GCIH Exam Questions

What is the primary goal of the Eradication phase of handling an incident?

In the event there is a disagreement on the events of the incident, how should it be handled in the final report?

You have responded to the breach of an internal file server that contains highly confidential strategic information. The attacker compromised the server and created a local adminis...

An attacker is tunneling TLS encrypted traffic within ICMP echo and reply packets. How will most network appliances see this?

An administrator needs to repeatedly scan a very large network with thousands of hosts, what is the best way of accomplishing this very quickly?

You are a member of your organization's IT Security Team. The following were found in the hosts file on a Windows workstation that is on your network. The system administrator thou...

An attacker issues the command shown below. Which of the following best describes what the attacker is attempting to do? C:\> nc.exe '"L '"p 43567 '"e cmd.exe

How can you minimize your chances of a mistake, such as not notifying a required party, being made during an incident response?

What command would you issue on a Windows 7 system in order to list the open TCP and UDP ports and connections to these ports?

Mike uncovers malware on a web server that is triggering 100% CPU utilization which prevents other processes from launching. What category of Denial of Service attacks does he plac...

Which tool can sniff probe requests from a wireless client, pretend to be the client's legitimate access point, and offer fake network services to the client?

By default, many Unix systems store the system logs in what format?

You have identified a virus that has quickly spread throughout your organization through fileshares. You have isolated the server that was the source of the infection, and you're w...

You're the lone incident handler at an online-only small business. Monday morning, your email box contains four incidents that have been identified by the company's systems adminis...

Why should you inform incident handling team members in advance of their joining the team that they may be required to testify in a court of law?

Which approach is recommended to prevent a DoS condition due to account lockouts as a result of a password guessing attack?

Which of the following is a characteristic of metamorphic worm code?

Which security practice is most likely to reduce worm infections?

Which TCP header field is used by Covert_TCP to conceal ASCII data?

Which of the following is vulnerable to a dictionary-based, password-cracking attack against wireless networks using WPA and pre-shared keys?

What is the best practice for analyzing network traffic in a production environment to minimize the risks associated with such activities?

Which version or versions of the SSH protocol are vulnerable to man in the middle attacks using Dsniff?

Examine the image below. Which of the following directories should be examined for suspicious entries?

What capability does a GRE tunnel provide to a bot herder communicating with his bots?

A successful phishing attack led to multiple user workstations being infected with command and control malware. Which of the following would be an effective short-term containment...

How is exploiting a buffer overflow in a Linux SUID program owned by root different from exploiting other programs?

You are investigating an incident on a workstation that you suspect is compromised after the user opened an executable in an email. The workstation is used for email, internet acce...

Your organization has suffered several leaks of internally distributed documents. They have asked you to track down the culprit. You are embedding a four-letter string of character...

Which of the following commands could a Windows administrator use to hardcode the MAC address for host 10.1.12.23 on his workstation?

A server was infected by malware and controlled by an attacker for six months. The server was recovered and returned to production. Which of the following would provide the most ef...

During which Incident Handling phase would steps for preventing successful worm attacks occur, such as developing patch management and file encryption policies and processes?

Which command will reveal the contents of slackspace.txt? C:\> notepad C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt

As an incident handler, you are responding to a server breach and have gathered the following information: An attacker can execute code of his/her choice on a vulnerable system tha...

Eve and Alice have the same 8 character password of 'password' for their Linux accounts. A simplified entry from /etc/shadow is displayed below. Which of the following explains why...

During which phase of the incident response process do you define and implement your general defenses against Netcat?

Examine the image below. Which of the following defensive measures could be taken to control the activity?

A Linux server which is in the scope of an Incident Response you are performing has been rebuilt and tested by the accounting department. The accounting department is the business...

Which servers should be allowed to perform zone transfers from your primary DNS server?

Analyze the following command. What will this command do? $ nc -1 -p 443 -e /bin/csh

Which of the following will best protect your network from being mapped by untrusted, external sources, while still allowing trusted sources to verify network connectivity with pin...

The Kratla Company deploys laptops running Windows or Mac OS to their employees, who connect via VPN. What tool can the incident response team use to centrally gather critical logs...

What step would mitigate the risk of the specific type of the web attack that produced the web server logs presented below?

Which of the following is most likely to be an Indicator of Compromise (IOC)?

Analyze the screenshot below. Based on the information, how will you classify this?

Which of the following files would an attacker alter to remove evidence of the most recently typed commands on a Linux system?

Which activity would be conducted as part of the containment phase?

In an attempt to contain an incident, the response team shut down a critical server without communicating with the Network Operations team. This led to upset management, poor custo...

Which of the following would be a recommended containment measure taken to prevent a bot infected system from communicating over command and control channels?

What kind of traffic does an egress anti-spoof filter drop?

During the lessons learned phase which of the following represents the best choice for what you should do to resolve the issue(s) that caused an incident?