Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
GIAC Exam GSNA Topic 2 Question 21 Discussion
Actual exam question for
GIAC's
GSNA exam
Question #: 21
Topic #: 2
[All GSNA Questions]
Topic #: 2
You are concerned about rootkits on your network communicating with attackers outside your network. Without using an IDS how can you detect this sort of activity?
Suggested Answer:
D
Firewall logs will show all incoming and outgoing traffic. By examining those logs you can detect anomalous traffic, which can indicate the presence of malicious code such as rootkits.
Answer B is incorrect. While an IDS might be the most obvious solution in this scenario, it is not the only one.
Answer C is incorrect. It is very unlikely that anything in your domain controller logs will show the presence of a rootkit, unless that
rootkit is on the domain controller itself.
Answer A is incorrect. A DMZ is an excellent firewall configuration but will not aid in detecting rootkits.
Currently there are no comments in this discussion, be the first to comment!