GCIH practice questions 121–130

1. Question 121 · 213 in bank

   What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> lsaenumsid

   • AResolving SIDs to usernames on the target server
   • BDisplaying the rights associated with a SID on the target server
   • CListing the privileges associated with a SID defined locally on the target server
   • DEnumerating the SIDs of all users defined locally on the target server

   Show answer

   Answer: C

   Next question

2. Question 122 · 213 in bank

   When probing for command injection opportunities on a remote host, why would an attacker target her own address space from the remote host?

   • ACollection of URL session tokens
   • BLegal requirement
   • CVerification of a blind attack
   • DDetect target's operating system

   Show answer

   Answer: D

   Next question

3. Question 123 · 213 in bank

   An administrator needs to protect his organization's IIS webservers from Cross-Site Scripting attacks. Which action should he take?

   • AUse the Anti-XSS library from Microsoft
   • BConfigure two-factor authentication for clients
   • CUse a random element when setting session cookies
   • DConfigure application whitelisting on the IIS server

   Show answer

   Answer: A

   Next question

4. Question 124 · 213 in bank

   What information is commonly found in both the header and the possession log of a Chain of Custody?

   • ADate and time the evidence was requested by the court
   • BDate and time the evidence was checked into evidence locker
   • CDate and time the evidence was initially collected
   • DDate and time the evidence is classified as reliable

   Show answer

   Answer: B

   Next question

5. Question 125 · 213 in bank

   Which of the following Metasploit module types would contain privilege escalation capabilities?

   • AAuxiliary
   • BExploit
   • CPost
   • DPayload

   Show answer

   Answer: D

   Next question

6. Question 126 · 213 in bank

   Which of the following describes a suspicious event in the service data below? root@kali:~/volatility# ./vol.py -f ../mem/Desk005.vmem svcscan

   

   • AGREEN: Executables should not be run from temporary folders
   • BBLUE: Service names should be all capital letters
   • CPURPLE: Services should not be in the STOPPED state
   • DYELLOW: Option -k should be followed by -p for svchost

   Show answer

   Answer: D

   Next question

7. Question 127 · 213 in bank

   Which file contains information about failed login attempts on a Unix system?

   • Actmp
   • Bwtmp
   • Cbtmp
   • Dutmp

   Show answer

   Answer: C

   Next question

8. Question 128 · 213 in bank

   What is one of the simplest AND most common ways for an attacker to camouflage files on a UNIX system?

   • AUse S-Tools to embed the files into a graphic image
   • BRun "chmod 600" on the files to be hidden
   • CUse a dot-space or dot-dot-space as the file or directory name
   • DInsert the data into an alternate data stream using the colon (:)
   • EInstall a kernel-level rootkit

   Show answer

   Answer: C

   Next question

9. Question 129 · 213 in bank

   Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters? tcpdump -nn -r pingout.pcap `˜icmp and (dst host 8.8.8.8)'

   • A09:31:00.928389 IP 192.168.1.14.63263 > 8.8.8.8.33595: UDP, length 24
   • B08:54:07.451392 IP 8.8.8.8 > 192.168.1.14: ICMP echo reply, id 36234, seq 3, length 64
   • C09:06:09.085200 IP 192.168.1.14.49655 > 8.8.8.8.22: Flags [S], seq 2144394082, win 65535, options [mss 1460,sackOK,eol], length 0
   • D08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64

   Show answer

   Answer: A

   Next question

10. Question 130 · 213 in bank

    During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password is not "pass1", and "root" is not a valid username, what can you infer solely from these logs?

    

    • AThis is a web spidering attack using wget
    • BThis is an account harvesting attack
    • CThis is a session hijacking attack
    • DThis is a password brute-forcing attack

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 121. 213 questions available.