10 free GIAC Certified Intrusion Analyst GCIA practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 507 questions. Work through them, then open each answer to check your reasoning.
Get all 507 questions (US$39) · Download these 10 as a PDF
Question 1
Andrew works as a System Administrator for NetPerfect Inc. All client computers on the network run on Mac OS X. The Sales Manager of the company complains that his MacBook is not able to boot. Andrew wants to check the booting process. He suspects that an error persists in the bootloader of Mac OS X. Which of the following is the default bootloader on Mac OS X that he should use to resolve the issue?
Show answer and explanation
Correct answer: B. BootX
BootX is the default bootloader for Mac OS X systems. It is responsible for loading the kernel and initializing the boot process on Apple Macintosh computers. LILO and GRUB are Linux bootloaders, while NT Loader is used by Windows systems.
Why the other options are wrong
- A. LILO is the Linux Loader used on Linux systems, not Mac OS X.
- C. NT Loader is the bootloader for Windows NT-based systems, not Mac OS X.
- D. GRUB is the Grand Unified Bootloader used primarily on Linux systems, not Mac OS X.
Question 2
Sasha wants to add an entry to your DNS database for your mail server.
Which of the following types of resource records will she use to accomplish this?
Show answer and explanation
Correct answer: C. MX
MX (Mail Exchange) records are used in DNS to specify the mail servers responsible for receiving email for a domain. They are essential for directing email traffic to the correct mail server. ANAME is not a standard DNS record type, SOA defines zone parameters, and CNAME creates aliases for hostnames.
Why the other options are wrong
- A. ANAME is not a standard DNS resource record type.
- B. SOA records define Start of Authority parameters for a DNS zone, not mail server entries.
- D. CNAME records create canonical name aliases but are not used specifically for mail server entries.
Question 3
John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks?
Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, B, C
A. Dictionary attack B. Hybrid attack C. Brute Force attack "apple" is a short, common English word, so it falls to several cracking techniques. A dictionary attack simply tries every word in a wordlist, and "apple" is in every wordlist. A hybrid attack starts from dictionary words and appends or alters characters, so the base word "apple" is recovered along the way. A brute force attack tries every possible character combination, and a five-character lowercase password is exhausted in seconds. All three therefore succeed against this password.
Why the other options are wrong
- D. A rule-based attack is used when the attacker already knows something about the password composition policy (length, required character classes) and builds rules from that knowledge; nothing here gives the attacker such prior information about the password's structure.
Question 4
Which of the following proxy servers is also referred to as transparent proxies or forced proxies?
Show answer and explanation
Correct answer: D. Intercepting proxy server
Intercepting proxy servers, also called transparent proxies or forced proxies, intercept client requests without requiring explicit client configuration. They transparently handle traffic by intercepting it at the network level, forcing all traffic through the proxy without the user's knowledge or manual configuration. The other proxy types require explicit configuration or serve different purposes.
Why the other options are wrong
- A. Tunneling proxy servers establish encrypted tunnels for secure communication but are not referred to as transparent proxies.
- B. Reverse proxy servers handle requests from clients on behalf of backend servers and are not transparent proxies.
- C. Anonymous proxy servers hide the client's identity but require explicit configuration and are not the same as transparent proxies.
Question 5
Victor works as a network administrator for DataSecu Inc. He uses a dual firewall Demilitarized Zone (DMZ) to insulate the rest of the network from the portions that is available to the Internet.
Which of the following security threats may occur if DMZ protocol attacks are performed?
Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, B, D
A. Attacker can perform Zero Day attack by delivering a malicious payload that is not a part of the intrusion detection/prevention systems guarding the network. B. Attacker can gain access to the Web server in a DMZ and exploit the database. D. Attacker can exploit any protocol used to go into the internal network or intranet of the com pany Option A is correct because attackers can deliver zero-day exploits through the DMZ that bypass intrusion detection systems. Option B is correct because compromising a web server in the DMZ can provide a foothold to exploit backend databases. Option D is correct because attackers can exploit protocols used to communicate between the DMZ and internal network. Option C is incorrect because if an attacker breaks the first firewall, the second firewall would still protect the internal network if properly configured with different rules.
