GIAC GCIA Exam - Topic 4 Question 25 Discussion

Actual exam question for GIAC's GCIA exam

Question #: 25
Topic #: 4

John works as a Network Security Professional. He is assigned a project to test the security of www.we-are-secure.com. He is working on the Linux operating system and wants to install an Intrusion Detection System on the We-are-secure server so that he can receive alerts about any hacking attempts. Which of the following tools can John use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

ASARA

BSnort

CSamhain

DTripwire

Show Suggested Answer

Suggested Answer: B, C

by Jesusita at May 05, 2022, 12:15 PM

Limited Time Offer

25%

Off

Get Premium GCIA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosalia

7 months ago

I agree, Snort is the go-to for most pros.

upvoted 0 times

...

Annice

7 months ago

Definitely surprised to see Samhain listed here!

upvoted 0 times

...

Ashlyn

7 months ago

SARA could work, but it's not as popular as the others.

upvoted 0 times

...

Teri

7 months ago

I think Tripwire is more for file integrity, not IDS.

upvoted 0 times

...

Iraida

7 months ago

Snort is a solid choice for IDS!

upvoted 0 times

...

Chu

8 months ago

I feel like SARA is more of a vulnerability assessment tool, so I'm leaning towards Snort and Samhain for this question.

upvoted 0 times

...

Quentin

8 months ago

I practiced a similar question before, and I believe both Snort and Tripwire were mentioned as effective tools.

upvoted 0 times

...

Ramonita

8 months ago

I think Samhain is definitely an option for an IDS, but I can't recall if Tripwire fits into that category too.

upvoted 0 times

...

Brandon

8 months ago

I remember studying Snort as a popular IDS tool, but I'm not sure if SARA is also used for that purpose.

upvoted 0 times

...

Mila

8 months ago

I'm pretty sure the Dependency Model Builder is the feature used to build relationships between Entity Classes in the Classic UI. I remember learning about that in class.

upvoted 0 times

...

Stefany

8 months ago

Hmm, I'm a bit unsure about this one. The environment details seem pretty basic, but I'm not totally familiar with Citrix's recommended practices. Might need to do some quick research to make sure I'm on the right track.

upvoted 0 times

...

Chauncey

8 months ago

Ah, I've seen this type of question before. The key is to focus on the specific wording of the commands. "splunk clear kvstore" sounds like the most direct way to clear the KV store, so I'll go with that.

upvoted 0 times

...

Mayra

8 months ago

Hmm, this is a tricky one. I'm not entirely sure which transformational flow process is the correct answer. I'll need to think this through carefully and review my notes before making a decision.

upvoted 0 times

...