[NEW] GIAC Certified Enterprise Defender (GCED)

Defensive Infrastructure and Tactics (15%): Implementing network and cloud defenses, managing IDS/logging (detective), and firewalls/segmentation (preventive),

Digital Forensics (10%): Identifying artifacts, maintaining chain of custody, and following evidence preservation procedures,

Incident Response (10%): Mastering the continuous IR process, free advanced techniques in threat intelligence reporting course integration, and the Cyber Kill Chain mapping,

Malware Analysis (20% combined): Covering everything from static/automated analysis to manual code reversal, disassembly, and de-obfuscation techniques,

Intrusion Detection and Packet Analysis (10%): IPS tuning, packet capture techniques, alert triage, and custom signature development,

Network Forensics and Logging (10%): SIEM deployment, log normalization, and flow analysis for deep forensic investigations,

Network Security Monitoring (5%): SOC sensor placement and strategies for monitoring encrypted traffic,

learn the real power of penetration testing unveiled (10% combined): Understanding scoping/rules of engagement and applying frameworks to attack typical enterprise targets for defensive validation,

B. A "nmap" scan utilizing crafted, non-standard flag combinations to bypass simple filters.

C. A routine DNS zone transfer.

D. An encrypted HTTPS handshake.

E. A hardware failure in the local network switch.

F. An automated Windows Update background process.

Correct Answer: B

Explanation:

A (Incorrect): A graceful teardown uses FIN and ACK, not SYN.

C (Incorrect): DNS zone transfers typically use standard TCP 53 connections without malformed flags.

D (Incorrect): HTTPS handshakes follow standard TCP three-way handshake procedures.

E & F (Incorrect): These would not specifically result in consistent SYN/FIN flag settings.

Question 2: In the context of Digital Forensics, why is "Chain of Custody" considered a critical requirement during evidence collection?

B. To ensure the hardware is recycled properly after the investigation.

C. To provide a chronological, documented record of who handled the evidence to ensure its integrity in legal proceedings.

D. To identify the specific IP address of the attacker.

E. To automate the creation of SIEM correlation rules.

F. To decrease the time spent on packet capture.

Correct Answer: C

Explanation:

A & D (Incorrect): Chain of custody is a procedural/legal requirement, not a technical analysis speed-up or attribution tool.

B, E, & F (Incorrect): These are unrelated to the legal integrity of forensic artifacts.

Question 3: When performing manual malware analysis, which technique is most effective for bypassing code obfuscation like "packing"?

B. Using a debugger to run the malware until it reaches the Original Entry Point (OEP) and then dumping the process memory.

C. Renaming the file extension from .exe to .txt.

D. Calculating the MD5 hash of the file.

E. Checking the file's digital signature.

F. Viewing the file in a hex editor without executing it.

Correct Answer: B

Explanation:

A (Incorrect): Strings analysis usually fails on packed files as the text is encrypted/compressed.

C (Incorrect): Renaming a file does not change its internal code structure or obfuscation.

D, E, & F (Incorrect): These are static methods that provide metadata but do not bypass the obfuscation layer to reveal hidden logic.

You can retake the exams as many times as you want,

This is a huge original question bank,

You get support from instructors if you have questions,

Each question has a detailed explanation,

Mobile-compatible with the Udemy app,

30-days money-back guarantee if you're not satisfied,