GCIH practice questions 111–120

1. Question 111 · 213 in bank

   What is the definition of an event as it applies to incident handling?

   • AAny observable occurrence in a system and/or network
   • BThe introduction of malicious code into your network
   • CSomething that triggers an alert from your Intrusion Detection System
   • DAn adverse occurrence in an information system and/or network or the threat of such an occurrence

   Show answer

   Answer: A

   Next question

2. Question 112 · 213 in bank

   What hash type is being cracked in the command below? hashcat -m 1000 -a 0 customer.ntds wordlist.txt --potfile-path ./hashcat.potfile

   • ASHA-1
   • BLANMAN
   • CKerberos 5
   • DNT hashes

   Show answer

   Answer: A

   Next question

3. Question 113 · 213 in bank

   Which of the following occurs when a penetration tester attempts to connect to a host with the following command? net use \\192.168.44.213

   • AGuest user account permissions will be granted
   • BLocal logon credentials will be sent to 192.168.44.213
   • CIPC$ share returns a list of running processes
   • DHost at 192.168.44.213 will exchange a temporary authentication key

   Show answer

   Answer: C

   Next question

4. Question 114 · 213 in bank

   A security auditor is using John the Ripper to review password strength on Windows machines. The auditor knows that the company requires a 15-character minimum in their passwords. In this scenario, what format parameter must be passed to John (with Jumbo Patch) to crack the passwords?

   • A--format=LANMAN
   • B--format=UNIX
   • C--format=NT
   • D--format=SHA256

   Show answer

   Answer: D

   Next question

5. Question 115 · 213 in bank

   Which of the following is the most effective technique for identifying live client systems on a LAN?

   • AICMP Echo Requests
   • BTCP FIN scanning
   • CTraceroute
   • DDNS Zone Transfer

   Show answer

   Answer: C

   Next question

6. Question 116 · 213 in bank

   Which of the following squid proxy log fields is easiest for an attacker to spoof?

   • AHTTP method
   • BSession duration
   • CTimestamp
   • DUser agent

   Show answer

   Answer: A

   Next question

7. Question 117 · 213 in bank

   A responder runs the two commands below looking for the number of lines that contain the word powershell. Which of the following is a reason why the output is different between the two plugins?

   

   • AThe pslist plugin has deduplicated the results
   • BThe psscan plugin searched further back in time for the image
   • CThe pslist plugin identifies the first instance of an executable
   • DThe psscan plugin has identified hidden processes

   Show answer

   Answer: C

   Next question

8. Question 118 · 213 in bank

   An attacker has tricked a user into executing content he placed on a social networking site. The malicious content executes in the victim's browser and allows the attacker to determine if machines behind the user's firewall are up and running. What type of attack is this?

   • ACross Site Scripting
   • BSQL Injection
   • CAccount Harvesting
   • DSession Hijacking

   Show answer

   Answer: D

   Next question

9. Question 119 · 213 in bank

   Following the recent acquisition of a new business, your manager asks you to investigate their DNS service and report back on its status. He is concerned as they only have one DNS server in the organization and it is visible on the Internet. What actions and recommendations should be taken as a first step?

   • AReview the logs of the acquired business' firewall for port 53 traffic. Add a firewall rule to block port 53 traffic.
   • BEnsure zone transfer requests from the acquired business' DNS server are disabled. Propose a plan to migrate the DNS service to your split-DNS infrastructure.
   • CUse the nslookup command to direct the aquired business' DNS server to transfer its records to your primary DNS server. Block all other traffic at the firewall.
   • DRemove the acquired business' DNS server from the network. Import its database entries into your secure infrastructure.

   Show answer

   Answer: A

   Next question

10. Question 120 · 213 in bank

    A system administrator finds the entry below in an Apache log. What can be done to mitigate against this? 192.168.116.201 - - [22/Apr/2016:13:43:26 -0400] `GET http://www.giac.org%2Farticles.php%3Fid%3D3+and+%28select+1+from +mysql.user+limit+0%2C1%29%3D1 HTTP/1.1` 200 453 `-` `Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0`

    • AFilter user input using Javascript on the client browser
    • BReduce the permissions of the user account running the web application
    • CFilter user input before it gets passed to the application
    • DCreate drop-downs for users to choose their search terms

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 111. 213 questions available.