22 free GIAC Certified Enterprise Defender GCED practice questions from the CertStash pack of 88, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 22 free here, all 88 in the pack, and each step includes the one before it.
Get all 88 questions (US$39) · Download the first 10 as a PDF
Question 1
Before re-assigning a computer to a new employee, what data security technique does the IT department use to make sure no data is left behind by the previous user?
Show answer and explanation
Correct answer: D. Wiping
Wiping is the data security technique used to remove all data from a computer before reassigning it to a new employee. This process overwrites the storage media to ensure no recoverable data remains from the previous user, preventing unauthorized access to sensitive information.
Why the other options are wrong
- A. Fingerprinting is a technique for identifying and authenticating users or files, not for removing data.
- B. Digital watermarking embeds identifying information into files for ownership or authenticity verification, not data removal.
- C. Baselining establishes a standard configuration or performance baseline for comparison and monitoring, not data deletion.
Question 2
What feature of Wireshark allows the analysis of one HTTP conversation?
Show answer and explanation
Correct answer: B. Follow TCP Stream
Follow TCP Stream is the Wireshark feature that reconstructs and displays one complete HTTP conversation between a client and server. This function extracts the TCP stream containing the HTTP traffic, making it easy to analyze the full conversation in a readable format.
Why the other options are wrong
- A. Follow UDP Stream is used for UDP traffic analysis, not HTTP which uses TCP.
- C. Conversation list with IPV4 filter displays statistics about conversations but does not provide the detailed stream view of a single HTTP conversation.
- D. Setting a display filter to 'tcp' filters packets but does not follow or reconstruct a single conversation stream.
Question 3
From a security perspective, how should the Root Bridge be determined in a Spanning Tree Protocol (STP) environment?
Show answer and explanation
Correct answer: A. Manually selected and defined by the network architect or engineer.
From a security perspective, the Root Bridge should be manually selected and defined by the network architect or engineer. This prevents attackers from manipulating the election process through Bridge ID spoofing or other attacks. Manual configuration ensures that only the intended, trusted switch serves as the root bridge.
Why the other options are wrong
- B. While STP technically selects the highest Bridge ID as root, allowing automatic selection based on Bridge ID is a security risk, as attackers can lower their Bridge ID to become root.
- C. Automatic selection by STP without manual oversight creates a security vulnerability where malicious devices can influence the root bridge election.
- D. This is technically incorrect; only one switch becomes the root bridge in an STP environment, not all switch interfaces.
Question 4
Which tasks would a First Responder perform during the Identification phase of Incident Response?
Show answer and explanation
Correct answer: C. Search for sources of data and information that may be valuable in confirming and containing an incident.
During the Identification phase, First Responders search for sources of data and information that may be valuable in confirming and containing an incident. This involves gathering evidence, logs, and indicators that help establish what has occurred. The other activities, verifying root cause, reinstalling security software, and disconnecting systems, occur in later phases of incident response.
Why the other options are wrong
- A. Verifying root cause and applying patches are part of the Remediation or Recovery phases, not Identification.
- B. Reinstalling security software occurs during Containment or Recovery phases, not the initial Identification phase.
- D. Disconnecting systems and searching for malicious processes are containment activities that occur after identification has been established.
Question 5
What should happen before acquiring a bit-for-bit copy of suspect media during incident response?
Show answer and explanation
Correct answer: B. Create a one-way hash of the original media
Before acquiring a bit-for-bit copy of suspect media, a one-way hash of the original media should be created. This hash serves as a digital fingerprint that proves the original media's integrity and provides a reference to verify that the forensic copy is identical to the original, which is critical for maintaining the chain of custody and evidence admissibility.
Why the other options are wrong
- A. Encrypting the original media would alter it and compromise the forensic process.
- C. Decompressing files on the original media would modify the suspect media and violate forensic integrity principles.
- D. Decrypting the original media before imaging would modify its state and compromise the forensic evidence.
Question 6
How does the Cisco IOS IP Source Guard feature help prevent spoofing attacks?
Show answer and explanation
Correct answer: A. Filters traffic based on IP address once a DHCP address has been assigned
Cisco IOS IP Source Guard filters traffic based on the IP address once a DHCP address has been assigned to a device. It validates that traffic coming from a port matches the IP address binding created during DHCP assignment, preventing attackers from sending packets with spoofed source IP addresses.
Why the other options are wrong
- B. This describes DHCP snooping, which prevents unauthorized MAC addresses from receiving IP addresses, not IP Source Guard's function.
