GCED 試験問題を無料オンラインアクセス

How does the Cisco IOS IP Source Guard feature help prevent spoofing attacks?

• A.Blocks unsolicited ARP packets after a client has received an IP address
• B.Rate limits client traffic to prevent CAM table flooding
• C.Prevents unauthorized MAC addresses from receiving an IP address on the network
• D.Filters traffic based on IP address once a DHCP address has been assigned

You have been tasked with searching for Alternate Data Streams on the following collection of Windows partitions; 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total Gigabytes and partitions will you need to search?

• A.10GBs of data, both the FAT32 and NTFS partitions.
• B.4GBs of data, the NTFS partition only.
• C.6GBs of data, the FAT32 partition only.
• D.12GBs of data, the FAT16, FAT32, and NTFS partitions.

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

• A.Media from the infected host, copied to the dedicated IR host
• B.Bit-for-bit image from the infected host
• C.Restored media from full backup of the infected host
• D.Original media from the infected host

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

• A.Swap space and page files
• B.Event logs from a central repository
• C.Directory listing of system files
• D.Media in the CDrom drive

What does the following WMIC command accomplish?
process where name='malicious.exe' delete

• A.Stops current process handles associated with the process named 'malicious.exe'
• B.Removes the 'malicious.exe' process form the Start menu and Run registry key
• C.Removes the executable 'malicious.exe' from the file system
• D.Stops the 'malicious.exe' process from running and being restarted at the next reboot