sed, awk, grep, and other powerful text processing and scripting tools unavailable natively in Windows.

Why the other options are wrong:

• A. Cygwin does not install a complete Red Hat operating system on Windows; it provides Unix-like tools and utilities within Windows.
• C. While Apache can technically run under Cygwin, it is not intended as a production server solution and Cygwin is not suitable for production deployments.
• D. Cygwin does not install a complete Ubuntu operating system on Windows; it provides a Unix-like environment and toolset.

Correct answer: C

Encryption is the critical technical control that protects data confidentiality even after physical security is breached. If an intruder obtains encrypted tapes, the data remains unreadable without the decryption keys. This is a detective/preventive control that provides the last line of defense when physical security fails, making it more effective than other options which either don't protect the data itself or are detective-only controls.

Why the other options are wrong:

• A. Camera recordings document a breach but do not protect the data on the tapes from unauthorized access.
• B. Security guards are a physical control that has already been bypassed by assumption in the question.
• D. Shredding is a destruction method, not applicable to tapes still in use for critical data.
• E. Corrective controls address issues after they occur but do not prevent unauthorized data access if tapes are obtained.

Correct answer: C

When two clients share the same public IP address behind a NAT firewall, the server distinguishes between them by their source ports. The NAT device translates each client's unique internal source port to different ports in outbound connections, allowing the server to maintain separate connections to both clients. This 5-tuple identification (source IP, source port, destination IP, destination port, protocol) is what enables simultaneous connections from the same public IP.

Why the other options are wrong:

• A. The port number used by the server is irrelevant; simultaneous connections work on any server port with different client source ports.
• B. The network location of the server is irrelevant; the distinction happens at the NAT layer.
• D. Clients on different subnets still share the same public IP when behind the same NAT device, so this is not the determining factor.

Correct answer: A

The `dd` command is the standard Unix utility for copying raw disk and file system data byte-by-byte, preserving all data including unallocated space, metadata, and deleted files. This makes it essential for forensic analysis where maintaining a bit-for-bit copy of the original media is critical. The `dd` command can create forensic images without interpreting the file system, which is exactly what forensic analysis requires.

Why the other options are wrong:

• B. The `backup` command is not a standard Unix command for this purpose.
• C. The `cp` command copies files at the file system level, missing unallocated space and not suitable for forensic imaging.
• D. The `gzip` command is a compression utility, not designed for raw data acquisition or forensic imaging.

Correct answer: B

Allowing all TCP 3389 traffic through the external firewall is explicitly NOT a best practice and is a significant security risk. The recommended practice is to restrict RDP access through firewalls, use VPNs or jump boxes, and limit exposure to the internet. Options A, C, and D are all legitimate security best practices, making B the only answer that describes what should NOT be done.

Why the other options are wrong:

• A. Requiring TLS authentication and encryption is a fundamental best practice for securing RDP.
• C. Using Group Policy to lock down virtual desktops for thin clients is a recommended hardening practice.
• D. Adding IPSec or VPN in addition to RDP encryption provides defense-in-depth against vulnerabilities and is a best practice.

Correct answer: B

When a filename extension is mapped in IIS, it associates that extension with a specific interpreter program (such as asp.dll, php-cgi.exe, etc.). When a file with that extension is requested, IIS passes the file and the browser request data to the mapped interpreter, which processes the file and returns output to the client. This mechanism enables dynamic content execution on web servers.

Why the other options are wrong:

• A. Mapped extensions are specifically interpreted by the server, not prevented from being interpreted.
• C. Files are not interpreted by CMD.EXE; they are handled by the mapped interpreter defined in IIS configuration.
• D. The web browser does not interpret mapped file types; interpretation occurs on the server side before content is sent to the browser.

