GIAC
GSEC
Question 110 of 334What determines the class of an IPv4 address?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Initial binary digits
The class of an IPv4 address is determined by its initial binary digits. Remember the leading bits: zero for Class A, one zero for B, one one zero for C, and so on, rather than relying on the subnet mask.
Question 111 of 334What are the default service ports for the TLS encrypted form of FTP?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) TCP 989, 990
The TLS encrypted form of FTP, known as FTPS, uses TCP ports 989 and 990 by default. Do not confuse FTPS with SFTP, which operates over SSH on port 22, or standard FTP, which uses ports 20 and 21.
Question 112 of 334What is the standard size of an IPv4 header if no options are set?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) 20 bytes
The standard size of an IPv4 header is 20 bytes when no options are set. The header length field usually indicates five 4-byte words, meaning five times four equals twenty bytes for your calculations.
Question 113 of 334What field in the TCP header is used to verify that received data was not corrupted or modified in transit?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Checksum
The checksum field is used to verify that received data was not corrupted or modified in transit. The acknowledgment number only confirms successful receipt of data, not its integrity against transmission errors.
Question 114 of 334What term describes the function on a system receiving a network communication where the content of a header is processed, the header is removed, then the payload is passed up to the next layer's appropriate protocol?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) De-encapsulation
De-encapsulation describes processing a header, removing it, and passing the payload up to the next layer. This matches the OSI or TCP/IP model flow, whereas checksum verification is only a small step in that overall process.
Question 115 of 334What is the primary security benefit of operating multiple guest OSs in a virtual environment, as opposed to running multiple applications in a single OS?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Isolation of tasks and operations
The primary security benefit of operating multiple guest OSs is the isolation of tasks and operations. If one application is compromised, the hypervisor prevents the attacker from easily affecting the other isolated guest systems.
Question 116 of 334Why should the wireless encryption option of WPA be avoided when configuring a network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) It is based on RC4.
You should avoid WPA because it relies on the vulnerable RC4 streaming cipher. WPA2 provides a significant security upgrade by using the much stronger Advanced Encryption Standard, or AES, for protecting wireless communications.
Question 117 of 334What is the size of the original 2.4 GHz channels as defined by IEEE 802.11?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) 22 MHz
The original IEEE 802.11 standard defined 2.4 GHz channels with a width of 22 MHz. Modern amendments like 802.11n and 802.11ac introduced channel bonding, allowing wider channels like 40 MHz to increase network throughput.
Question 118 of 334What is a description of Tcpdump?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) A command-line raw packet-capturing utility
Tcpdump is a command-line raw packet-capturing utility used extensively in Linux and Unix environments. It is not a port listing tool like netstat, but rather a powerful utility for sniffing and analyzing network traffic.
Question 119 of 334When attempting to communicate with a service on a UDP port, your system receives a response of an ICMP Type 3 Code 3. Why did you receive this message?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Closed port
An ICMP Type 3 Code 3 message indicates a destination port is unreachable, meaning the UDP port is closed. Because UDP lacks internal error tracking, it relies on ICMP to notify senders of these delivery failures.
Question 120 of 334Why should inbound TCP and UDP 3389 be blocked on most networks?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) To prevent remote control attacks
Port 3389 is used by Microsoft's Remote Desktop Protocol, which allows remote control of a system and poses a serious inbound security risk if exposed. Blocking it prevents attackers from establishing unauthorized remote control sessions, whereas the other options map to completely different ports.
Question 121 of 334Why is the three-way handshake performed by TCP at the start of each session?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) To establish a session
The TCP three-way handshake synchronizes sequence numbers to reliably establish a session between two endpoints. A helpful exam tip is that basic network protocols do not handle authentication or encryption keys; those functions are left to the application or higher-level security protocols.
Question 122 of 334Which of the following TCP/IP layer to OSI layer mappings is incorrect?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Internetworking layer - Data Link layer
The TCP/IP Internetworking layer correctly maps to the OSI Network layer, making the Data Link mapping in the correct option fundamentally incorrect. When tackling model questions, always assume OSI is the default focus unless the question specifically calls out the TCP/IP or DARPA model.
Question 123 of 334What network device manages network traffic based on a 48-bit hardware address?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Switch
A switch operates at Layer 2 and makes forwarding decisions based on the 48-bit Media Access Control address found in Ethernet frames. Routers and firewalls function at higher layers using IP addresses, while a simple hub just repeats physical signals to all ports.
