Free GIAC Certified Enterprise Defender GCED practice questions

10 free GIAC Certified Enterprise Defender GCED practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 88 questions. Work through them, then open each answer to check your reasoning.

Get all 88 questions (US$39) · Download these 10 as a PDF

Question 1

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

  1. Restored media from full backup of the infected host
  2. Media from the infected host, copied to the dedicated IR host
  3. Original media from the infected host
  4. Bit-for-bit image from the infected host
Show answer and explanation

Correct answer: D. Bit-for-bit image from the infected host

A bit-for-bit image is the correct forensic evidence to use during incident investigation. This creates an exact duplicate of the original media at the binary level, preserving all data including deleted files and unallocated space, while maintaining chain of custody. This approach allows analysis without risking modification of original evidence and enables multiple independent investigations.

Why the other options are wrong

  • A. Restored backups may lack malware artifacts and forensic evidence needed to understand the attack.
  • B. Copied media to another host introduces the risk of modification during transfer and may not preserve all forensic details.
  • C. Handling original media directly risks contamination, modification, and loss of chain of custody required for forensic validity.

Question 2

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worms artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after.

Where did the incident response team fail?

  1. The team did not adequately apply lessons learned from the incident
  2. The custom rule did not detect all infected workstations
  3. They did not receive timely notification of the security event
  4. The team did not understand the worm’s propagation method
Show answer and explanation

Correct answer: D. The team did not understand the worm’s propagation method

The team failed to understand the worm's propagation method. If worm activity continued after blocking at the IPS and removing artifacts from detected workstations, the team did not identify the actual transmission mechanism, whether it was via email, network shares, USB drives, or another vector. Without understanding how the worm spreads, containment efforts were incomplete and reinfection could occur.

Why the other options are wrong

  • A. Lessons learned apply to preventing future incidents, not explaining why containment failed in the current event.
  • B. The rule may have been functioning correctly; the problem was ongoing propagation through an unblocked vector.
  • C. Delayed notification would not explain continued activity after initial remediation actions were taken.

Question 3

A legacy server on the network was breached through an OS vulnerability with no patch available. The server is used only rarely by employees across several business units. The theft of information from the server goes unnoticed until the company is notified by a third party that sensitive information has been posted on the Internet.

Which control was the first to fail?

  1. Security awareness
  2. Access control
  3. Data classification
  4. Incident response
Show answer and explanation

Correct answer: C. Data classification

Data classification was the first control to fail. If sensitive information was stored on a rarely-used legacy server without appropriate protections or access controls, the organization had not properly classified its data or applied commensurate security measures. Proper data classification would have identified that sensitive information should not reside on an unpatched system, triggering compensating controls or data relocation before a breach occurred.

Why the other options are wrong

  • A. Security awareness training does not directly address the placement of sensitive data on vulnerable systems.
  • B. Access control failures would be a downstream issue after data was already improperly classified and stored.
  • D. Incident response is the process of handling breaches after they occur, not a preventive control against data exposure.

Question 4

Analyze the screenshot below.

Which of the following attacks can be mitigated by these configuration settings?

Exhibit for question 4

  1. A Denial-of-Service attack using network broadcasts
  2. A Replay attack
  3. An IP masquerading attack
  4. A MAC Flood attack
Show answer and explanation

Correct answer: D. A MAC Flood attack

The screenshot shows HP ProCurve port security with statically defined authorized MAC addresses per port and a violation action of send alarm and disable the port. Binding each port to specific source MAC addresses is the standard defense against MAC flooding, because an attacker generating thousands of bogus source MACs to overflow the CAM table trips the violation action and the port shuts down. That stops the switch from failing open and flooding traffic out all ports.

Why the other options are wrong

  • A. Broadcast-based denial of service floods legitimate broadcast traffic that the switch must still forward, so per-port MAC authorization does nothing to reduce it.
  • B. A replay attack retransmits captured valid traffic, which can be sent from an already authorized MAC address and is handled by session or cryptographic controls, not port security.
  • C. IP masquerading is an address change at layer 3, and this feature inspects only layer 2 source MAC addresses on each port.

Question 5

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

  1. Event logs from a central repository
  2. Directory listing of system files
  3. Media in the CDrom drive
  4. Swap space and page files
Show answer and explanation

Correct answer: D. Swap space and page files

The order of volatility drives collection sequence, and of the items listed the swap space and page files are the most volatile. They live on disk but are actively rewritten while the system runs and can be cleared or reinitialized at shutdown or reboot, so their contents must be captured while the system is live. They often hold process fragments, credentials and key material that exist nowhere else.

Why the other options are wrong

  • A. Event logs held in a central repository are already preserved off the victim system and can be pulled later without loss.
  • B. A directory listing of system files reflects static metadata on disk that survives shutdown and can be produced at any stage.
  • C. Media sitting in the CD-ROM drive is read-only physical evidence that does not change and can be collected after the volatile data.

Question 6

Which of the following attacks would use ".." notation as part of a web request to access restricted files and directories, and possibly execute code on the web server?