Correct answer: D

The `inittab` file in Linux is the configuration file read by the init process during boot. It specifies which processes and services start at boot time and how the system transitions between runlevels. This is the standard initialization table that controls the startup sequence in traditional System V-style init systems. While `initd` (init.d) contains the actual startup scripts, `inittab` is the file that lists/configures what starts at boot time.

Why the other options are wrong:

• A. The `inetd` daemon manages internet services, not boot-time process initialization.
• B. The `netsrv` file is not a standard Linux component for process startup configuration.
• C. The `initd` directory contains startup scripts, but `inittab` is the configuration file that specifies which processes start at boot.

Correct answer: D

Traceroute sends probes with incrementally increasing TTL (Time To Live) values. When a hop fails to respond within three attempts, traceroute prints '* * *' for those three failed attempts, then increments the TTL and continues trying to reach subsequent hops until it reaches the maximum hop count or successfully reaches the destination. This allows it to map the entire route even when intermediate hops don't respond.

Why the other options are wrong:

• A. Traceroute does increment the hop count and continue, but it prints asterisks for unresponsive hops and continues with the next TTL value.
• B. Traceroute does not exit on a single unresponsive hop; it continues incrementing TTL until max hop count is reached.
• C. Traceroute does not increase the timeout; it uses a fixed timeout and moves to the next TTL value after three failed attempts.

Correct answer: D

A 40-byte header length indicates IPv6 (IPv4 headers are typically 20 bytes minimum, IPv6 headers are fixed at 40 bytes). In both IPv4 and IPv6, byte 0 contains the version in the first 4 bits and additional header fields. In IPv6, the next header field (at byte 6) indicates the payload protocol, where a value of 6 specifically indicates TCP. Therefore, this is an IPv6 packet with TCP payload.

Why the other options are wrong:

• A. A 40-byte header is characteristic of IPv6, not IPv4; also the value 6 in the next header field indicates TCP, not unspecified.
• B. The 40-byte header indicates IPv6, not IPv4.
• C. While the 40-byte header correctly identifies IPv6, a value of 6 in the next header field specifically indicates TCP, not an unspecified protocol.

Correct answer: D

Windows default password complexity requires at least three of four character types: uppercase letters, lowercase letters, numbers, and special characters. Option D (SaNS2006) contains uppercase (S, N), lowercase (a, n, S), and numbers (2, 0, 0, 6), meeting the three-character-type minimum. Option A lacks numbers and special characters. Option B lacks uppercase letters and special characters. Option C has only uppercase letters and special characters but no lowercase letters.

Why the other options are wrong:

• A. Lacks both numeric and special characters, only has uppercase and lowercase letters.
• B. Lacks uppercase letters and special characters, only has lowercase and numerics.
• C. Lacks lowercase letters, only has uppercase letters and special character (@).

Correct answer: B

Law enforcement notification decisions must be made during the preparation phase when policies are being established, not reactively during an incident. This allows the organization to understand legal obligations, jurisdictional requirements, and notification procedures before a crisis occurs. Making this decision during analysis, recovery, or reaction would be too late and could compromise investigations or violate legal requirements.

Why the other options are wrong:

• A. Analysis phase is too late; decisions should be pre-established in policy.
• C. Recovery is the final phase and too late for initial law enforcement decisions.
• D. Reaction phase occurs during the incident; planning should happen beforehand.

Correct answer: B

Wireless eavesdropping attacks can potentially be conducted from considerable distances depending on transmitter power, antenna gain, and environmental conditions. Modern wireless networks can be intercepted from distances significantly beyond typical building range. Options A, C, and D are factually incorrect: concrete walls do not prevent all eavesdropping (signals penetrate or bypass), eavesdropping is difficult to detect passively, and basic eavesdropping tools are inexpensive or free.

Why the other options are wrong:

• A. Wireless signals penetrate concrete walls and can be intercepted through barriers.
• C. Passive eavesdropping is inherently difficult to detect on wireless networks.
• D. Many eavesdropping tools like Wireshark are free or cost very little.

