GCIH Exam Questions

Which of the following is used by Nmap for identifying live hosts and devices as part of a network sweep?

A company was a victim of bucket squatting. What process would help to prevent this type of attack?

Which encryption algorithm was replaced with the introduction of the /etc/shadow file in the Linux OS?

What can a Linux administrator use to take advantage of RADIUS?

An organization needs to protect its PHP web applications from Cross-Site Scripting attacks. Which action should they take?

An attacker has penetrated a network and is moving into the stage of pivoting throughout the network. Which defense mitigates this stage of the attack?

The provided screenshot shows output from running the SysInternals "Strings" command against a suspected malware executable. Which of the following strings indicate that the attack...

An engineer is using Hashcat to brute force passwords from a file of hashes. How should the following hash be handled in the scenario? 0843c6lee36fcdebcfec3333e62fe187

An attacker needs to relay SMB requests to another system outside of the local subnet using Responder. Which command arguments will achieve this goal?

A spike in Event ID 4625 is found in Windows event logs. Looking at individual accounts across the domain, no more than 5 failed logins are found for any single account. What is a...

What is the size of the data transferred in the following Squid access log?

Inspecting developer code for functions like system, exec, and popen is recommended to reduce the likelihood of what type of public-facing attack?

Which of the following is an example of a Berkeley Packet Filter (BPF) expression?

A series of TCP packets are being sent from a DNS server to an external webserver over port 53. Based on the information given, what is most likely generating the traffic?

A penetration tester is using John the Ripper to audit the password strength of Linux systems. The systems use shadow passwords. What command will he run to unshadow the passwords...

Which of the following natively supports SMB encryption?

Which persistence mechanism will evade detection by Sysinternals AutoRuns?

Which attack technique does the enabled setting in the screenshot mitigate?

A security team is actively monitoring windows event IDs 4634, 4688, and 4697. Which persistence mechanism will they detect with this approach?

Which RITA threat hunting functionality is used to identify C2 activity specific to Meterpreter?

What tcpdump parameter was used to produce the output on lines 2 and 3 shown below?

Which netcat command will listen on port 2222 for connections from a remote system (10.0.0.1)?

Which system is an attacker targeting by running the following command? PS > Invoke-MSOLSpray -UserList ./users.txt -Password Clippers22

A popular forum, where ICS techniques are discussed, loads scripts and ads from multiple external sites. Which attack can an adversary use to leverage this situation to attack this...

What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?

Which of the following actions can prevent the successful use of Metasploit against a Windows host?

What action does the following command perform? C:\DefenderCheck.exe .\giac1.exe

The following screenshot is of a malicious file. Why is there a notice about upgrading Microsoft Word?

Which of the following dumped hashes would be most useful to an attacker?

An investigator performing an initial analysis of a memory image identified a suspicious URL while using the strings utility. A second investigator attempting to recreate the resul...

The tools and techniques used in memory analysis closely resembles which other type of investigation?

The following event snippet was recorded by which type of logging device? 1660582288.951 185 192.168.42.109 TCP_MISS/208 1856

Which of the following Metasploit module types would contain scanning capabilities?

Which of the following persistence techniques will be identified using the Autoruns utility?

What is the destination endpoint host for the SSH session shown below? ssh - L 1777:192.168.1.80:23 [email protected]

During which phase of incident response would an analyst review the following data?

Which of the following files would grow to a large size as a result of a brute force attack?

Which malware investigation approach provides a detailed log of a system's file system, network, registry and process activities?

Which PowerShell cmdlet will display the command line parameters used to launch a Windows process?

Which of the following logs could be queried to identify Azure, Amazon and Google storage use in an organization?

Which Amazon AWS threat detection service monitors AWS accounts and workloads for malicious activity?

What is the outcome of the command below? hashcat -m 0 -a 3 ntds.dat --potfile-path ntds.potfile -1 ?d?d?d?d?d?d

What hash type is being cracked in the command below? hashcat -m 1800 -a 0 customer.ntds wordlist.txt --potfile-path ./hashcat.potfile

What would the following netcat command be used for? nc -V -W2 -z -p 53 192.168.193.33 21-112

What UNIX component can be used to enforce password complexity requirements?

Which web application log keyword would be associated with a SQL injection attack?

Which endpoint security bypass technique leverages existing system tools instead of adding executable?

Based on the nmap data in the screenshot the analyst would choose which IP address for a DNS attack?

An attacker is hoping to discover as many IP addresses associated with a target domain as possible. Which command would be helpful?

The following output shows reconnaissance activity against which platform?