GCIH practice questions 181–190

1. Question 181 · 213 in bank

   How does the use of endpoint application allow lists impact malware attacks against the system?

   • AAn attacker must encrypt their attack tools
   • BAn attacker must obfuscate their code and scripts
   • CAn attacker must generate new code hashes
   • DAn attacker must modify their attack tool use

   Show answer

   Answer: B

   Next question

2. Question 182 · 213 in bank

   What shortcoming of the traditional PICERL incident response model is addressed by adopting a dynamic incident response model like DAIR?

   • ALinear approach imparts the success of response activities
   • BInability to enforce written policies and procedures during an investigation
   • CNo differentiation between short and longterm containment tactics
   • DSteps are continually revisited in a loop with no clear endpoint

   Show answer

   Answer: D

   Next question

3. Question 183 · 213 in bank

   Which of the following SSH commands will start a SOCKS proxy server on the local system?

   • Assh -D 2000 [email protected]
   • Bssh -R 9762:localhost:3576 [email protected]
   • Cssh -L 0.0.0.0:7324:10.10.10.200:80 [email protected]
   • Dssh -L 8895:10.10.10.200:80 [email protected]

   Show answer

   Answer: D

   Next question

4. Question 184 · 213 in bank

   A web application receives the following input from a malicious request. What is the attacker attempting to do? select accountbalance from user where name = jake' OR 'z'='z';

   • ADownload database records for a specific application user
   • BCombine two input requests into a single query
   • CObtain database records for every application user
   • DAdd a new user account to the application database

   Show answer

   Answer: C

   Next question

5. Question 185 · 213 in bank

   After running the command shown below, which output field contains the user’s cleartext account name? aws sts get-caller-identity

   • AUserId
   • BArn
   • CAccount
   • DUserName

   Show answer

   Answer: C

   Next question

6. Question 186 · 213 in bank

   What action is being performed in the following session?

   

   • AGathering Active Directory hashes
   • BEscalating privileges
   • CCreating a rescue boot disc
   • DDumping information from the LSASS.EXE process

   Show answer

   Answer: A

   Next question

7. Question 187 · 213 in bank

   What goal would an attacker achieve with the following Set of commands?

   

   • APoison DNS cache
   • BSpoof an IP address
   • CFind possible targets
   • DPromiscuously collect packets

   Show answer

   Answer: A

   Next question

8. Question 188 · 213 in bank

   Which of the following is shown in the screenshot?

   

   • ADAIR scoping response
   • BATT&CK discovery techniques
   • COSINT data collection
   • DRITA anomaly analysis

   Show answer

   Answer: D

   Next question

9. Question 189 · 213 in bank

   What does the term any instruct tcpdump to capture in the following command? tcpdump -A -i any 'port 21 && host 192.168.100.1'

   • ANetwork Interface
   • BIP address
   • CPort
   • DProtocol

   Show answer

   Answer: A

   Next question

10. Question 190 · 213 in bank

    

    A Windows workstation was clean a few days ago but now appears to be infected. Based on results from tasklist, which was run last week, which connection or connections shown in netstat -naob, run today, most likely indicates the host is now infected?

    • AThe connection with winevtd.exe
    • BThe connection with wmpnetwk.exe
    • CThe connections with lsass.exe
    • DThe connections with svchost.exe

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 181. 213 questions available.