GCIH practice questions 81–90

1. Question 81 · 213 in bank

   Which of the following is the most effective at eradicating a system infected with a Rootkit?

   • ADisable the rootkit service in Control Panel/Administrative Tools/Services
   • BFormat the drive, reinstall the OS applying any applicable patches, and change passwords
   • CUninstall the Rootkit via Add / Remove Programs
   • DDelete the rootkit files and remove the startup shortcut

   Show answer

   Answer: B

   Next question

2. Question 82 · 213 in bank

   An attacker is tunneling TLS encrypted traffic within ICMP echo and reply packets. How will most network appliances see this?

   • AAs reverse shell traffic
   • BAs covert TCP traffic
   • CAs ping traffic
   • DAs TLS traffic

   Show answer

   Answer: C

   Next question

3. Question 83 · 213 in bank

   Which of the following is an effective method of detecting a covert communication tunnel such as ptunnel?

   • ARejecting incoming UDP packets with source port < 1024
   • BCapturing outgoing HTTP traffic at unusual times
   • CRestricting ICMP port unreachables with a non-zero payload
   • DDetecting ICMP packets with uncommon payloads

   Show answer

   Answer: C

   Next question

4. Question 84 · 213 in bank

   Which of the following processes should be prioritized for examination during live response?

   

   • ARpcSs
   • Bchrome.exe
   • Cnotepad.exe
   • DW32Time

   Show answer

   Answer: B

   Next question

5. Question 85 · 213 in bank

   An attacker compromises a host and runs the following commands. What did the attacker do?

   

   • AA tunnel was created
   • BA password was cracked
   • CA file was hidden
   • DA log file was edited

   Show answer

   Answer: D

   Next question

6. Question 86 · 213 in bank

   Which of the following can be used in a USB attack to bypass authentication by hijacking the password libraries on a Windows system?

   • AInception
   • BRubber Ducky
   • CLan Turtle
   • DKon-boot

   Show answer

   Answer: D

   Next question

7. Question 87 · 213 in bank

   An attacker is launching an attack against an input field in a form that is used to retrieve restricted information that is filtered dependent upon the privileges of the logged in user. This attacker inserts "' or 1=1;--" into this field. What is most likely the attacker's desired result from this insertion?

   • AThis forces a bypass on the back-end authentication mechanism, allowing total access to the entire database
   • BThis forces a TRUE condition and may cause the SQL server to return all of the information in the selected field(s)
   • CThis forces a UNION condition and may cause the SQL server to return a list of all columns in the database
   • DThis forces an INSERT condition and will dump all rows in the table to the users screen

   Show answer

   Answer: D

   Next question

8. Question 88 · 213 in bank

   An organization has an SSH server that was compromised, but later eradicated and recovered. The system disks were wiped clean, the OS reinstalled, and patches re-applied. After this process is complete, a security analyst noticed multiple simultaneous SSH logins from a single, valid, user-account on that system. Which of the following is the most likely explanation?

   • AProper action was not taken on the firewall or router to block SSH traffic
   • BAn attacker is accessing the system through a backdoor using netcat
   • CNot all of the attackers artifacts have been removed from the system
   • DThe SSH user account credentials have been compromised

   Show answer

   Answer: D

   Next question

9. Question 89 · 213 in bank

   Which Microsoft tool can be used to mitigate the risk of an adversary reusing a stolen local administrator password hash?

   • AAttack surface reduction
   • BLAPS
   • CASLR
   • DHeap spray protection

   Show answer

   Answer: D

   Next question

10. Question 90 · 213 in bank

    Which endpoint security bypass technique modifies the assembly of an executable?

    • ALiving Off the Land
    • BCode signing
    • CKeyed payload
    • DGhostwriting

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

GCIH practice, question 81. 213 questions available.