  1. URL directory
  2. HTTP header attack
  3. SQL injection
  4. IDS evasion
  5. Cross site scripting
Show answer and explanation

Correct answer: A. URL directory

Directory traversal attacks use ".." notation (dot-dot-slash) to navigate up directory levels and access restricted files and directories outside the intended web root. An attacker might request URLs like "http://example.com/../../etc/passwd" to escape the web directory and access system files. This technique can lead to information disclosure and potentially code execution if the attacker reaches executable files.

Why the other options are wrong

  • B. HTTP header attacks manipulate header values, not directory path notation.
  • C. SQL injection targets database queries through input fields, not directory path traversal.
  • D. IDS evasion uses techniques to avoid detection, not directory path notation specifically.
  • E. Cross-site scripting injects malicious scripts into web pages, not directory paths.

Question 7

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive.

What is the purpose of this command?

C: >dir / s / a dhsra d:

> a: IRCD.txt

  1. To create a file on the USB drive that contains a listing of the C: drive
  2. To show hidden and archived files on the C: drive and copy them to the USB drive
  3. To copy a forensic image of the local C: drive onto the USB drive
  4. To compare a list of known good hashes on the USB drive to files on the local C: drive
Show answer and explanation

Correct answer: A. To create a file on the USB drive that contains a listing of the C: drive

The dir command with /s walks every subdirectory and /a with the attribute set d, h, s, r and a includes directories plus hidden, system, read-only and archive files. The redirection operator sends that listing to IRCD.txt on the removable drive the handler just inserted rather than writing anything to the evidence system. The result is a documented inventory of the local fixed drive stored on the responder's media.

Why the other options are wrong

  • B. The command writes only a text listing of file names and paths, it never copies the files themselves anywhere.
  • C. Imaging requires a bit for bit acquisition tool such as dd or FTK Imager, and dir cannot capture slack space, deleted data or a full volume.
  • D. No hashing is performed or compared here, since dir reports directory metadata only.

Question 8

Why might an administrator not be able to delete a file using the Windows del command without specifying additional command line switches?

  1. Because it has the read-only attribute set
  2. Because it is encrypted
  3. Because it has the nodel attribute set
  4. Because it is an executable file
Show answer and explanation

Correct answer: A. Because it has the read-only attribute set

A file with the read-only attribute set cannot be deleted using the basic `del` command without additional switches like `/F` to force deletion or `/A` to specify attributes. The rea-nly attribute is a Windows file protection mechanism that prevents accidental deletion. This is the most common reason a file deletion fails in Windows.

Why the other options are wrong

  • B. Encryption does not prevent deletion; encrypted files can be deleted normally.
  • C. There is no standard Windows file attribute called 'nodel'.
  • D. Executable files have no special deletion restrictions compared to other file types.

Question 9

Why would the pass action be used in a Snort configuration file?

  1. The pass action simplifies some filtering by specifying what to ignore.
  2. The pass action passes the packet onto further rules for immediate analysis.
  3. The pass action serves as a placeholder in the snort configuration file for future rule updates.
  4. Using the pass action allows a packet to be passed to an external process.
  5. The pass action increases the number of false positives, better testing the rules.
Show answer and explanation

Correct answer: A. The pass action simplifies some filtering by specifying what to ignore.

The pass action in Snort is used to explicitly ignore certain traffic and prevent it from triggering alerts or further rule analysis. It simplifies filtering by allowing administrators to whitelist or exclude specific packet patterns that would otherwise match alert rules, reducing false positives and noise in security monitoring.

Why the other options are wrong

  • B. The pass action stops rule processing for matching packets; it does not pass them to further rules.
  • C. Pass is a functional action, not a placeholder; it actively controls packet behavior.
  • D. Pass actions do not send packets to external processes; they simply suppress alert generation.
  • E. Pass reduces alerts by whitelisting traffic, thereby decreasing false positives rather than increasing them.

Question 10

On which layer of the OSI Reference Model does the FWSnort utility function?

  1. Physical Layer
  2. Data Link Layer
  3. Transport Layer
  4. Session Layer
  5. Application Layer
Show answer and explanation

Correct answer: E. Application Layer

FWSnort is an application-layer utility that functions as an intrusion detection system (IDS) by translating Snort rules into firewall rules. It operates at the Application Layer (Layer 7) of the OSI model where it analyzes application-level traffic patterns and security policies rather than lower-layer protocols.

Why the other options are wrong

  • A. The Physical Layer deals with electrical signals and media transmission, not application-level security rule processing.
  • B. The Data Link Layer handles MAC addresses and frame transmission, which FWSnort does not operate upon.
  • C. While transport protocols carry traffic, FWSnort's intelligence operates above the Transport Layer at the application level.
  • D. The Session Layer manages connection establishment; FWSnort operates at a higher semantic level for rule application.

That was 10 of 88.

The full GIAC Certified Enterprise Defender GCED pack has all 88 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack