GCIH practice questions 71–80

1. Question 71 · 213 in bank

   To defend against network mapping, which of the following packets should be denied at the border router?

   • AOutgoing ICMP Port Unreachable messages
   • BOutgoing ICMP Echo Request messages
   • CIncoming ICMP Time Exceeded messages
   • DIncoming ICMP Echo Request messages

   Show answer

   Answer: A

   Next question

2. Question 72 · 213 in bank

   As related to buffer overflows, what is the purpose of the Instruction Pointer?

   • AThe Instruction Pointer tells the CPU where on the hard drive to look for the next instruction for the running program.
   • BThe Instruction Pointer tells the CPU where to find newly allocated memory.
   • CThe Instruction Pointer tells the CPU where in memory to find the next instruction for the running program.
   • DThe Instruction Pointer tells the CPU where in the BIOS to find the boot up sequence.

   Show answer

   Answer: A

   Next question

3. Question 73 · 213 in bank

   Which stage of an attack typically involves little or no direct interaction with the attack target(s)?

   • AReconnaissance
   • BScanning
   • CCovering the Tracks
   • DKeeping Access
   • EDenial of Service

   Show answer

   Answer: C

   Next question

4. Question 74 · 213 in bank

   A client wants a system so that they can monitor connection queues on network equipment for too many half-open connections, as well as look for bandwidth consumption from the same types of connections. What kind of attacks will this type of system defend against?

   • ASmurf attacks
   • BPassive scans
   • CCPUHog attacks
   • DSYN Floods

   Show answer

   Answer: C

   Next question

5. Question 75 · 213 in bank

   If virtual machines are relatively easy for an attacker to detect, the next best thing might be to put so much honey in your honeypot, attackers won't be able to resist. Which actions would result in the most meaningful traffic on your honeypot?

   • AInstall the latest OS and patches, use interesting usernames and easy to guess passwords, don't set a limit on failed login attempts, and don't log anything
   • BSet file and folder permissions so everyone has full access, allow full directory browsing on the web site, and don't remove the cgi-bin directory or any of its contents
   • CGive the server a tempting name, create directories and files with appealing names, and create user accounts that resemble a production environment
   • DInstall only older versions of software, remove the ג€Block Allג€ setting on the firewall, and falsify the reported BIOS version information so it looks like a much earlier version

   Show answer

   Answer: D

   Next question

6. Question 76 · 213 in bank

   Which reconnaissance source would you expect to provide the information in the below screen capture?

   

   • Awhois record
   • Bthe Wayback Machine
   • Cnslookup
   • Dtraceroute

   Show answer

   Answer: B

   Next question

7. Question 77 · 213 in bank

   A new helpdesk employee at a multinational corporation took it upon himself to test the security of the servers that holds highly confidential information regarding specific government projects. Which of the following is a well-known technique for deterring such individuals?

   • AWarning banners stating unauthorized access is forbidden.
   • BSecured and controlled access to the server room.
   • CA mantrap with a manned guard deters unauthorized access.
   • DReview the Acceptable use Internet policy before access.

   Show answer

   Answer: B

   Next question

8. Question 78 · 213 in bank

   You are a member of your organization's security team. A new ticket just came into your service desk and was escalated to you. One of the system administrators noticed the following entry in a Windows Server 2008 R2 file server Security event log: Log Name: Security - Source: Microsoft-Windows-Security-Auditing Date: 2/1/2012 2:24:07 AM - Event ID: 4674 - Task Category: Sensitive Privilege Use Level: Information - Keywords: Audit Failure - User: N/A - Computer: somehost.somecompany.com Description: An operation was attempted on a privileged object. Subject: Security ID: LOCAL SERVICE - Account Name: LOCAL SERVICE - Account Domain: NT AUTHORITY - Logon ID: 0x3e5 - Object: Object Server: LSA - Object Type: - Object Name: - Object Handle: 0x0 - Process Information: Process ID: 0x1d8 - Process Name: C:\Windows\System32\Isass.exe Requested Operation: Desired Access: 16777216 - Privileges: SeSecurityPrivilege - What is your next step?

   • AInitiate the ג€Containmentג€ phase of the Incident Handling process
   • BSearch Microsoft's TechNet to find out if this is a normal Windows Security event
   • CDisable the trusted account status of the Local Service account
   • DRequest that all audit failure log entries be forwarded to you

   Show answer

   Answer: A

   Next question

9. Question 79 · 213 in bank

   The Network Operations Center has identified and escalated an active denial of service incident on the mail server and several externally facing web sites to the security team for review. What are the next steps for the NOC team?

   • AIssue a company-wide alert to the users detailing the events.
   • BMonitor the events and provide new information directly to the security team.
   • CContact the web and mail administrators and provide them with the remediation solution.
   • DEnable IPS and firewall controls to mitigate the events.

   Show answer

   Answer: D

   Next question

10. Question 80 · 213 in bank

    Analysis of malicious code identifies a function that searches for specific processes and hardware on a victim host. If the processes or hardware are found, the malicious executable does not install itself. What is a common purpose of this type of malware functionality?

    • ADetecting virtual machines
    • BRemote code execution
    • CRunning polymorphic code
    • DDisabling local anti-virus

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 71. 213 questions available.