GCIH Exam Questions

Analyze the data shown below. Where does this data originate from?

Which volatility plugin shows the command line path for a recently launched application?

Which of the following commands will enumerate a list of shares on a Windows target machine?

What is the definition of an event as it applies to incident handling?

Which of the following is a normal finding that an incident handler would expect to see while reviewing the squid proxy logs for a small business with a single office?

What hash type is being cracked in the command below? hashcat -m 1000 -a 0 customer.ntds wordlist.txt --potfile-path ./hashcat.potfile

Which of the following occurs when a penetration tester attempts to connect to a host with the following command? net use \\192.168.44.213

A security auditor is using John the Ripper to review password strength on Windows machines. The auditor knows that the company requires a 15-character minimum in their passwords....

Which of the following would be exposed to an attacker as a result of a remote employee attempting to connect to company resources without a VPN?

Which of the following is the most effective technique for identifying live client systems on a LAN?

Where would an incident handler search for autostart extensibility points (ASEPs) on a Windows host?

How can an adversary use a hash that was stolen from a Windows account to compromise a Linux server?

What is the outcome of the command below? hashcat -m 3000 -a 3 ntds.dat --potfile-path ntds.potfile -1 ?u?d?s --increment ?1?1?1?1?1?1

Which file would an attacker need to read in order to crack passwords on a modern Linux system?

Which of the following squid proxy log fields is easiest for an attacker to spoof?

What do drive-by attacks typically take advantage of when delivering exploits?

A responder runs the two commands below looking for the number of lines that contain the word powershell. Which of the following is a reason why the output is different between the...

Alice is checking for unusual activity on the LAN that she administers. Based on the CAM table excerpt below, what port should be investigated further?

An attacker has tricked a user into executing content he placed on a social networking site. The malicious content executes in the victim's browser and allows the attacker to deter...

Following the recent acquisition of a new business, your manager asks you to investigate their DNS service and report back on its status. He is concerned as they only have one DNS...

A system administrator finds the entry below in an Apache log. What can be done to mitigate against this? 192.168.116.201 - - [22/Apr/2016:13:43:26 -0400] 'GET +mysql.user+limit+0%...

Which of the following user accounts is the default Administrator account?

What request methods are exploited in a Lanturtle + Responder access attack?

In addition to special characters, certain keywords in log files may indicate a SQL injection attack. Which words could indicate a SQL injection attack?

What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> lsaenumsid

How can a system be configured to ignore gratuitous ARPs for specific IP addresses?

What built-in Windows tool can be used to collect Active Directory database data and the SYSTEM registry hive for off-line password cracking?

Examine the image below. What share would a user typically connect to when they execute the NET USE command below? C:\> net use \\10.0.10.123

When probing for command injection opportunities on a remote host, why would an attacker target her own address space from the remote host?

An administrator needs to protect his organization's IIS webservers from Cross-Site Scripting attacks. Which action should he take?

What information is commonly found in both the header and the possession log of a Chain of Custody?

Which of the following Metasploit module types would contain privilege escalation capabilities?

Which of the following describes a suspicious event in the service data below? root@kali:~/volatility# ./vol.py -f ../mem/Desk005.vmem svcscan

Which file contains information about failed login attempts on a Unix system?

What is one of the simplest AND most common ways for an attacker to camouflage files on a UNIX system?

Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters? tcpdump -nn -r pingout.pcap '榠cmp and (dst host 8.8.8.8)'

What is the goal of an attacker who has entered the commands shown in the screenshot?

During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password...

What information will be returned when an administrator executes the command below? # last -f /var/log/btmp

Which of the following Volatility commands will display the date and time an image was collected?

When switching traffic on a LAN, what element of the Ethernet frame does a switch use to make its decision on where to send the data?

How would an attacker hide an executable from being viewed by Windows Explorer?

What is an alternate data stream?

Which tcpdump command will open the capture.dmp pcap file and display the ASCII output of traffic going to and from 192.168.122.12?

Which is the normal response from live hosts to the discovery packets sent during a default Nmap sweep?

An administrator is inspecting a machine that starts more slowly than it used to. Which key under HKLM\Software\Microsoft\Windows\ should be examined to determine if malware is exe...

Tools like RITA use which of the following characteristics to identify C2 traffic?

Where would salted hashes be found on a Linux machine?

What type of hash is used in the password hash below?

A fake installer exploit is delivered using which attack?