GCIH practice questions 171–180

1. Question 171 · 213 in bank

   The following output shows reconnaissance activity against which platform?

   

   • ADocker
   • BGCP
   • CAWS
   • DAzure

   Show answer

   Answer: D

   Next question

2. Question 172 · 213 in bank

   A security examiner has been given permission by senior management to conduct a password audit. What should the examiner ensure after the process completes?

   • APot files are removed from cracking systems
   • BAcceptability rules are defined following the audit
   • CUsers can change passwords at their discretion
   • DCracked passwords are stored on a single system

   Show answer

   Answer: D

   Next question

3. Question 173 · 213 in bank

   What is downloaded when the following command is executed? $ bucket_finder.rb words --download

   • ANames of S3 buckets found in the wordlist
   • BPermission settings for identified S3 buckets
   • CContent from publicly accessible S3 buckets
   • DList of publicly accessible S3 buckets

   Show answer

   Answer: D

   Next question

4. Question 174 · 213 in bank

   Which Windows process would an attacker target to steal credentials from a user who logs into applications with a Password Manager?

   • AClipboard
   • BREGSVC
   • CExplorer
   • DLSASS

   Show answer

   Answer: D

   Next question

5. Question 175 · 213 in bank

   What is the first decision point of an incident investigation?

   • ACriticality
   • BPreparation
   • CVerification
   • DDetection

   Show answer

   Answer: D

   Next question

6. Question 176 · 213 in bank

   While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which investigative technique does this describe?

   • APivoting
   • BEnumeration
   • CAttribution
   • DTriaging

   Show answer

   Answer: D

   Next question

7. Question 177 · 213 in bank

   Which activity helps readdress security tasks identified in past incident reports?

   • AAfter Action Report
   • BRoot cause analysis
   • CFollow-up review meetings
   • DContainment and eradication

   Show answer

   Answer: B

   Next question

8. Question 178 · 213 in bank

   What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> enumdomusers

   • AResolving SIDs to usernames on the target server
   • BDisplaying the rights associated with a SID on the target server
   • CFinding locally defined users on the target server
   • DEnumerating the SIDs of all users defined locally on the target server

   Show answer

   Answer: C

   Next question

9. Question 179 · 213 in bank

   Which of the following can the rpcclient application do?

   • AConnect with Windows hosts using RDP
   • BInteract with Windows hosts using SMB
   • CCollect password hashes from a Windows server
   • DEnumerate web pages on an IIS server

   Show answer

   Answer: B

   Next question

10. Question 180 · 213 in bank

    What task is a Windows administrator performing with the command below, executed from a file server with an IP address of 46.95.101.82? C:\> net session \\46.95.101.109 /del

    • ARemove the share being offered from 46.95.101.82
    • BDisconnect the SMB session from host 46.95.101.82
    • CDelete the SMB share being offered from 46.95.101.109
    • DDisconnect the SMB session from host 46.95.101.109

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 171. 213 questions available.