Correct answer: C

The 'who' command displays information from the utmp file, which tracks currently logged- in users. Since the employee 'dmaul' is logged in but does not appear in the 'who' output, the utmp file must have been altered to remove the record of that login session. The utmp file is the source of data for the 'who' command, so modifications to it directly affect what 'who' displays.

Why the other options are wrong:

• A. /var/log/messages contains system messages and would not affect the 'who' command output, which reads from utmp.
• B. Bash history files record command history for individual shell sessions and do not affect the 'who' command's ability to display logged-in users.
• D. HTTP logs record web server activity and are unrelated to the 'who' command, which monitors user login sessions at the system level.

Correct answer: B

Kismet is a wireless network detector and sniffer that passively monitors wireless traffic. Its primary function is packet capture and analysis, enabling eavesdropping on unencrypted wireless communications. While it can provide information useful for other attacks, eavesdropping is its core capability. IP spoofing, masquerading, and DoS attacks require active attack tools or different functionalities beyond passive packet capture.

Why the other options are wrong:

• A. IP spoofing operates at the network layer and is not Kismet's primary function.
• C. Masquerading requires active impersonation tools, not passive sniffing.
• D. Denial of Service requires active attack generation, not passive monitoring.

Correct answer: A

SSL (Secure Sockets Layer) is a cryptographic protocol that implements Public Key Infrastructure (PKI) principles using digital certificates, certificate authorities, and public/private key pairs for secure communications. 3DES is a symmetric encryption algorithm. Kerberos is an authentication protocol using symmetric keys. SHA-1 is a hash function. Only SSL implements the full PKI framework with certificate-based authentication and key management.

Why the other options are wrong:

• B. 3DES is a symmetric encryption algorithm, not a PKI implementation.
• C. Kerberos uses symmetric cryptography and ticket-based authentication, not PKI.
• D. SHA-1 is a cryptographic hash function, not a PKI implementation.

Correct answer: B

A well-written security policy should establish the 'what' (objectives and requirements) but should not prescribe specific 'how' details, as those belong in procedures and technical standards that change more frequently. Policy provides high-level direction; implementation details are separated into procedures. Options A, C, and D accurately describe policy functions: defining what must be done, protecting information, and protecting compliant employees from liability.

Why the other options are wrong:

• A. Well-written policies correctly define 'what' objectives and requirements.
• C. Security policy appropriately establishes what must be done to protect information.
• D. Policy protects good-faith employees by establishing clear guidelines to follow.

Correct answer: B

Enabling the Audit Object Access GPO policy is only half the requirement. Individual files and folders must also have specific SACL (System Access Control List) entries configured to generate audit events when accessed. Without setting these file-level audit settings, the policy alone produces no logs. The most likely reason for empty audit logs is that auditing was not properly enabled on the actual files themselves.

Why the other options are wrong:

• A. Auditing can be enabled on individual files, not just folders.
• C. Domain users typically lack permissions to disable system auditing policies.
• D. If changes weren't saved, GPO would not have applied at all.

Correct answer: A

MBSA functions as both a vulnerability scanner (detecting missing patches, weak passwords, and configuration vulnerabilities) and an auditing tool (assessing compliance with security baselines and checking system configurations). While it can inform patch decisions, its primary functions are vulnerability scanning and security auditing. Option D incorrectly labels it as a patching tool when it only detects missing patches; option B incorrectly includes alerting; option C omits scanning entirely.

Why the other options are wrong:

• B. MBSA does not function as an alerting system; it performs scans and reports results.
• C. MBSA is not a configuration management tool; it audits against baselines.
• D. MBSA does not perform patching itself; it identifies missing patches and vulnerabilities.

Correct answer: C

The hexadecimal value 0xFEDCBA contains 6 hexadecimal digits. Since each hexadecimal digit represents 4 bits, and 8 bits equal 1 byte, 6 hex digits equal 3 bytes (6 digits ÷ 2 = 3 bytes). The value breaks down as: FE (1 byte), DC (1 byte), BA (1 byte).

