GCIH Exam Questions

An analyst discovers an undocumented host showing up in some IDS alerts with IP address 10.0.1.123. A port scan indicates listening services on the host. What step can the analyst...

Which of the following describes an attack where false Data Link Layer information is sent to a victim host to redirect packets to the attacker's host on the same subnet?

Which of the following is a feature of Netcat that is not present in telnet?

Analyze the screenshot below. What action should the penetration tester recommend to the security team?

Examine the packet capture below. What can be determined based on the packet information?

How can the information below be used in a penetration test?

As an incident handler for the XYZ Widget Company, you have responded to the breach of your mail server. The server is not in a DMZ but on your internal network and was being used...

Canaries help to implement what protective mechanisms in the stack?

What element of the DNSSec standard would help stop DNS cache poisoning attacks?

Which three components must be included in a SQL update statement?

In general, which method is the fastest for cracking a password?

Why do protocol parsers such as sniffers often run with root or system privileges?

You are a Windows XP user and you want to ensure that your account does not have a LANMAN hash. How can this be achieved?

Detecting Virtual Machine Environments (VMEs) is the purpose of which of the following pieces of software?

A company's internal LAN is being scanned by a compromised workstation. Which of the following is a 'Containment Phase' action that protects volatile data?

After reviewing your firewall logs for the past week, you notice that a specific workstation is surfing the Internet at the same time every night when employees would not be on the...

An attacker is attempting to sniff packets on a switched network. He has forced his network interface to run in promiscuous mode, and set up IP forwarding on his machine. All packe...

Which of the following tools will show all TCP and UDP connections on a Windows system?

An analyst ran a Nessus scan with Dangerous plugins enabled for performing a vulnerability scan against a business critical system running on the production network. This brought d...

If a sniffer is installed on a host residing on a switched environment network, what packets will it capture?

How does Karmetasploit acquire the user credentials of wireless clients?

What is one of the first actions you should take in the containment phase of incident handling?

Your incident handling team is gathering a list of data owners and contact numbers for high-value targets. In which stage of the incident handling process does this action belong?

The scanning algorithm in a port scanning tool is designed to continue sending SYN packets to targets rather than actively listening for a response from each one before proceeding....

During routine examination of bandwidth data for your company's DMZ, an anomaly was discovered with the activity to a public-facing, download only FTP server. To begin your investi...

What is an effective mitigation for an HTTP flood attack?

What is the name of the GUI-based front end for Nmap?

Where could you refer to a honeypot web page in order to lure and identify possible attackers?

What is the first line of defense against BGP hijacking?

How could you determine if your system is the victim of a SYN flood?

An attacker wishes to steal browser cookies through a Cross-Site Scripting attack. Which website provides the best attack vector?

Which of the following functionalities is offered by Abel?

A new buffer overflow vulnerability in the Remote Procedure Call (RPC) mechanism for all versions of Windows has been announced, and exploit code has already been made available on...

Which of the following is a protocol that, like TFTP, can be used to transfer Netcat to a victim machine in order to open a backdoor listener?

You run a network using the 10.0.0.0/8 address range. You notice a strange increase in traffic coming from one of your DMZ servers one day. You collect a packet trace using Tcpdump...

Which of the following security benefits does DNSSEC provide?

As an incident handler, you are checking DNS server logs for DNS transfers. What protocol and port might indicate a zone transfer?

The Conficker worm can run every time Windows starts on infected machines. What tool would you use to test whether the worm will do this on a machine that you think may have been i...

You have many software packages available to choose from when preparing for a vulnerability scan. What precautions should be taken when running a basic vulnerability scan, regardle...

Which of the following TTL values on an incoming packet allow it to be forwarded to the next router in the path?

A company is running a Windows network segment with Windows 8 for its users and wants to do a statistical analysis of the workstations to help detect malware. What would be a good...

How could an attacker insert malware into the kernel of a Windows system?

Analyze the screenshot below. What will the search return?

You cane across the following code snippet when investigating an incident that involved a business critical system. This code crashed right after the user passed the following inpu...

Stacy is the lead of the network services team. She suspects that Keith, one of the network administrators, is not spending as much time working as he states he is. She suspects he...

Examine the image below. Based on the log file and directory entry below why was the .bash_history file empty after Eve terminated her session?

What advantage does running netstat with the flags '-nao' have over running netstat with the '-na' flags in Windows?

If a router received an IPv6 packet with a Hop Limit of 1, which of the following ICMP messages would it send back to the originating host?

Which of the following commands can be used to create a backdoor shell on port 1234 on a Linux or Unix system?

Which of the following best describes a statically linked binary?