Free GSNA Exam Dumps

Question 46

- (Topic 1)
Which of the following responsibilities does not come under the audit process?

A. Reporting all facts and circumstances of the irregular and illegal acts.
B. Planning the IT audit engagement based on the assessed level of risk.
C. Reviewing the results of the audit procedures.
D. Applying security policies.

Correct Answer:ABC

According to the standards of ISACA, an auditor should hold the following responsibilities: Planning the IT audit engagement based on an assessed level of risk. Designing audit procedures of irregular and illegal acts. Reviewing the results of the audit procedures. Assuming that acts are not isolated. Determining why the internal control system failed for that act. Conducting additional audit procedures. Evaluating the results of the expanded audit procedures. Reporting all facts and circumstances of the irregular and illegal acts. Distributing the report to the appropriate internal parties, such as managers. Answer D is incorrect. The auditor is not responsible for applying security policies.

Question 47

- (Topic 2)
Which of the following commands can you use to search a string 'pwd' in all text files without opening them? (Choose two)

A. vi
B. grep
C. sed
D. locate

Correct Answer:BC

sed and grep are the two commands that can be used to search a specified string in all text files without opening them. sed is a stream editor that is used to perform basic text transformations on an input stream (a file or input from a pipeline).

Question 48

- (Topic 1)
You work as a Web Deployer for UcTech Inc. You write the element for an application in which you write the sub-element as follows: * Who will have access to the application?

A. Only the administrator
B. No user
C. All users
D. It depends on the application.

Correct Answer:C

The element is a sub-element of the element. It defines the roles that are allowed to access the Web resources specified by the
sub-elements. The element is written in the deployment descriptor as follows: -----------
----- Administrator
Writing Administrator within the element will allow only the administrator to have access to the resource defined within the
element.

Question 49

- (Topic 3)
You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP based switched network. A root bridge has been elected in the switched network. You have installed a new switch with a lower bridge ID than the existing root bridge. What will happen?

A. The new switch starts advertising itself as the root bridge.
B. The new switch divides the network into two broadcast domains.
C. The new switch works as DR or BDR.
D. The new switch blocks all advertisements.

Correct Answer:A

The new switch starts advertising itself as the root bridge. It acts as it is the only bridge on the network. It has a lower Bridge ID than the existing root, so it is elected as the root bridge after the BPDUs converge and when all switches know about the new switch that it is the better choice. Answer B, C, D are incorrect. All these are not valid options, according to the given scenario.

Question 50

- (Topic 3)
Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

A. Command injection attack
B. Code injection attack
C. Cross-Site Scripting attack
D. Cross-Site Request Forgery

Correct Answer:B

A code injection attack exists whenever a scripting or programming language is used in a Web page. All that the attacker needs is an error or opening. That opening usually comes in the form of an input field that is not validated correctly. It is not necessary for the code injection attack to be on the Web page. It can be located in the back end as part of a database query of the Web site. If any part of the server uses Java, JavaScript, C, SQL, or any other code between the Internet and the data, it is vulnerable to the code injection attack.
Answer C is incorrect. A cross site scripting attack is one in which an attacker enters malicious data into a Website. For example, the attacker posts a message that contains malicious code to any newsgroup site. When another user views this message, the browser interprets this code and executes it and, as a result, the attacker is able to take control of the user's system. Cross site scripting attacks require the execution of client-side languages such as JavaScript, Java, VBScript, ActiveX, Flash, etc. within a user's Web environment. With the help of a cross site scripting attack, the attacker can perform cookie stealing, sessions hijacking, etc. Answer A is incorrect. A command injection attack is used to inject and execute commands specified by the attacker in the vulnerable application. The application, which executes unwanted system commands, is like a virtual system shell. The attacker may use it as any authorized system user. However, commands are executed with the same privileges and environment as the application has. The command injection attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker. Answer D is incorrect. Cross-site request forgery, also known as one-click attack or session riding, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser. The attack works by including a link or script in a page that accesses a site to which the user is known to have authenticated.