Why the other options are wrong:

• A. 12 bytes would represent 24 hexadecimal digits, not 6.
• B. 2 bytes would only represent 4 hexadecimal digits.
• D. 6 bytes would represent 12 hexadecimal digits.

Correct answer: C

PGP uses a hybrid encryption approach: it generates a random symmetric key to encrypt the message (symmetric encryption is fast for large data), then encrypts that symmetric key with the recipient's public key (asymmetric encryption secures the key exchange). This combines the efficiency of symmetric encryption with the key-distribution advantages of asymmetric encryption.

Why the other options are wrong:

• A. This reverses the encryption process and uses asymmetric encryption for the message, which is inefficient and incorrect.
• B. Asymmetric keys are computationally expensive for encrypting large messages; PGP uses symmetric keys for the message itself.
• D. Encrypting an asymmetric key with a symmetric key defeats the purpose of public- key cryptography for secure key distribution.

Correct answer: B

Layer 1 (Physical Layer) in wireless networks involves the actual radio frequency transmission. Limiting RF coverage restricts the physical area where the wireless signal can be received, thereby protecting at the physical layer by preventing unauthorized devices outside the coverage area from intercepting transmissions.

Why the other options are wrong:

• A. Hardening applications operates at Layer 7 (Application Layer), not Layer 1.
• C. Firewalls operate at Layer 3-4 (Network/Transport Layers), not Layer 1.
• D. Encryption typically operates at Layer 6-7 (Presentation/Application Layers), not Layer 1.

Correct answer: C

To meet the requirements, the hypervisor must create separate virtual network interfaces for each VM so they can each have unique IP addresses on the same subnet, and must configure resource limits (such as RAM allocation) for each guest OS. This addresses both the networking requirement (separate network identity) and the resource constraint requirement (limiting access to system resources).

Why the other options are wrong:

• A. Hard drive partitions are not mentioned in the requirements; the focus is on network configuration and resource limits.
• B. While separate virtual network interfaces are needed, the statement that they "use the same physical interface" is accurate but doesn't address the resource limitation requirement.
• D. Configuring physical system resources from within the guest OS does not allow the hypervisor to enforce resource limits on the VM.
• E. Each VM does not need a separate physical network interface; virtual network interfaces on a single physical adapter suffice for multiple VMs on the same subnet.

Correct answer: B

The System event log records hardware, driver, and system-level events, including driver loading during startup. Information about whether a specific driver was running at system startup would be logged in the System event log where startup processes and driver initialization are recorded.

Why the other options are wrong:

• A. The Application log records application-level events, not driver startup information.
• C. There is no standard Windows event log called 'Startup'; startup events are logged in the System log.
• D. The Security log records authentication, authorization, and access control events, not driver startup information.

Correct answer: D

Defense-in-depth involves multiple layers of security controls. Separating resources by providing security boundaries between systems with different security requirements embodies this principle by creating segmented trust zones that limit the impact of a compromise and enforce principle of least privilege across the network architecture.

Why the other options are wrong:

• A. This statement is contradictory and impractical; systems need both inbound and outbound connectivity for legitimate purposes.
• B. While VLANs can enforce security boundaries, stating they ensure systems cannot reach each other without a firewall is overly rigid and doesn't represent flexible defense- in-depth.
• C. A single choke-point creates a single point of failure and is contrary to defense-in- depth principles, which advocate for distributed and layered controls.

Correct answer: B

Business Impact Analysis (BIA) quantifies the effects of a potential disaster over a period of time by calculating metrics such as Recovery Time Objective (RTO), Recovery Point Objective (RPO), and the financial or operational impact of downtime across various time intervals.