Question 124 of 334What prevents an IP packet from being forwarded indefinitely when it encounters a routing loop?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) TTL
The Time to Live field in the IPv4 header is decremented by each router, ensuring packets are dropped if a routing loop occurs. Remember that Spanning Tree Protocol prevents Layer 2 loops, while the Time to Live field specifically protects Layer 3 routing.
Question 125 of 334A DHCP server fails to provide a Windows client with an IP address lease. What IP address may be used instead?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) 169.254.0.1
When a Windows client fails to reach a DHCP server, it assigns itself an Automatic Private IP Addressing address from the 169.254 range. A strong exam cue is to associate the 169.254 prefix directly with DHCP failures, completely ignoring standard private or loopback addresses.
Question 126 of 334What ICMP type is used by the tracert/traceroute tool to determine the IP addresses of the routers along a path to a destination?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Type 11
Traceroute relies on ICMP Type 11, which is the Time Exceeded message, to map router hops. Do not confuse this with Type 0 Echo Replies used by ping, or Type 3 Destination Unreachable errors.
Question 127 of 334Which protocol uses the service port of 587?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) SMTP
Port 587 is the modern submission port for SMTP, used by clients to send email securely. Port 25 is typically for server-to-server routing, while port 110 or 995 is used for retrieving email via POP3.
Question 128 of 334What is the first field in a TCP header?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Source port
The source port is always the very first field in a TCP header. For the exam, remember that Time to Live is an IP header concept, while the window size and acknowledgement number appear later in the TCP header.
Question 129 of 334What is the purpose of the DNS resource record type of PTR?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Link IP address to FQDN
A Pointer record links an IP address to a Fully Qualified Domain Name to support reverse DNS lookups. Address records perform the opposite function, resolving domain names to their respective IP addresses.
Question 130 of 334How is the network ID of an IP address identified?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) By ANDing the subnet mask with the IP address
ANDing the subnet mask with the IP address mathematically reveals the network ID by dropping the host portion. Relying on legacy IP class assignments is invalid today due to variable length subnet masking.
Question 131 of 334What standard defines the 2.4 GHz wireless technology known as Bluetooth?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) IEEE 802.15
The IEEE 802.15 standard defines Bluetooth, which operates in the 2.4 GHz frequency range for personal area networks. Do not confuse this with IEEE 802.11, which is the standard for standard Wi-Fi networks.
Question 132 of 334An SOA record stores seven details. Which detail is changed each time the zone file is updated on the primary authoritative DNS server?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Serial number
The serial number in a Start of Authority record must be incremented each time a zone file is updated. This tells secondary DNS servers that new information is available and a zone transfer is required.
Question 133 of 334What commonly used networking protocol adds a footer to the payload during encapsulation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Ethernet
Ethernet adds a footer, known as the Frame Check Sequence, to the end of a payload during encapsulation to verify data integrity. Other common protocols like IP and TCP only use headers and lack this trailer.
Question 134 of 334At what layer or layers of the OSI model does a LAN protocol operate?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Physical and Data link layers
Local Area Network protocols like Ethernet operate at the Physical and Data Link layers of the OSI model. Remember that these bottom two layers handle physical connectivity and local hardware addressing.
Question 135 of 334Why is containment an essential step to perform before recovery can be initiated during the execution of an incident response policy?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) To prevent further damage
Containment is performed before recovery to isolate affected systems and prevent further damage to the network. Identifying systems happens earlier, while evidence preservation is a forensic concern, not the primary containment goal.
Question 136 of 334Why would an organization choose to use the IP addresses from RFC 1918?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Internet isolation
RFC 1918 provides private IP addresses that are not routed across the public Internet, giving an organization natural internet isolation. For the exam, remember that private addressing inherently blocks inbound external traffic, though NAT is still required for outbound connectivity.
Question 137 of 334Which of the following is a public IP address?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) 173.194.200.138
Only the 173.194.200.138 address falls outside the RFC 1918 private ranges, making it a valid public IP address. A strong exam cue is to immediately eliminate any option starting with the ten, 172.16 to 172.31, or 192.168 private ranges.
Question 138 of 334Which field in an ICMP header is used to indicate the function or purpose of the communication?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Type
The Type field defines the primary function or purpose of an ICMP message. Watch out for Protocol Number or EtherType, because those belong to IP and Ethernet headers respectively, not ICMP.
