Free GIAC Information Security Professional GISP practice questions

Correct answer: D. ARP poisoning

ARP poisoning is a data link layer (Layer 2) attack that sends forged Address Resolution Protocol replies so that a victim maps an attacker's MAC address to a legitimate IP address. Because ARP resolution happens on the local Ethernet segment, the attack works against both wired switched LANs and wireless LANs bridged to them. The result is traffic interception, modification, or blocking in a man-in-the-middle position.

Why the other options are wrong

• A. DNS poisoning corrupts name resolution records or resolver caches at the application layer rather than manipulating Ethernet frame delivery on the local segment.
• B. Keystroke logging captures input on an individual host through software or hardware and does not attack the network itself.
• C. Mail bombing floods a mailbox or mail server with messages, which is an application layer denial-of-service technique, not an Ethernet attack.

Correct answer: D. Ciphertext

Ciphertext is the standard term for encrypted text that has been transformed through a cryptographic algorithm. It is unreadable without the appropriate decryption key and is the output of any encryption process.

Why the other options are wrong

• A. Plaintext refers to unencrypted, readable text before encryption is applied.
• B. Cookies are HTTP data storage mechanisms used for session management, not encrypted text.
• C. Hypertext is markup-formatted text for web documents, not encrypted material.

Correct answer: A, C

A. It helps identify which information is the most sensitive or vital to an organization. C. It helps identify which protections apply to which information. Information classification helps organizations identify which data is most sensitive or critical (option A), enabling risk assessment and prioritization. It also determines which security protections and controls should apply to different data categories (option C). Option B describes data integrity controls, and option D relates to cost management rather than classification purposes.

Why the other options are wrong

• B. Preventing unauthorized modifications is a function of data integrity and access controls, not classification itself.
• D. While classification may indirectly affect costs, reducing TCO is not a direct benefit of the classification process.

Correct answer: A. Role-Based Access Control

Role-Based Access Control (RBAC) grants permissions based on job functions and roles, ensuring users access only resources necessary for their responsibilities. This model aligns access privileges directly with organizational roles, making it the appropriate choice for limiting user access to required resources.

Why the other options are wrong

• B. Discretionary Access Control allows data owners to grant permissions freely, not enforcing organizational requirements.
• C. Mandatory Access Control uses fixed security labels and is typically used in hig
  -ecurity environments, not for general role-based access.
• D. Policy Access Control is not a standard access control model classification.

Correct answer: A, B, C, D

A. Smart card B. Biometrics C. Username and password D. Magnetic stripe card All four options are valid authentication methods. Smart cards (A) and magnetic stripe cards (D) are physical token-based authentication. Biometrics (B) uses unique biological characteristics. Username and password (C) is knowledge-based authentication. Organizations typically implement multiple methods to create multi-factor authentication systems.

Correct answer: D. OCSP

OCSP, the Online Certificate Status Protocol, is the standard method for querying a responder about whether a specific certificate is good, revoked, or unknown. It returns a signed, real-time status response, so a client does not have to download and parse a full certificate revocation list. This makes it the protocol used to verify certificate status.

Why the other options are wrong

• A. CEP, the Certificate Enrollment Protocol, handles certificate requests and issuance, not revocation status checking.
• B. HTTP is a general-purpose application layer protocol that can transport status requests but performs no certificate validation of its own.
• C. OSPF is a link-state IP routing protocol and has nothing to do with public key infrastructure.

Correct answer: B, C, D

B. Preserve the log files for a forensics expert. C. Prevent the company employees from entering the server room. D. Detach the network cable from the database server. When preserving evidence after a security incident, logs must be secured for forensic analysis (B), the affected system should be isolated from the network to prevent tampering (D), and unauthorized personnel must be restricted from the server room to maintain evidence chain of custody (C). Preventing forensics experts from accessing the server room (A) would obstruct the investigation and is counterproductive.

Why the other options are wrong

• A. Forensics experts must be allowed access to conduct a proper investigation and evidence collection.

Correct answer: A. 3 to 4 feet

A fence height of 3 to 4 feet is generally considered sufficient to deter casual trespassers and is commonly used as a psychological barrier. This height is easily visible and establishes a boundary without appearing as a serious security fortification, making it suitable for low-security perimeters.

Why the other options are wrong

• B. At 2 to 2.5 feet, a fence is too low to effectively deter even casual trespassers and is mainly decorative.
• C. An 8-foot fence is a substantial security barrier designed to deter serious intruders, not just casual trespassers.
• D. A 6 to 7-foot fence represents a significant physical security measure intended to deter determined intruders, exceeding casual trespasser deterrence.

Correct answer: A. In this model, a user can access resources according to his role in the organization.

In Role-Based Access Control, permissions are attached to roles that reflect job functions, and users receive access by being assigned to the appropriate role. A user can therefore reach only the resources his or her organizational role allows. This design scales well because access changes are made once at the role level instead of per user account.

Why the other options are wrong

• B. Assigning permissions uniquely to each user account describes user-based or identity-based access control, where entitlements are managed one account at a time.
• C. Granting every user account the same permission provides no differentiation of access and is not an access control model.
• D. Access granted by seniority is not a recognized model; role-based systems key off job function, not length of service or rank.

Correct answer: A, B, D

A. It is immune to electromagnetic interference (EMI). B. It can transmit undistorted signals over great distances. D. It uses light pulses for signal transmission. Fiber optic cables are immune to electromagnetic interference because they transmit data using light pulses rather than electrical signals, allowing undistorted signal transmission over long distances. The question describes fiber optic cable characteristics: immunity to EMI, long-distance signal integrity, and light pulse transmission are all defining features of fiber optics.

Why the other options are wrong

• C. Eight wires twisted into four pairs describes Unshielded Twisted Pair (UTP) copper cabling used in Ethernet, not fiber optic cable.