Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65

GCED GIAC Certified Enterprise Defender Questions and Answers

Questions 4

Which type of attack could be used to obtain IOS router configuration files without a valid user password?

Options:

A.

ARP cache poisoning

B.

CDP sniffing

C.

SNMP man in the middle

D.

TFTP brute force

Buy Now
Questions 5

Before re-assigning a computer to a new employee, what data security technique does the IT department use to make sure no data is left behind by the previous user?

Options:

A.

Fingerprinting

B.

Digital watermarking

C.

Baselining

D.

Wiping

Buy Now
Questions 6

What feature of Wireshark allows the analysis of one HTTP conversation?

Options:

A.

Follow UDP Stream

B.

Follow TCP Stream

C.

Conversation list > IPV4

D.

Setting a display filter to ‘tcp’

Buy Now
Questions 7

Analyze the screenshot below. Which of the following attacks can be mitigated by these configuration settings?

GCED Question 7

Options:

A.

A Denial-of-Service attack using network broadcasts

B.

A Replay attack

C.

An IP masquerading attack

D.

A MAC Flood attack

Buy Now
Questions 8

A company classifies data using document footers, labeling each file with security labels “Public”, “Pattern”, or “Company Proprietary”. A new policy forbids sending “Company Proprietary” files via email. Which control could help security analysis identify breaches of this policy?

Options:

A.

Monitoring failed authentications on a central logging device

B.

Enforcing TLS encryption for outbound email with attachments

C.

Blocking email attachments that match the hashes of the company’s classification templates

D.

Running custom keyword scans on outbound SMTP traffic from the mail server

Buy Now
Questions 9

The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?

Options:

A.

alert tcp any 22 < > any 22 (msg:SSH connection; class type:misc-attack;sid: 122:rev:1;)

B.

alert tcp any any < > any 6000: (msg:X-Windows session; flow:from_server,established;nocase;classtype:misc-attack;sid:101;rev:1;)

C.

alert tcp any 23 < > any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;)

D.

alert udp any any < > any 5060 (msg:VOIP message; classtype:misc-attack;sid:113; rev:2;)

Buy Now
Questions 10

Which of the following is an outcome of the initial triage during incident response?

Options:

A.

Removal of unnecessary accounts from compromised systems

B.

Segmentation of the network to protect critical assets

C.

Resetting registry keys that vary from the baseline configuration

D.

Determining whether encryption is in use on in scope systems

Buy Now
Questions 11

An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for this purpose?

Options:

A.

tcpdump –s0 –i eth0 port 514

B.

tcpdump –nnvvX –i eth0 port 6514

C.

tcpdump –nX –i eth0 port 514

D.

tcpdump –vv –i eth0 port 6514

Buy Now
Questions 12

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm’s artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

Options:

A.

The team did not adequately apply lessons learned from the incident

B.

The custom rule did not detect all infected workstations

C.

They did not receive timely notification of the security event

D.

The team did not understand the worm’s propagation method

Buy Now
Questions 13

Enabling port security prevents which of the following?

Options:

A.

Using vendors other than Cisco for switching equipment as they don’t offer port security

B.

Spoofed MAC addresses from being used to cause a Denial of Service condition

C.

Legitimate MAC addresses from being used to cause a Denial of Service condition

D.

Network Access Control systems from functioning properly

Buy Now
Questions 14

Requiring background checks for employees who access protected data is an example of which type of data loss control?

Options:

A.

Mitigation

B.

Prevention

C.

Monitoring

D.

Identification

Buy Now
Questions 15

What should happen before acquiring a bit-for-bit copy of suspect media during incident response?

Options:

A.

Encrypt the original media to protect the data

B.

Create a one-way hash of the original media

C.

Decompress files on the original media

D.

Decrypt the original media

Buy Now
Questions 16

Which statement below is the MOST accurate about insider threat controls?

Options:

A.

Classification of information assets helps identify data to protect.

B.

Security awareness programs have a minimal impact on reducing the insider threat.

C.

Both detective and preventative controls prevent insider attacks.

D.

Rotation of duties makes an insider threat more likely.

E.

Separation of duties encourages one employee to control a great deal of information.

Buy Now
Questions 17

Requiring criminal and financial background checks for new employees is an example of what type of security control?

Options:

A.

Detective Support Control

B.

Detective Operational Control

C.

Detective Technical Control

D.

Detective Management Control

Buy Now
Questions 18

Michael, a software engineer, added a module to a banking customer’s code. The new module deposits small amounts of money into his personal bank account. Michael has access to edit the code, but only code reviewers have the ability to commit modules to production. The code reviewers have a backlog of work, and are often willing to trust the software developers’ testing and confidence in the code.

Which technique is Michael most likely to engage to implement the malicious code?

Options:

A.

Denial of Service

B.

Race Condition

C.

Phishing

D.

Social Engineering

Buy Now
Questions 19

What does the following WMIC command accomplish?

process where name=’malicious.exe’ delete

Options:

A.

Removes the ‘malicious.exe’ process form the Start menu and Run registry key

B.

Stops current process handles associated with the process named ‘malicious.exe’

C.

Removes the executable ‘malicious.exe’ from the file system

D.

Stops the ‘malicious.exe’ process from running and being restarted at the next reboot

Buy Now
Questions 20

What is needed to be able to use taskkill to end a process on remote system?

Options:

A.

Svchost.exe running on the remote system

B.

Domain login credentials

C.

Port 445 open

D.

Windows 7 or higher on both systems

Buy Now
Questions 21

Which Windows tool would use the following command to view a process:

process where name=’suspect_malware.exe’list statistics

Options:

A.

TCPView

B.

Tasklist

C.

WMIC

D.

Netstat

Buy Now
Questions 22

Throughout the week following a new IPS deployment, nearly every user on the protected subnet submits helpdesk tickets regarding network performance and not being able to access several critical resources. What is the most likely reason for the performance issues?

Options:

A.

The incoming traffic is overflowing the device’s TAP buffer

B.

The in-line TAP experienced a hardware failure

C.

The IPS sensor was changed from test mode to production mode

D.

The IPS sensor was powered off or moved out of band

Buy Now
Questions 23

Why would an incident handler acquire memory on a system being investigated?

Options:

A.

To determine whether a malicious DLL has been injected into an application

B.

To identify whether a program is set to auto-run through a registry hook

C.

To list which services are installed on they system

D.

To verify which user accounts have root or admin privileges on the system

Buy Now
Questions 24

Who is ultimately responsible for approving methods and controls that will reduce any potential risk to an organization?

Options:

A.

Senior Management

B.

Data Owner

C.

Data Custodian

D.

Security Auditor

Buy Now
Questions 25

Network administrators are often hesitant to patch the operating systems on CISCO router and switch operating systems, due to the possibility of causing network instability, mainly because of which of the following?

Options:

A.

Having to rebuild all ACLs

B.

Having to replace the kernel

C.

Having to re-IP the device

D.

Having to rebuild ARP tables

E.

Having to rebuild the routing tables

Buy Now
Questions 26

Why might an administrator not be able to delete a file using the Windows del command without specifying additional command line switches?

Options:

A.

Because it has the read-only attribute set

B.

Because it is encrypted

C.

Because it has the nodel attribute set

D.

Because it is an executable file

Buy Now
Exam Code: GCED
Exam Name: GIAC Certified Enterprise Defender
Last Update: Apr 30, 2026
Questions: 88

PDF + Testing Engine

$63.52  $181.49

Testing Engine

$50.57  $144.49
buy now GCED testing engine

PDF (Q&A)

$43.57  $124.49
buy now GCED pdf