Question 139 of 334When examining packets collected from an unknown network communication, you notice that the Protocol Number field in several IP headers is set to a value of 0x11. What does this indicate?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) The payload is UDP.
A Protocol Number of 17, which is 0x11 in hexadecimal, indicates that the IP payload is UDP. Remember that TCP is protocol 6, so a hex value of 0x06 would be required for the payload to be TCP.
Question 140 of 334What type of device is the Zigbee wireless technology most commonly associated with?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Home automation
Zigbee is a low-power, low-bandwidth wireless standard designed primarily for home automation and sensor networks. It is not built for high-speed internet connectivity, which relies on technologies like LTE or Wi-Fi.
Question 141 of 334What is the response received by a client when communicating with a service on an open UDP port?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Nothing
Because UDP is connectionless, sending data to an open UDP port typically yields no protocol-level response. Remember that ICMP Type 3 Code 3 is only returned when attempting to reach a closed UDP port.
Question 142 of 334You have ANDed the local netmask with your destination's IP address. What can you determine from this operation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Whether the destination is in a remote subnet
ANDing the subnet mask with a destination IP address calculates the destination network ID. By comparing this to your local network ID, you immediately know if the target is local or on a remote subnet.
Question 143 of 334How can you calculate the size of the payload of a UDP datagram that is captured during a network sniffing event?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Subtract 64 bits from the UDP header length field value.
Subtracting 64 bits from the UDP length field calculates the payload size because the 8-byte header is always 64 bits. Remember that the UDP length field includes both the header and the payload, not just the payload itself.
Question 144 of 334How does ICMP communication operate when it does not have address or port support in its header?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) It rides as the payload of an IP packet.
ICMP relies on riding as the payload of an IP packet, borrowing the necessary addressing from the IP header. A practical cue is that ICMP operates at Layer 3, meaning it completely avoids using Layer 4 ports or sessions.
Question 145 of 334How can an administrator use the ping command to determine where along a communication path an error exists?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) Ping in order: loopback, local IP address, default gateway address, an internal LAN address, proxy/gateway internal address, proxy/gateway external address, then several Internet addresses.
Pinging destinations from local to remote allows you to pinpoint exactly where the communication path breaks. If you started from the outside in, you would struggle to isolate whether the failure is local or happening further down the route.
Question 146 of 334You are selecting the hardware to comprise a virtual machine server host. Which of the following is most critical to ensure high levels of performance when serving large numbers of clients and using a SAN?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) Network interface capacity
Network interface capacity is critical because a SAN relies on the network for storage traffic, which easily creates bottlenecks. While CPU cores matter, the combined load of client traffic and storage read and writes makes the network card the most likely choke point.
Question 147 of 334What is the most important feature or benefit provided by CIDR?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) It reduced the size of routing tables.
CIDR was primarily adopted to reduce the size of core Internet routing tables by combining multiple subnets into a single route. Remember that Variable Length Subnet Masking actually initiated the move away from strict class-based subnetting.
Question 148 of 334How does a sending system know that a window set of packets was not properly received and that a re-transmission of the window is required?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) There is no acknowledgement within a timeout period
A lack of an acknowledgement within a specific timeout period tells the sender to re-transmit the window. A failed checksum silently drops the packet, but it is the resulting timeout on the sender side that actually forces the retransmission.
Question 149 of 334Which of the following statements is true regarding security management for an operating system hosted in a virtual machine?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) All OSs need security management, no matter how they are hosted.
All operating systems need security management, whether they are physical or virtual, because virtualization does not provide inherent protection. Host and guest systems require independent patching and security controls, as host protections do not automatically secure the guests.
Question 150 of 334What network type is confined to a limited geographical area?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) LAN
A Local Area Network is confined to a limited geographical area, such as a single building or campus. For the exam, remember that a Wide Area Network spans large distances, while a Virtual Private Network secures connections across existing networks.
Question 151 of 334What is the top reason for organizations to adopt virtual machines instead of using traditional physical systems?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Cost reduction
Consolidating multiple virtual machines onto fewer physical hosts directly lowers hardware, power, and cooling costs. While deployment might seem easier, managing hypervisors and avoiding a single point of failure actually adds complexity to the infrastructure.
