GCIH practice questions 101–110

1. Question 101 · 213 in bank

   Which of the following commands will identify hidden file streams within the C:\Documents folder?

   • A> c:\tools\lads\lads /S c:\Documents
   • B> eventvwr c:\Documents.
   • C> type c:\Documents | more
   • D> more /r c:\Documents

   Show answer

   Answer: D

   Next question

2. Question 102 · 213 in bank

   Observe the following command; what is the analyst doing?

   

   • AConnecting to an SMB share on 192.168.230.138
   • BListing active network connections to 192.168.230.138
   • CDetermining what services are running on 192.168.230.138
   • DAcquiring a memory image from 192.168.230.138

   Show answer

   Answer: B

   Next question

3. Question 103 · 213 in bank

   What happened in the following screenshot?

   

   • AThe user does not have permissions to access btmp
   • BThere was a overflow condition
   • CThe btmp logs are not stored in ASCII
   • DAn attacker corrupted the file to cover their tracks

   Show answer

   Answer: A

   Next question

4. Question 104 · 213 in bank

   When would a web-based reconnaissance tool be preferred over a direct/local reconnaissance tool?

   • AWhen more comprehensive TCP port scanning is required than what is offered by local tools
   • BIn the event that the target is running third-party web applications
   • CWhen the target's employees are using a VPN to connect to the central office
   • DTo keep traffic from the attacker's system from hitting the target network

   Show answer

   Answer: C

   Next question

5. Question 105 · 213 in bank

   Which of the following network applications is better suited for using a connection-oriented protocol than a stateless protocol?

   • AVideo streaming
   • BVoice transmissions
   • CWindows Server Message Block
   • DDomain Name Service queries

   Show answer

   Answer: D

   Next question

6. Question 106 · 213 in bank

   Nathan is examining the security event log on a file server that contains sensitive data. He finds a number of Event ID 1234s with substatus code 0xC000006A. There are 4 or less failures against any individual account. Which type of password attack is indicated by these events?

   • ARainbow Tables
   • BSpraying
   • CBrute Force
   • DPassing the Hash

   Show answer

   Answer: C

   Next question

7. Question 107 · 213 in bank

   Which of the following statements describes the data below from volatility's pstree plugin?

   

   • ACmd.exe was the child process of OneDrive.exe
   • BChrmstp.exe was launched by MSASCuiL.exe
   • CExplorer.exe was the parent process for firefox.exe
   • DNotepad.exe was launched with Administrative privileges

   Show answer

   Answer: C

   Next question

8. Question 108 · 213 in bank

   Which of the following Metasploit tools will generate a payload that can be introduced to a Windows system as shown in the image?

   

   • AMsfvenom
   • BMsfd
   • CMsfrpc
   • DMsfconsole

   Show answer

   Answer: D

   Next question

9. Question 109 · 213 in bank

   Which UNIX log file contains information about currently logged in users?

   • Awtmp
   • Bbtmp
   • Cutmp
   • Dlastlog

   Show answer

   Answer: A

   Next question

10. Question 110 · 213 in bank

    Which volatility plugin shows the command line path for a recently launched application?

    • Ahivelist
    • Bdlllist
    • Cpslist
    • Dnetscan

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 101. 213 questions available.