Why the other options are wrong:

• A. Risk Assessment identifies and evaluates risks but does not specifically quantify the effects of a disaster over time.
• C. Disaster Recovery Planning creates strategies to respond to disasters but does not quantify impacts over time; it uses BIA outputs.
• D. Lessons Learned documents what was learned after a disaster, not the effects of a potential disaster.

Correct answer: B

The VPN interface has a different IP address from the protected network interface. The VPN interface is assigned an IP address from the VPN server (on the remote network), while the local network interface has its own IP address. These are distinct addresses reflecting the dual connectivity of a VPN client.

Why the other options are wrong:

• A. The VPN interface can and is configured into the route table to determine traffic routing over the tunnel.
• C. VPN functionality is built into modern Windows operating systems as a standard feature.
• D. The VPN tunnel appears as a virtual network adapter alongside other network interfaces in the system.

Correct answer: C

Logging is the firewall feature that records network traffic and security events, creating a forensic trail of evidence that can be analyzed to identify attack patterns and trends. Logs capture detailed information about connections, blocked traffic, and suspicious activities that are essential for forensic analysis and trend identification.

Why the other options are wrong:

• A. NAT translates addresses but does not inherently generate forensic evidence trails.
• B. State tables track active connections but are not primarily designed for forensic analysis or trend identification.
• D. Content filtering blocks certain content but does not create the detailed forensic trail needed for evidence and trend analysis.

Correct answer: B

Protected enclaves describes a network architecture where different segments are isolated and protected from one another using firewalls, ACLs, and VLANs. This approach creates distinct security zones or enclaves, preventing lateral movement of attacks across the network and defending specific segments from threats originating elsewhere.

Why the other options are wrong:

• A. Uniform protection applies the same defense mechanisms to all devices equally without segmentation.
• C. Vector-oriented is not a standard defense-in-depth terminology.
• D. Information-centric focuses on protecting data assets specifically rather than network segmentation.

Correct answer: C

In VMware NAT mode, the host system acts as the NAT device, translating network addresses between the guest virtual machines and the external network. The host system performs the address translation, allowing guest systems to communicate with external networks while appearing to use the host's address.

Why the other options are wrong:

• A. Guest systems do not perform NAT; they are behind the NAT device.
• B. Local gateway is not the component performing NAT in VMware NAT mode.
• D. Virtual system is too vague; the host system specifically performs the NAT function.

Correct answer: A

Uniform protection describes a defense strategy where all devices and network segments receive equal protection without differentiation or segmentation. This approach treats all systems the same rather than categorizing or separating networks, which is explicitly what the scenario describes.

Why the other options are wrong:

• B. Threat-oriented focuses on specific threat vectors rather than uniform application.
• C. Information-centric emphasizes data protection rather than uniform device protection.
• D. Protected enclaves involves segmentation and separation, which this scenario explicitly avoids.

Correct answer: B

Network Address Translation (NAT) changes the source address of packets leaving the network, translating private internal addresses to public routable addresses. This is the fundamental function of NAT-rewriting the source IP address to enable communication between private and public networks.

Why the other options are wrong:

• A. TCP sequence numbers are not modified during standard NAT operations.
• C. Destination ports are typically not changed by basic NAT (port translation is a separate feature).
• D. Destination addresses remain unchanged; NAT modifies the source address.

Correct answer: C

Executive buy-in is the most critical requirement for business continuity plan success because it ensures adequate funding, resource allocation, organizational commitment, and enforcement of the plan. Without leadership support, even well-designed plans lack the resources and organizational backing needed to be effective.

Why the other options are wrong:

• A. Disaster recovery plans are important but are components within business continuity rather than the most critical requirement.
• B. Anticipating all threats is impossible and impractical; plans address known and likely threats.
• D. While roles and responsibilities are important, they depend on having executive commitment first.
• E. Training is valuable but requires executive support to be implemented and maintained.

