GCIH practice questions 61–70

1. Question 61 · 213 in bank

   When containing an incident, who makes the final decision on whether a box should be taken offline?

   • AIT auditor
   • BLaw enforcement
   • CIncident handler
   • DManagement
   • ESecurity department

   Show answer

   Answer: E

   Next question

2. Question 62 · 213 in bank

   Suppose a web application builds the SQL command "select PhoneNumber from contacts where Company = '[value]';". What would the result likely be if an attacker submitted the value "GIAC'; drop table contacts; --" to the database?

   • ANothing. The 'contacts;--' portion is syntactically incorrect.
   • BThe database would attempt to drop the PhoneNumber from the 'GIAC' table.
   • CThe 'contacts' table would be deleted from the database.
   • DThe database would drop all records containing 'GIAC' from the 'contacts' table.

   Show answer

   Answer: B

   Next question

3. Question 63 · 213 in bank

   What is one of the functions CyberCPR performs?

   • AIt can act as a NIDS when traffic is routed through it
   • BAll uploaded files are hashed
   • CCyperCPR can act as an secure email server
   • DIt can act as a HIDS on the system it is installed on

   Show answer

   Answer: A

   Next question

4. Question 64 · 213 in bank

   Analyze the nmap results shown. What is the first step the security administrator should take?

   

   • AClose one port on host to improve the accuracy of the scan
   • BDetermine what services are running on ports greater than 1024
   • CEnsure encryption is being used on all 3306/tcp traffic
   • DBlock outgoing packets for ports greater than 1024

   Show answer

   Answer: C

   Next question

5. Question 65 · 213 in bank

   If an accounting department's computer system was compromised, who should make the decision about when that system is put back into production?

   • ALead incident handler, after recovery is complete
   • BHead of Information Systems or CIO
   • CSystem owner for that system
   • DSystem administrator for that system

   Show answer

   Answer: A

   Next question

6. Question 66 · 213 in bank

   Failing DNS, what will modern Windows systems use to resolve names of other systems?

   • ALocal Host File
   • BLLMNR
   • CNBT-NS
   • DWINS

   Show answer

   Answer: B

   Next question

7. Question 67 · 213 in bank

   The incident response team has been working with the various systems teams to find a way to gain root access to systems in event of an incident. It has been proposed that the system teams keep copies of all system passwords and crypto keys in sealed envelopes in a safe in the IT director's office. The envelopes are kept updated by the systems teams and access to the envelopes is logged by the IT director. However, the VMware system team is concerned about unqualified handlers having root access to the VMware host servers. What additional qualifier would make this agreement more agreeable to the VMware system team?

   • AAgree that only handlers with VMware experience will access the system
   • BCreate a password reset disk to be used in case of an incident
   • CHave one member of the incident response team know the password
   • DCall VMware system team for incidents involving their systems to gain access

   Show answer

   Answer: B

   Next question

8. Question 68 · 213 in bank

   What can you do to proactively protect against DLL injection on your organization's Exchange server?

   • ATake away Full Control over important files from the Everyone group and monitor changes to important registry keys
   • BScript a comparison of the Is and echo commands and take cryptographic checksums of important files
   • CLimit Debug rights and take cryptographic checksums of important files
   • DLimit Debug rights to the Administrators' group and monitor changes to files in Event Viewer

   Show answer

   Answer: A

   Next question

9. Question 69 · 213 in bank

   If an attacker is attempting to use the Kaminsky method of DNS cache poisoning, what is the maximum number of unique Query IDs which must be presented to the victim DNS server before a match is made?

   • A32,768
   • B4096
   • C65,536
   • D1024

   Show answer

   Answer: D

   Next question

10. Question 70 · 213 in bank

    You are responding to an incident in which the organization's Extranet server has been compromised. The Extranet is the browser home page for most users in the organization. You have been instructed to watch the attacker, but minimize the business impact and the risk of further compromise. How can you continue providing services to the organization's users while isolating the compromised server?

    • APoint the domain name to the IP address of a secondary, patched production server
    • BChange the server IP address to a different IP address
    • CIsolate the switch port and put the system on a quarantined VLAN
    • DRebuild the system during a downtime window and restore the service

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 61. 213 questions available.