GIAC Certified Incident Handler213 questions across 22 pages are complete and free, with no account or card.
213 questions in this bank
Free access · progress saved on this device
The provided screenshot shows output from running the SysInternals "Strings" command against a suspected malware executable. Which of the following strings indicate that the attacker is attempting to gain persistence on the target system?
Answer: D
An attacker needs to relay SMB requests to another system outside of the local subnet using Responder. Which command arguments will achieve this goal?
Answer: D
A spike in Event ID 4625 is found in Windows event logs. Looking at individual accounts across the domain, no more than 5 failed logins are found for any single account. What is a likely explanation for this?
Answer: B
What is the size of the data transferred in the following Squid access log?
Answer: D
Inspecting developer code for functions like system, exec, and popen is recommended to reduce the likelihood of what type of public-facing attack?
Answer: C
Which of the following natively supports SMB encryption?
Answer: A
Which persistence mechanism will evade detection by Sysinternals AutoRuns?
Answer: B
Which attack technique does the enabled setting in the screenshot mitigate?
Answer: A
A security team is actively monitoring windows event IDs 4634, 4688, and 4697. Which persistence mechanism will they detect with this approach?
Answer: C
Which netcat command will listen on port 2222 for connections from a remote system (10.0.0.1)?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
GCIH practice, question 141. 213 questions available.
Version 1.0.0. How we source questions