- C. This describes Dynamic ARP Inspection, which blocks unsolicited ARP packets, not IP Source Guard.
- D. Rate limiting CAM table flooding is a separate defense against MAC flooding attacks, not the function of IP Source Guard.
Question 7
Which control would BEST help detect a potential insider threat?
Show answer and explanation
Correct answer: C. Multiple scheduled log reviews of all employee access levels throughout the year
Multiple scheduled log reviews of all employee access levels throughout the year provide the best detective control for insider threats. Regular review of access logs allows security teams to identify unusual access patterns, unauthorized privilege escalations, and suspicious activities that may indicate malicious insider behavior.
Why the other options are wrong
- A. Mandatory approval for administrative access is a preventive control that limits who gets access, not a detection mechanism for insider threats.
- B. Providing the same access to all employees actually increases risk by removing the principle of least privilege and does not effectively detect threats.
- D. Cross-training employees on job duties is a preventive control for segregation of duties but does not specifically detect insider threat activity.
Question 8
On which layer of the OSI Reference Model does the FWSnort utility function?
Show answer and explanation
Correct answer: E. Application Layer
FWSnort is an application-layer intrusion detection tool that operates at Layer 7 of the OSI model. It combines Snort intrusion detection rules with firewall rule generation capabilities and functions at the application layer where it can inspect and analyze application-level traffic and protocols.
Why the other options are wrong
- A. The Physical Layer deals only with electrical signals and cables, not intrusion detection.
- B. The Data Link Layer handles MAC addressing and frame forwarding, not application-level threat analysis.
- C. The Transport Layer handles TCP/UDP but does not perform application-level intrusion detection like FWSnort.
- D. The Session Layer manages connections but does not perform the deep packet inspection required by FWSnort.
Question 9
Which Unix administration tool is designed to monitor configuration changes to Cisco, Extreme and Foundry infrastructure devices?
Show answer and explanation
Correct answer: C. RANCID
RANCID (Really Awesome New Cisco confIg Differ) is a Unix administration tool specifically designed to monitor, track, and manage configuration changes on network infrastructure devices including Cisco routers and switches, as well as Extreme and Foundry devices. It maintains version control of device configurations and alerts administrators to unauthorized changes.
Why the other options are wrong
- A. SNMP is used for network monitoring and performance metrics, not configuration change tracking.
- B. Netflow analyzes traffic patterns and network flows, not device configuration changes.
- D. RMON is a monitoring protocol for network segment analysis, not configuration management.
Question 10
If a Cisco router is configured with the "service config" configuration statement, which of the following tools could be used by an attacker to apply a new router configuration?
Show answer and explanation
Correct answer: A. TFTPD
When a Cisco router is configured with the 'service config' statement, it allows the device to accept configuration updates from a TFTP server. An attacker can exploit this by hosting a malicious configuration on a TFTPD (TFTP Daemon) server and leveraging this service to push a new configuration to the router.
Why the other options are wrong
- B. Hydra is a password-cracking tool, not used for configuration deployment.
- C. Ettercap is a network sniffer and man-in-the-middle tool, not for router configuration.
- D. Yersinia is used for network protocol testing and attacks, but not specifically for TFTP configuration deployment.
What people say about the full Certified Enterprise Defender GCED pack 5.0 from 4
passed the GCED exam today as 99%, almost all the question from this GCED exam dumps! That’s pretty awesome!
I purchase the GCED exam dumps and pass easily. If you do not want to waste too much time on prepare, I advise you to purchase this exam dumps.
Recommend for studying GCED
Question 11
You have been tasked with searching for Alternate Data Streams on the following collection of Windows partitions; 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total Gigabytes and partitions will you need to search?
Show answer and explanation
Correct answer: A. 4GBs of data, the NTFS partition only.
Alternate Data Streams (ADS) are a feature that exists only on NTFS file systems. FAT16 and FAT32 do not support ADS and therefore cannot contain them. A forensic examiner searching for alternate data streams would only need to search the 4GB NTFS partition, as the other partitions cannot store ADS regardless of their size.
Why the other options are wrong
- B. FAT16 and FAT32 file systems do not support Alternate Data Streams, making those partitions irrelevant to the search.
- C. The FAT32 partition does not support Alternate Data Streams and should not be searched for this purpose.
- D. FAT32 does not support Alternate Data Streams, so including it in the search is unnecessary.
Question 12
An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worms artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?