Correct answer: A

Option A shows the SYN flag (S) being sent from the client (download.net:39904) to the server (ftp.com:21), which is the first step of the TCP three-way handshake. The client initiates the connection with a synchronization packet containing an initial sequence number, indicated by 'S' in the tcpdump output.

Why the other options are wrong:

• B. This shows the SYN-ACK response (second step) from the server back to the client.
• C. This shows a reset packet (RST), which is not part of the normal three-way handshake sequence.
• D. This shows an ACK packet (third step) sent by the client, completing the handshake rather than initiating it.

Correct answer: A

Both volumes should use NTFS for Windows XP Professional workstations. NTFS provides encryption via EFS for the local work files on the first volume and supports security features and permissions needed for group-shared files on the second volume. NTFS is superior to FAT32 for security, file permissions, and enterprise environments.

Why the other options are wrong:

• B. FAT32 lacks security features and does not support file-level encryption or granular permissions needed for work files.
• C. EFS is not a file system; it is an encryption mechanism that operates on top of NTFS, and FAT32 is unsuitable for shared business data.
• D. FAT32 does not support NTFS DACLs (Discretionary Access Control Lists), making this an invalid configuration.

Correct answer: D

Windows Server 2008 introduced RemoteApp, which allows clients to execute and interact with individual applications remotely rather than connecting to an entire terminal desktop session. This provides a more seamless user experience by making remote applications appear as if they're running locally. Option A (custom RDP ports) predates 2008, Option B (mobile device support) was limited in 2008, and Option C (TLS authentication) was also present in earlier versions.

Why the other options are wrong:

• A. Custom RDP port configuration was available in earlier Windows Server versions, not new to 2008.
• B. Mobile device support for RDP was extremely limited in Windows Server 2008 and not a primary feature.
• C. TLS/SSL support for RDP connections existed prior to Windows Server 2008.

Correct answer: E

Stand-alone computers (those not joined to any domain or workgroup) can absolutely coexist on the same physical network with computers that are domain members. This is a common configuration in mixed environments. Domain-joined computers authenticate through Active Directory while stand-alone computers use local authentication, and both can operate on the same network. Option A is false (computers can form workgroups), B is false (costs don't differ this way), C is false (stand-alone computers can coexist), and D is false (workgroup computers can share resources).

Why the other options are wrong:

• A. Windows Server 2008 computers can form workgroups as well as be domain controllers; workgroups are always an option.
• B. Workgroups and domain controllers do not inherently differ in cost; cost depends on infrastructure, not the topology choice.
• C. Stand-alone computers are commonly deployed alongside domain member computers on the same network without issues.
• D. Workgroup computers can share resources with each other through SMB/CIFS; domain membership is not required for resource sharing.

Correct answer: A

The robots.txt file is the standard text file placed in a website's root directory that provides instructions to web crawlers and spiders about which areas of the site should or should not be accessed. Search engines and web spiders consult this file to respect website owners' preferences. The other filenames (Restricted.txt, Spider.txt, Search.txt) are not recognized standards in web protocol specifications.

Why the other options are wrong:

• B. Restricted.txt is not a recognized standard file for controlling web crawler access.
• C. Spider.txt is not the standard filename; the actual standard is robots.txt.
• D. Search.txt is not a recognized standard for instructing search engines or spiders.

Correct answer: C

John the Ripper's MD5 cracking routine uses a simplified central computing loop that decreases the cost (time and resources) required for each hash computation, making it efficient for MD5 password cracking. This optimization is one of John's strengths for password auditing. Option A incorrectly describes Blowfish as expensive, Option B contradicts John's design purpose (it's actually faster for these algorithms), and Option D is false (John does use bit-slicing techniques effectively against DES).

Why the other options are wrong:

• A. John's Blowfish routine is designed to be computationally expensive to slow down cracking, but this is not described as the main benefit for auditing.
• B. John the Ripper is actually faster than many alternatives for MD5 and Blowfish, not slower; speed is a design advantage.
• D. John the Ripper does implement bit-slicing techniques for DES, making it faster than some alternatives, not slower.

