GCIA GCIA Firewall and Log Analysis

Question 1

What does a firewall 'implicit deny' rule do?

Accepted Answer

Denies all traffic not explicitly allowed

Answer

An implicit deny rule blocks all traffic that does not match any explicit allow rule, implementing a default-deny security posture.

Question 2

Which type of firewall performs deep packet inspection at the application layer?

Accepted Answer

Next-Generation Firewall (NGFW)

Answer

Next-Generation Firewalls perform deep packet inspection at the application layer, identifying applications regardless of port or protocol used.

Question 3

In a firewall log, what does a 'DENY' action entry indicate?

Accepted Answer

Traffic was blocked by a matching rule

Answer

A DENY action in firewall logs indicates that a packet was blocked because it matched a deny rule or fell through to the implicit deny policy.

Question 4

What does a high volume of DENY log entries from a single source IP most likely suggest?

Accepted Answer

A potential port scan or attack attempt

Answer

Multiple denied connections from a single source IP often indicate port scanning, brute force attempts, or other malicious reconnaissance activity.

Question 5

Which log field is most useful for correlating events across multiple security systems during an incident?

Accepted Answer

Timestamp

Answer

Timestamps allow analysts to correlate events across different systems and establish the correct sequence of events during an incident investigation.

(GCIA) GIAC Certified Intrusion Analyst Practice Test