Why the other options are wrong
- C. A properly configured dual firewall DMZ means the second firewall would still defend the internal network even if the first is breached, assuming the firewalls have independent rule sets.
Question 6
Which of the following is known as a message digest?
Show answer and explanation
Correct answer: A. Hash function
A hash function, also called a message digest algorithm, is a cryptographic function that produces a fixed-size string of bytes from input data. The output is commonly referred to as a message digest. While hashing algorithm (option B) describes the same concept, hash function is the more precise and commonly accepted terminology for what produces a message digest. Spider and message authentication code serve different purposes.
Why the other options are wrong
- B. Hashing algorithm describes the process but is less precise than hash function as the answer to what produces a message digest.
- C. A spider is a web crawler used for indexing web pages, unrelated to message digests.
- D. A message authentication code (MAC) is used for authentication and integrity verification but is distinct from a simple message digest/hash function.
Question 7
Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion.
When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc.
Which of the following types of Cross-Site Scripting attack Ryan intends to do?
Show answer and explanation
Correct answer: D. Persistent
The exploit code is submitted to a forum and stored on the site, so it is served back to every visitor of the infected page and executes automatically without the victim clicking a crafted link. Injecting script that is saved in the application's data store (message boards, comments, profiles) and replayed to other users is the defining characteristic of a persistent, or stored, XSS attack, and it enables session hijacking and history theft as described.
Why the other options are wrong
- A. DOM-based XSS occurs entirely in client-side script manipulating the document object model; the payload is not stored on the server and delivered to all forum visitors.
- B. Non-persistent (reflected) XSS requires the victim to follow a specially crafted request; the payload is not saved on the site as it is here.
- C. SAX is an event-driven XML parsing API, not a category of cross-site scripting.
Question 8
You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible attack is in process.
Which of the following actions will you take for this?
Show answer and explanation
Correct answer: B. Install a network-based IDS
A network-based Intrusion Detection System (IDS) is specifically designed to monitor all traffic on a network segment in real-time and generate alerts when suspicious patterns or known attacks are detected. It operates at the network level, analyzing traffic across multiple hosts, making it ideal for monitoring an entire local network. Host-based IDS monitors individual systems, firewalls control access rather than detect attacks, and DMZ firewalls are architectural components, not monitoring tools.
Why the other options are wrong
- A. Verbose firewall logging records events but does not actively detect and alert on attacks in real-time.
- C. A DMZ firewall is a network architecture component used for segmentation, not for monitoring suspicious activities.
- D. Host-based IDS monitors individual systems only, not all network traffic across the local network.
Question 9
Adam works as a professional Computer Hacking Forensic Investigator. He wants to investigate a suspicious email that is sent using a Microsoft Exchange server.
Which of the following files will he review to accomplish the task?
Each correct answer represents a part of the solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, B, C
A. Checkpoint files B. EDB and STM database files C. Temporary files When investigating suspicious emails on a Microsoft Exchange server, investigators must examine EDB and STM database files (the core Exchange databases containing mailbox data and message content), checkpoint files (which track transaction logs and database consistency), and temporary files (which may contain cached email data or partial message fragments). These three sources collectively capture email evidence from different layers of the Exchange system.
Why the other options are wrong
- D. Cookie files are browser artifacts related to web browsing, not Exchange email investigation, and are not relevant to analyzing email transmission or content on an Exchange server.
Question 10
This is a Windows-based tool that is used for the detection of wireless LANs using the IEEE 802.11a, 802.11b, and 802.11g standards. The main features of these tools are as follows:
• It displays the signal strength of a wireless network, MAC address, SSID, channel details, etc.
• It is commonly used for the following purposes:
Show answer and explanation
That was 10 of 507.
The full GIAC Certified Intrusion Analyst GCIA pack has all 507 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.