Correct answer: A

A Host Intrusion Detection System (HIDS) operates on the host machine itself and can detect malicious traffic after it has been decrypted by the host's TLS/SSL layer. This is a significant advantage over Network IDS, which typically sees encrypted traffic at the network perimeter and cannot inspect encrypted payloads. This allows HIDS to detect attacks hidden within encrypted communications. Options B and C describe NIDS capabilities or false claims, and Option D contradicts HIDS's advantage.

Why the other options are wrong:

• B. NIDS cannot decrypt network traffic; encrypted traffic remains opaque to network- based detection.
• C. This describes NIDS capability at the perimeter, not a HIDS advantage; HIDS operates on the host itself.
• D. HIDS actually detects malicious traffic AFTER decryption occurs on the host, which is its advantage, not before.

Correct answer: D

Asynchronous Transfer Mode (ATM) is more commonly used for establishing high-speed backbone networks that interconnect smaller networks and can reliably carry signals over significant distances. ATM provides high bandwidth (up to 622 Mbps and higher) and was the primary backbone technology before modern fiber Ethernet. Bluetooth is short-range, Ethernet is for LANs, and Token Ring is legacy LAN technology.

Why the other options are wrong:

• A. Bluetooth is a short-range wireless technology, not suitable for backbone interconnection over significant distances.
• B. Ethernet, while now common for backbones, was not traditionally the primary choice for long-distance backbone infrastructure; ATM was more standard.
• C. Token Ring is a legacy LAN technology, not used for high-speed backbone interconnection.

Correct answer: C

The command chmod 400 /etc/shadow sets permissions to read-only (4) for the owner (root) with no permissions for group or others (00). In octal notation, 4 = read, 2 = write, 1 = execute, so 400 means owner can only read. Option A uses invalid syntax (missing space), Option B uses chown which changes ownership not permissions, and Option D incorrectly uses chown with a numeric mode instead of an owner specification.

Why the other options are wrong:

• A. This command has invalid syntax; there is a missing space between "chmod 444" and "/etc/shadow".
• B. The chown command changes file ownership, not permissions; it would not make the file readable only by root.
• D. The chown command expects owner:group format, not a numeric permission code like 400.

Correct answer: D

Symmetric cryptography (such as DES) is generally much faster than asymmetric cryptography (such as RSA) because symmetric algorithms use simpler mathematical operations and shorter key lengths relative to their security strength. Asymmetric cryptography requires complex mathematical operations like modular exponentiation on very large numbers, making it inherently slower. This is why symmetric encryption is used for bulk data encryption and asymmetric encryption is used for key exchange and signatures.

Why the other options are wrong:

• A. Security level does not determine speed; many secure algorithms can be fast or slow depending on their mathematical basis.
• B. Implementation medium (hardware vs software) is not the primary reason; the algorithmic difference between symmetric and asymmetric is fundamental.
• C. This is backwards; asymmetric cryptography is actually much slower than symmetric cryptography.

Correct answer: D

A Disaster Recovery Plan (DRP) contains specific, actionable procedures for restoring systems and operations after a disaster occurs. Option D describes a concrete recovery action (using a server rebuild checklist at an alternate site), which is exactly the type of operational guidance found in a DRP. Options A and B relate to emergency response or crisis communication rather than recovery procedures. Option C, while recovery-focused, sets a Recovery Time Objective (RTO) which is typically found in business continuity planning documents rather than being a statement seen within a DRP itself.

Why the other options are wrong:

• A. Media notification is typically handled by communications/public relations plans, not disaster recovery plans.
• B. Emergency Response Plans are distinct from Disaster Recovery Plans and address initial response, not recovery execution.
• C. RTOs are planning parameters set during BCP development, not statements typically found within the DRP document itself.