GIAC GCFW 考試概覽:

認證廠商:	GIAC (Global Information Assurance Certification)
考試名稱:	GIAC 認證防火牆分析師（GCFW）
考試代碼:	GCFW
證照有效期限:	4 年
考試形式:	選擇題, 情境題, 開放式參考
實際考試題數:	80-100
相關認證:	GIAC Certified Perimeter Protection Analyst (GPPA) GIAC Certified Intrusion Analyst (GCIA) GIAC Security Essentials (GSEC)
考試時間:	180 分鐘
考試費用:	$999 USD
及格分數:	72%
支援語言:	English
推薦課程:	SANS SEC522：防禦性邊界設計與防火牆管理
考試報名:	Pearson VUE 考試預約 GIAC 官方報名
範例考題:	GIAC GCFW 範例考題
考試方式:	線上監考測驗：可透過 ProctorU 遠端應考，或至 Pearson VUE 考場實體應考
必備條件:	無強制報名資格；建議具備網路安全相關經驗或完成 SANS SEC522 訓練
官方大綱網址:	https://www.giac.org/certifications/certified-firewall-analyst-gcfw

GIAC GCFW 考試大綱主題:

章節	權重	目標
主題 1: 紀錄、監控與問題排除	15%	- 紀錄分析與流量模式檢視 - 連線與原則問題排除 - 警示設定與事件偵測
主題 2: 存取控制與規則管理	25%	- 使用者與應用程式控制原則 - 規則建立、排序與最佳化 - NAT、PAT 與位址轉換
主題 3: 防火牆技術與檢查機制	20%	- 狀態式與無狀態式過濾之比較 - Deep packet inspection (DPI) - Next-Generation Firewall (NGFW) 功能
主題 4: 防火牆架構與部署	25%	- DMZ 架構與實作 - 網路區域與縱深防禦 - 防火牆類型與設計原則
主題 5: 安全強化與法規遵循	15%	- 法規遵循與稽核要求 - 原則生命週期管理 - 防火牆系統安全強化

最新的 GIAC Information Security GCFW 免費考試真題：

問題 #1

Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter?

A. Stateless packet filter firewall
B. PIX firewall
C. Stateful packet filter firewall
D. Virtual firewall

問題 #2

You are the Administrator for a corporate network. You are concerned about denial of service attacks.
Which of the following would be most helpful against Denial of Service (DOS) attacks?

A. Packet filtering firewall
B. Network surveys.
C. Stateful Packet Inspection (SPI) firewall
D. Honey pot

問題 #3

You work as a Network Administrator for TechPerfect Inc. The company has a corporate intranet setup.
A router is configured on your network to connect outside hosts to the internetworking. For security, you want to prevent outside hosts from pinging to the hosts on the internetwork. Which of the following steps will you take to accomplish the task?

A. Block the IPv6 protocol through ACL.
B. Block the UDP protocol through ACL.
C. Block the ICMP protocol through ACL.
D. Block the TCP protocol through ACL.

問題 #4

Peter works as a Technical Representative in a CSIRT for SecureEnet Inc. His team is called to investigate the computer of an employee, who is suspected for classified data theft. Suspect's computer runs on Windows operating system. Peter wants to collect data and evidences for further analysis. He knows that in Windows operating system, the data is searched in pre-defined steps for proper and efficient analysis. Which of the following is the correct order for searching data on a Windows based system?

A. Volatile data, file slack, internet traces, registry, memory dumps, system state backup, file system
B. Volatile data, file slack, file system, registry, memory dumps, system state backup, interne t traces
C. Volatile data, file slack, registry, system state backup, internet traces, file system, memory dumps
D. Volatile data, file slack, registry, memory dumps, file system, system state backup, interne t traces

問題 #5

Which of the following are open-source vulnerability scanners?

A. Hackbot
B. Nikto
C. NetRecon
D. Nessus

問題與答案：

問題 #1
答案： C

問題 #2
答案： C

問題 #3
答案： C

問題 #4
答案： B

問題 #5
答案： A,B,D