Free GIAC GSEC Exam Dumps

Log files store errors and warnings generated by a Linux system. In Linux, the SYSLOGD and KLOGD utilities are used for logging errors and debugging messages. Log files help in tracking down these problems. Linux stores the logging configuration in the /etc/syslog.conf file. Log files are stored in the /var/log directory.

Following are some of the important log files:

/var/log/messages: The kernel and system errors are written in this file. Administrators should check this file daily for warning

messages.

/var/log/wtmp: The time and date of user logins are written in this file. Suspicious activities of users can be tracked down through this file.

/var/log/dmesg: The results of the last system boot is written in this file. It stores kernel messages that appear during the boot

stage. This file helps in tracking down the boot time problems.

Answer option B is incorrect. The /root directory represents the root user's home directory.

Answer option D is incorrect. The /etc directory contains administrative configuration files.

Answer option A is incorrect. There is no directory such as /log in Linux.

Keeping . (dot) in a root's path is considered to be a major security concern. A hacker can use this place to keep his own version of well-known and highly used commands, such as LS. When the root user will run that command, the changed program will run with privileges of the root user. This can be one of the greatest security risks. The . (dot) should not be included in the root's path.

According to the scenario, John is a root user. Hence, the value of the environmental variables $USER and $UID will be root and 0, respectively.

Access Control List (ACL) is the most commonly method used to implement a procedure to control inbound and outbound traffic on the network.

It filters traffic packets by controlling whether or not inbound and outbound packets are forwarded or blocked at the router's interfaces.

According to the criteria specified within the access lists, router determines whether the packets are to be forwarded or dropped. Access

control list criteria could be the source or destination address of the traffic or other information.

Answer option A is incorrect. A cookie is a small bit of text that accompanies requests and pages as they move between Web servers and

browsers. It contains information that is read by a Web application, whenever a user visits a site. Cookies are stored in the memory or hard

disk of client computers. A Web site stores information, such as user preferences and settings in a cookie. This information helps in providing

customized services to users. There is absolutely no way a Web server can access any private information about a user or his computer

through cookies, unless a user provides the information. A Web server cannot access cookies created by other Web servers.

Answer option B is incorrect. Sam Spade is a penetration-testing tool that is used in the discovery phase. It provides GUI graphics and a lot of

functionalities. It can perform mainly whois queries, ping requests, DNS requests, tracerouting, OS finger-printing, zone transferring, SMTP mail

relay checking, and Web site crawling and mirroring. Sam Spade runs on Windows operating systems.

Answer option C is incorrect. A Network-based Detection System (NIDS) analyzes data packets flowing through a network. It can detect

malicious packets that are designed to be overlooked by a firewall's simplistic filtering rules. It is responsible for detecting anomalous or

inappropriate data that may be considered 'unauthorized' on a network. An NIDS captures and inspects all data traffic, regardless of whether

or not it is permitted for checking.

The maximum segment length that a 1000BaseT network supports is 100 meters. Type 1000BaseT network uses 5-level encoding and Cat 5 UTP media. It can provide data transmission speeds of up to 1000 megabits per second.

In order to deny access to a user account, an invalid shell such as /bin/false should be assigned for the user account in the /etc/passwd file. When an invalid shell is assigned to a user account, a user cannot use the computer. You can take the following steps to deny access for a user to the computer:

1.Edit the /etc/passwd file and make the appropriate changes.

2.Use the -s switch with the USERMOD command.

3.Use CHSH -s /bin/false <user name> command.

Alternatively, you can use the USERMOD -l <user name> command at the command prompt to lock the user account.

KILL is a command used to terminate a specified process.

Answer options A, C, and D are incorrect. Blowfish, 3DES, and MD5 are encryption technologies used to secure the communication between computers on the network.

Secure Sockets Layer (SSL) is a protocol used to transmit private documents via the Internet. SSL uses a combination of public key and symmetric encryption to provide communication privacy, authentication, and message integrity. Using the SSL protocol, clients and servers can

communicate in a way that prevents eavesdropping and tampering of data on the Internet. Many Web sites use the SSL protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with https: instead of http:. By default, SSL uses port 443 for secured communication.

Answer option C is incorrect. SSL can only secure the communication transport. Processing of credit cards cannot be done by SSL.

The Static IP addressing is the term used for manual assignment of IP addresses to computers and devices.

Answer option C is incorrect. Automatic Private IP Addressing (APIPA) is a Windows feature, which allows household users and small business

users to create a functional single subnet TCP/IP network without manually configuring the TCP/IP protocol or setting up a DHCP server.

Answer option D is incorrect. Dynamic IP addressing is used when IP addresses are assigned to computers and devices automatically by the

DHCP service or APIPA.

Answer option B is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the

IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his

identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the

responses to be misdirected.