최신 GCED 무료덤프 - GIAC Certified Enterprise Defender

문제1

Following a Digital Forensics investigation, which of the following should be included in the final forensics report?

A. A summary of the incident and recommended disciplinary actions to apply internally.

B. An executive summary that includes high level descriptions of the overall findings.

C. A summary of the verified facts of the incident and the analyst's unverified opinions.

D. An executive summary that includes a list of all forensic procedures performed.

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

문제2

Which of the following tools is the most capable for removing the unwanted add-on in the screenshot below?

A. Paros

B. Taskkill

C. ProcessExplorer

D. Hijack This

정답: B

문제3

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

A. To compare a list of known good hashes on the USB drive to files on the local C: drive

B. To show hidden and archived files on the C: drive and copy them to the USB drive

C. To copy a forensic image of the local C: drive onto the USB drive

D. To create a file on the USB drive that contains a listing of the C: drive

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

문제4

Which of the following is a major problem that attackers often encounter when attempting to develop or use a kernel mode rootkit?

A. They are highly dependent on the target OS.

B. They are unstable and are easy to identify after installation

C. They tend to corrupt the kernel of the target system, causing it to crash.

D. Their effectiveness depends on the specific applications used on the target system.

정답: C

문제5

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

A. They did not patch the database server after the event

B. They did not eradicate tools left behind by the attacker

C. They did not lock the account after changing the password

D. They did not properly identify the source of the breach

정답: A

문제6

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm's artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

A. The custom rule did not detect all infected workstations

B. They did not receive timely notification of the security event

C. The team did not understand the worm's propagation method

D. The team did not adequately apply lessons learned from the incident

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제7

Which control would BEST help detect a potential insider threat?

A. Providing the same access to all employees and monitoring sensitive file access.

B. Multiple scheduled log reviews of all employee access levels throughout the year

C. Mandatory approval process for executive and administrative access requests.

D. Requiring more than one employee to be trained on each task or job duty.

정답: C

문제8

What are Browser Helper Objects (BHO)s used for?

A. To allow Firefox to process JavaScript in a sandbox

B. To provide multi-factor authentication support for Firefox

C. To provide a more feature-rich interface for Internet Explorer

D. To allow Internet Explorer to process multi-part URLs

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

문제9

Which command tool can be used to change the read-only or hidden setting of the file in the screenshot?

A. tasklist

B. dir

C. attrib

D. type

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

최신 GCED 무료덤프 - GIAC Certified Enterprise Defender

우리와 연락하기

유용한 링크

최신 업데이트