Show answer and explanation
Correct answer: D. The team did not understand the worm’s propagation method
The team failed to understand the worm's propagation method. Despite blocking the worm with an IPS signature and removing artifacts from detected workstations, the infection continued for days afterward. This indicates the worm was spreading through a mechanism the team didn't comprehend, perhaps lateral movement via network shares, email propagation, removable media, or infection of systems not triggering the rule. Without understanding propagation vectors, containment efforts are incomplete and reinfection continues.
Why the other options are wrong
- A. Lessons learned apply after the incident; the failure occurred during active response.
- B. If the IPS rule was working but infection continued, the issue is propagation method, not rule effectiveness.
- C. Notification timing doesn't explain why infections persisted after initial remediation.
Question 13
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
Show answer and explanation
Correct answer: A. To create a file on the USB drive that contains a listing of the C: drive
The command 'dir /s /a dhsra c: > a:\IRCD.txt' creates a directory listing of the C: drive (including hidden, system, and archive attributes) and redirects the output to a file named IRCD.txt on the USB drive (a:). The /s flag recursively lists all subdirectories, /a dhsra specifies attributes to display, and the redirection operator (>) sends the results to the USB drive. This produces a text file containing a complete file listing for analysis and documentation.
Why the other options are wrong
- B. The command lists files but does not copy them; it only creates a text listing.
- C. This command does not create a forensic image; it generates a directory listing only.
- D. This command does not perform hash comparison; it only lists file information.
Question 14
Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?
Show answer and explanation
Correct answer: D. Swap space and page files
Swap space and page files should be collected first from a live system. These volatile memory artifacts are lost immediately upon system shutdown and contain ephemeral data such as decrypted passwords, encryption keys, running processes, and unallocated memory fragments critical to incident analysis. Event logs from a central repository, directory listings, and media contents persist on disk and can be collected later. The order of volatility principle dictates that the most volatile evidence, data existing only in RAM, must be captured before any system state changes occur.
Why the other options are wrong
- A. Event logs in a central repository are persistent and can be collected later without data loss.
- B. Directory listings of system files persist on disk and do not require immediate collection.
- C. Media in the CD-ROM drive is persistent and poses no volatility concern.
Question 15
A company classifies data using document footers, labeling each file with security labels "Public", "Pattern", or "Company Proprietary". A new policy forbids sending "Company Proprietary" files via email. Which control could help security analysis identify breaches of this policy?
Show answer and explanation
Correct answer: D. Running custom keyword scans on outbound SMTP traffic from the mail server
Running custom keyword scans on outbound SMTP traffic from the mail server can identify emails containing security labels or patterns associated with Company Proprietary data, allowing detection of policy violations. Failed authentication monitoring does not relate to data classification. TLS encryption protects data in transit but does not detect classification violations. Hash-based blocking of classification templates is impractical and would not reliably identify proprietary content. Keyword scanning of SMTP traffic provides the visibility needed to identify and flag breaches of the email policy.
Why the other options are wrong
- A. Failed authentication monitoring detects brute force and unauthorized access attempts, not data classification policy violations.
- B. TLS encryption secures email in transit but does not detect or prevent sending of classified data.
- C. Blocking template hashes is ineffective because proprietary data exists in many file formats and would not reliably match templates.
Question 16
An outside vulnerability assessment reveals that users have been routinely accessing Gmail from work for over a year, a clear violation of this organizations security policy. The users report "it just started working one day". Later, a network administrator admits he meant to unblock Gmail for just his own IP address, but he made a mistake in the firewall rule. Which security control failed?
Show answer and explanation
Correct answer: C. Auditing
The firewall enforced exactly the rule it was given, but nobody noticed the mistaken change for over a year until an outside assessment found it. Regular auditing and review of firewall rules and logs would have caught the error quickly, so auditing is the control that failed.
Why the other options are wrong
- A. The firewall kept enforcing its configured rules, so the enforcement mechanism itself did not fail.
- B. Authentication confirms identity and played no part in the rule mistake or its long survival.
- D. Rights management protects documents and data use, not network access rules.
Question 17
A legacy server on the network was breached through an OS vulnerability with no patch available. The server is used only rarely by employees across several business units. The theft of information from the server goes unnoticed until the company is notified by a third party that sensitive information has been posted on the Internet. Which control was the first to fail?
Show answer and explanation
Correct answer: C. Data classification
Data classification was the first control to fail. The information stolen and posted publicly was sensitive, yet the legacy server holding it had no protective controls such as encryption, access restrictions, or monitoring. If the organization had properly classified the data and applied controls commensurate with its sensitivity, the theft would have been detected, restricted, or mitigated before third-party notification. Without data classification, the organization cannot determine what to protect or how. Access controls, awareness, and incident response are downstream controls that depend on knowing what data exists and matters.
