GCIH Exam Questions

A security examiner has been given permission by senior management to conduct a password audit. What should the examiner ensure after the process completes?

What is downloaded when the following command is executed? $ bucket_finder.rb words --download

Which Windows process would an attacker target to steal credentials from a user who logs into applications with a Password Manager?

What is the first decision point of an incident investigation?

A victim visits a website that allows authenticated users to upload articles for other users to read. The victim logs in and clicks a link on the website's home page for a newly po...

While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the...

Which activity helps readdress security tasks identified in past incident reports?

Which of the following programs is used by John the Ripper to merge the /etc/passwd and /etc/shadow files?

What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> enumdomusers

Which of the following can the rpcclient application do?

An attacker with GCP cloud administrative access uses the Google gcloud and gsutil utilities to create a backup of a sensitive database for download. How would this attack be ident...

What task is a Windows administrator performing with the command below, executed from a file server with an IP address of 46.95.101.82? C:\> net session \\46.95.101.109 /del

How does the use of endpoint application allow lists impact malware attacks against the system?

Which volatility plugin shows information about listening and closed sockets?

What password characteristic could you require to eliminate the use of LANMAN hashes and restrict the local authentication to NT in a modern Windows system?

What shortcoming of the traditional PICERL incident response model is addressed by adopting a dynamic incident response model like DAIR?

Which activity is considered a direct and riskier form of reconnaissance?

Which of the following SSH commands will start a SOCKS proxy server on the local system?

Which of the following user accounts is the default Administrator account?

A web application receives the following input from a malicious request. What is the attacker attempting to do? select accountbalance from user where name = jake' OR 'z'='z';

Which command is an indication of post-exploitation persistence?

What is the purpose of the application rpcclient?

Analyze the included screenshot. What is a best practice to mitigate against this type of event?

Why is a nmap SYN scan useful for network scanning?

After running the command shown below, which output field contains the user's cleartext account name? aws sts get-caller-identity

What action is being performed in the following session?

What goal would an attacker achieve with the following Set of commands?

What does the following command do? nc -v -z 192.168.40.90 1-1024

Which of the following is shown in the screenshot?

Which of the following will record web sites visited and web applications used for incident response analysis?

What does the term any instruct tcpdump to capture in the following command? tcpdump -A -i any 'port 21 && host 192.168.100.1'

A Windows workstation was clean a few days ago but now appears to be infected. Based on results from tasklist, which was run last week, which connection or connections shown in net...

What is a common characteristic of both a watering hole attack and a drive-by attack?

What password attack uses a stolen password breach list?

Which of the following describes code wrapping?

Based on the results below what type of nmap scan was run?

A victim browses to a news aggregator website through a link sent to them by an attacker. The attacker then alters the page delivered to the victim's browser and includes malicious...

Which Windows command cruted the output below?

An attacker at IP address 11.22.33.44 set up a reverse shell so he could execute commands on a server (internal IP address 192.168.20.21) that sits behind a site firewall blocking...

With what frequency does the AWS API Gateway assign a new IP address?

Which of the following describes OSINT?

Using the command below, to which share will the user be connected on 192.168.99.10? C:\> net use \\192.168.99.10

Which would be the ideal system for conducting analysis during cloud investigations?

What type of attack is being attempted in the following image?

How should an incident handler classify the following event shown in the output below?

An administrator runs the following command. What should be their next step based on the output shown?

What would a forensic analyst extract from the following registry key? HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions

What can be inferred from the results below?

What is an incident handler looking for when executing the PowerShell command below? Get-ItemProperty 'HKLM:Software\Microsoft\Windows\CurrentVersion\Run'

How do DNS tunneling tools like DNSCat2 avoid DNS caching?