GCIH Exam Questions

What is a penetration tester likely to be looking to accomplish with the following screen?

Which describes a Web Application Firewall?

Which of the following is an effective method of detecting a covert communication tunnel such as ptunnel?

Which of the following would prevent an active discovery toll like InSSIDer from detecting a wireless access point?

Roman Enterprises' network perimeter and internal servers are suspected to have been compromised by an advanced attacker over a period of several weeks. Which of the following shou...

A company's external DNS server was used by an attacker in a DDoS attack against a third party. Which of the following configurations should be changed to prevent this from happeni...

An attacker has gained the ability to sniff client traffic on a local subnet. Which technique would they use to cause clients to reauthenticate to internal applications in an attem...

What payload data would be difficult for an IDS/IPS signatures to analyze?

What kind of topics should be addressed by the Lessons Learned report?

Which of the following methods is the most likely to detect a user mode rootkit?

A user opened a PDF he downloaded from the web, that contained a URL to an executable called FreeCoupons.exe. The user downloaded and ran FreeCoupons.exe, and now that file is on t...

Which Linus command will list locally defined Windows users, groups, and SID's?

Your CIO, Thomas Fischer, has complained that vendors are cold calling him to get more information about your organization's new domain name (tvf-prod.com). You've extracted the in...

Which of the following protocol header values would indicate an IPv4 packet?

Which of the following activities would the fast flux technique be most useful in helping a bot- herder accomplish?

You are reviewing summarized logs from your central log server. You see a large number of packets from an internal host traveling to your primary DNS server with a destination port...

You want to ensure that the data that is returned to your web server during an online transaction is the same data that was sent to the customer. You have found several vendors off...

What is a histogram as it applies to an alphabetic cipher?

Based on the tcpdump output below, what is an attacker attempting to do?

How does a web application that is vulnerable to SQL injection attacks usually tie into a database?

An attacker configured nmap with command line options that specified the destination port, destination IP address, and TCP flags to be set to SYN/FIN/PSH/URG. No other command line...

One typical way to help secure applications such as Virtual Network Computing (VNC) is to send the application traffic using which of the following?

HYDAN uses functionally-equivalent instructions to steganographically embed information in which one of the following data formats?

Analyze the screenshot below. Which event described below is taking place in the output shown?

An attacker has used an infected USB thumb drive to compromise an internal host. The host is firewalled, blocking all inbound ports and protocols, and allowing tcp port 8080 outbou...

What type of activity is occurring in the screenshot?

Analyze the command output below. Why did OS detection fail?

Analyze the code snippet below. What is the main purpose of this code?

Which of the following is a key aspect of an emergency incident response?

What is the term used to describe a Worm that is able to infect a host by exploiting many different application or operating system vulnerabilities?

Who is responsible for the decision to take a machine critical to a company's operations out of a production environment?

Which is a requirement to ensure the success of the following command? C:\> notepad helloworld.txt:goodbye.txt

You are copying files from the C:\WINDOWS\system32 directory to a USB memory stick and encounter the pop-up shown in the image. What does this indicate?

How would a worm be able to affect hosts running different operating systems be classified?

An administrator creates a rule to block outgoing ICMP Time Exceeded messages from leaving the network border. What will the effect of this be?

Your incident handling team receives the following information: - The help desk is getting password reset requests from remote employees. - When contacted by the help desk technici...

Which of the following techniques can malware employ to avoid detection by honey ports installed on virtual machines?

You are planning to upgrade several packet filtering firewalls to proxy firewalls and need to make a presentation to management. During the presentation, a member of management ask...

How could an attacker bypass client-side filtering of user input?

You suspect that someone located outside your organization has been searching for open ports on your web server. How can you see whether the web server is being scanned?

An employee is sending personally threatening email through the company's email server to a supervisor and external business partners. Which type of incident is this?

Which of the following protocols is resistant to session hijacking attacks?

You are recovering a password. The password is encoded as an MD5 hash with salt. Which attack will have a 100% success rate at recovering the original password, given enough time a...

What is the first type of packet sent when the ping command is executed on a Windows system?

Which of the following devices would return information about internal targets during an ACK scan?

What is the penetration tester looking for in the following screenshot?

From the choices below, which type of defense is the best way to protect against User-Mode RootKits?

Which of the following BEST represents a true virtual machine escape?

Which of the following methods does Netcat use to act as a relay (transferring data from machine to machine)?

A company is reviewing its systems. The review includes travelling laptops with insecure connections, and is focused on finding connections to known malicious locations. What would...