GCIH practice questions 1–10

1. Question 1 · 213 in bank

   Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team. As a demo project he asked members of the incident response team to perform the following actions: ✑ Remove the network cable wires. ✑ Isolate the system on a separate VLAN ✑ Use a firewall or access lists to prevent communication into or out of the system. ✑ Change DNS entries to direct traffic away from compromised system Which of the following steps of the incident handling process includes the above actions?

   • AIdentification
   • BContainment
   • CEradication
   • DRecovery

   Show answer

   Answer: B

   Next question

2. Question 2 · 213 in bank

   Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti- spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd. Which of the following is the mostly likely the cause of the problem?

   • AComputer is infected with the stealth kernel level rootkit.
   • BComputer is infected with stealth virus.
   • CComputer is infected with the Stealth Trojan Virus.
   • DComputer is infected with the Self-Replication Worm.

   Show answer

   Answer: A

   Next question

3. Question 3 · 213 in bank

   Which of the following types of attacks is only intended to make a computer resource unavailable to its users?

   • ADenial of Service attack
   • BReplay attack
   • CTeardrop attack
   • DLand attack

   Show answer

   Answer: A

   Next question

4. Question 4 · 213 in bank

   Which of the following types of attack can guess a hashed password?

   • ABrute force attack
   • BEvasion attack
   • CDenial of Service attack
   • DTeardrop attack

   Show answer

   Answer: A

   Next question

5. Question 5 · 213 in bank

   Which of the following is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems, and fax machines?

   • ADemon dialing
   • BWarkitting
   • CWar driving
   • DWardialing

   Show answer

   Answer: D

   Next question

6. Question 6 · 213 in bank

   Network mapping provides a security testing team with a blueprint of the organization. Which of the following steps is NOT a part of manual network mapping?

   • AGathering private and public IP addresses
   • BCollecting employees information
   • CBanner grabbing
   • DPerforming Neotracerouting

   Show answer

   Answer: B

   Next question

7. Question 7 · 213 in bank

   Select 3

   Which of the following statements are true about tcp wrappers? Each correct answer represents a complete solution. (Choose all that apply.)

   • Atcp wrapper provides access control, host address spoofing, client username lookups, etc.
   • BWhen a user uses a TCP wrapper, the inetd daemon runs the wrapper program tcpd instead of running the server program directly.
   • Ctcp wrapper allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens to filter for access control purposes.
   • Dtcp wrapper protects a Linux server from IP address spoofing.

   Show answer

   Answer: ABC

   Next question

8. Question 8 · 213 in bank

   John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He finds that the We-are- secure server is vulnerable to attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing capability from the server. He is suggesting this as a countermeasure against __________.

   • AIIS buffer overflow
   • BNetBIOS NULL session
   • CSNMP enumeration
   • DDNS zone transfer

   Show answer

   Answer: A

   Next question

9. Question 9 · 213 in bank

   Which of the following applications is an example of a data-sending Trojan?

   • ASubSeven
   • BSenna Spy Generator
   • CFirekiller 2000
   • DeBlaster

   Show answer

   Answer: D

   Next question

10. Question 10 · 213 in bank

    Select 3

    Which of the following are the primary goals of the incident handling team? Each correct answer represents a complete solution. (Choose all that apply.)

    • AFreeze the scene.
    • BRepair any damage caused by an incident.
    • CPrevent any further damage.
    • DInform higher authorities.

    Show answer

    Answer: ABC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 1. 213 questions available.