Why the other options are wrong
- A. Security awareness does not prevent or detect unpatched vulnerability exploitation.
- B. Access control cannot be properly applied without first knowing what data requires protection through classification.
- D. Incident response addresses aftermath; earlier controls should have prevented or detected the breach.
Question 18
An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for this purpose?
Show answer and explanation
Correct answer: C. tcpdump –nX –i eth0 port 514
Unencrypted syslog travels on port 514, while 6514 is syslog over TLS. The -n option stops tcpdump from trying name lookups, which would only slow capture on a network with no DNS, and -X prints the payload so the syslog text can be read.
Why the other options are wrong
- A. Without -n tcpdump tries to resolve names that cannot be resolved, and without -X the syslog content is not displayed.
- B. Port 6514 carries encrypted syslog over TLS, not unencrypted syslog.
- D. Port 6514 carries encrypted syslog, and without -n tcpdump wastes time on name lookups.
Question 19
Throughout the week following a new IPS deployment, nearly every user on the protected subnet submits helpdesk tickets regarding network performance and not being able to access several critical resources. What is the most likely reason for the performance issues?
Show answer and explanation
Correct answer: C. The IPS sensor was changed from test mode to production mode
The most likely cause of widespread performance issues and blocked access immediately after IPS deployment is that the IPS sensor was changed from test mode to production mode with overly aggressive or misconfigured rules. In test mode, the IPS typically runs in detection-only mode without blocking traffic. Transitioning to production mode with inappropriate rulesets would cause blocking of legitimate traffic and degraded performance. TAP buffer overflow would cause packet loss but not consistent access blocking, hardware failure would eliminate protection entirely, and powering off the device would remove it from the network path.
Why the other options are wrong
- A. TAP buffer overflow causes packet loss and dropped connections, not systematic blocking of resources
- B. A hardware failure would remove the device from operation entirely, not cause selective access issues
- D. Powering off or moving out of band would eliminate IPS protection but not cause performance issues from rule processing
Question 20
Michael, a software engineer, added a module to a banking customers code. The new module deposits small amounts of money into his personal bank account. Michael has access to edit the code, but only code reviewers have the ability to commit modules to production. The code reviewers have a backlog of work, and are often willing to trust the software developers testing and confidence in the code. Which technique is Michael most likely to engage to implement the malicious code?
Show answer and explanation
Correct answer: D. Social Engineering
Michael is employing social engineering by exploiting the code reviewers' trust in developers and their willingness to approve code without thorough scrutiny due to backlog pressure. He is manipulating their behavior and exploiting the trust relationship to bypass controls that would normally catch the malicious code.
Why the other options are wrong
- A. Denial of Service is an availability attack unrelated to code modification or committing malicious modules.
- B. Race Condition is a timing-based vulnerability in concurrent processes, not applicable to manipulating code review.
- C. Phishing involves deception through fraudulent communications, not manipulation of existing trust relationships in this context.
Question 21
Requiring background checks for employees who access protected data is an example of which type of data loss control?
Show answer and explanation
Correct answer: B. Prevention
Requiring background checks for employees who access protected data is a prevention control. Prevention controls stop unauthorized access or data loss before it occurs by screening personnel before they gain access to sensitive information. This differs from mitigation (reducing impact after an incident), monitoring (detecting activity), and identification (recognizing what needs protection).
Why the other options are wrong
- A. Mitigation reduces the impact of data loss after it occurs, not preventing initial access
- C. Monitoring detects and observes activities but does not prevent unauthorized access
- D. Identification determines what data needs protection, not who can access it
Question 22
Why would the pass action be used in a Snort configuration file?
Show answer and explanation
Correct answer: A. The pass action simplifies some filtering by specifying what to ignore.
The pass action in Snort allows the administrator to specify traffic that should be ignored or excluded from further rule evaluation. This simplifies filtering by explicitly exempting known benign traffic from triggering alerts, reducing false positives and allowing focus on genuinely suspicious activity. Pass rules take precedence and halt evaluation of subsequent rules for matching packets.
Why the other options are wrong
- B. Pass does not pass packets to further rules; it stops evaluation and allows the packet through without alerting.
- C. Pass is a functional action, not a placeholder for future updates.
- D. Pass does not invoke external processes; it is a Snort-internal action.
- E. Pass reduces false positives by excluding benign traffic, not increasing them.
That was 22 of 88.
The full GIAC Certified Enterprise Defender GCED pack has all 88 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 44 free as one PDF by email. Get the Half Pack →