Question 152 of 334What protocol is used to resolve the MAC address of the device's interface used in communicating with a destination located in a distant subnet?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) ARP
When communicating with a distant subnet, Address Resolution Protocol resolves the MAC address of the local default gateway. Devices do not send ARP broadcasts across a router to find the remote destination's MAC address.
Question 153 of 334How does a bus topology differ from a star topology?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) A bus is a series of node connections, while a star consists of connections from nodes to a center device.
A bus topology connects nodes in a series along a single backbone cable, while a star topology links nodes to a central device. Remember that a mesh topology provides direct node-to-node connections.
Question 154 of 334Why would someone want to deploy an IEEE 802.11ac network rather than an IEEE 802.11g network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) 802.11ac provides throughputs up to 1 Gbps.
Deploying 802.11ac provides gigabit throughput speeds, significantly faster than older 802.11g networks. As a practical exam cue, remember that 802.11ac operates strictly in the five gigahertz band, avoiding two point four gigahertz interference.
Question 155 of 334What benefit does the modulation concept introduced into wireless networking by IEEE 802.11n provide to high-speed communications?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Multipath propagation
The multiple-input multiple-output modulation concept introduced by 802.11n uses multiple antennas to take advantage of multipath propagation. Instead of causing interference, bounced radio signals are tuned into unique transmission paths for faster data delivery.
Question 156 of 334You are using a sniffer to monitor IP traffic. You notice a set of packets that make up a four-step communication. The third packet in the set is a request packet, and it is sent from the client to the server. What operation or communication is being viewed?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. B) DHCP leasing
The described four-step exchange represents the Discover, Offer, Request, and Acknowledgment sequence of a DHCP lease. If it were a TCP session establishment, you would only see a three-way handshake.
Question 157 of 334How does a caching DNS server resolve a query on behalf of a client for which it does not already know the answer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) It checks with a root DNS server, the global TLD DNS server, and the authoritative server.
A caching DNS server resolves unknown queries by sequentially asking root, top-level domain, and authoritative servers. Checking the cache is always the first step, but the prompt specifies the server does not already know the answer.
Question 158 of 334How does a sniffer capture all network traffic reaching an interface?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) By disabling the MAC filter
A sniffer captures all traffic by placing the network interface card into promiscuous mode, which effectively disables the MAC address filter. This allows the system to read all frames on the local network segment, even those addressed to other devices.
Question 159 of 334How can data on a device be accessed by an attacker when Bluetooth is enabled?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) Bluesnarfing
Bluesnarfing is the specific attack used to unauthorizedly access and steal data from a Bluetooth-enabled device. Bluejacking is often confused here, but it merely sends unsolicited messages rather than extracting sensitive information.
Question 160 of 334Which of the following is the best choice for deploying virtual machines as servers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Bare metal hypervisor
Bare metal hypervisors, or Type 1 hypervisors, are installed directly onto server hardware without a host operating system. This provides better performance and security for server deployments compared to Type 2 hosted hypervisors.
Question 161 of 334How is the address assignment to systems different under IPv6 versus IPv4, as defined in their specifications?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. D) Potentially, each interface will have three addresses assigned in IPv6, while they have one address assigned in IPv4.
Under the original IPv6 specifications, an interface can hold multiple addresses simultaneously, such as link-local, site-local, and global addresses. Be mindful that modern IPv6 deployment often relies on standard DHCP, making this distinction heavily focused on theoretical specifications rather than modern practice.
Question 162 of 334How does the recipient of a communication indicate that all of the elements of a communication set were received without corruption?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) By sending an Acknowledgement flagged TCP segment with the acknowledgement number field set to a value that is one increment higher than the last received segment's sequencing number
The receiver sends a TCP segment with the Acknowledgement flag set, using a value one increment higher than the last sequence number. This confirms successful receipt and prepares the connection for the next expected byte.
Question 163 of 334What mechanism provides a live backup and restore feature for the guest OSs in a virtual machine environment?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A) Snapshot
Snapshots provide a quick, live backup and restore mechanism for running virtual machines, allowing admins to revert to a stable state. Standard drive imaging takes too long and is typically used for traditional physical servers rather than active virtualization.
Question 164 of 334Why is the WAN protocol PPP so important to modern networking?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. C) Platform independence and interoperability
The Point-to-Point Protocol is important because it provides platform independence and interoperability across diverse vendor systems. While it supports authentication protocols like CHAP, its universal connectivity remains its defining legacy.
Study on mobile
Get CertPunch for iOS or Android.