GCIH Exam Questions

You work as a Security Administrator for Net Perfect Inc. The company has a Windows-based network. You want to use a scanning technique which works as a reconnaissance attack. The...

Which of the following actions is performed by the netcat command given below? nc 55555 < /etc/passwd

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker? Each correct answer represents a complete solution. Choose all that apply.

Which of the following attacks saturates network resources and disrupts services to a specific computer?

based network. All client computers run the Windows XP operating system. The employees of the company complain that suddenly all of the client computers have started working slowly...

John works as a professional Ethical Hacker. He is assigned a project to test the security of are-secure Web site and receives the following error message: Microsoft OLE DB Provide...

John is a malicious attacker. He illegally accesses the server of We-are-secure Inc. He then places a backdoor in the We-are-secure server and alters its log files. Which of the fo...

Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

Which of the following virus is a script that attaches itself to a file or template?

Which of the following tools is described in the statement given below? "It has a database containing signatures to be able to detect hundreds of vulnerabilities in UNIX, Windows,...

John works as a professional Ethical Hacker. He has been assigned the project of testing the and applications running on the We-are-secure server. For this purpose, he wants to ini...

John works as a C programmer. He develops the following C program: #include <stdlib.h> #include <stdio.h> #include <string.h> int buffer(char *str) { char buffer1[10]; strcpy(buffe...

Which of the following is used to determine the operating system on the remote computer in a network environment?

Which of the following are the limitations for the cross site request forgery (CSRF) attack? Each correct answer represents a complete solution. Choose all that apply.

Which of the following wireless network security solutions refers to an authentication process in which a user can connect wireless access points to a centralized server to ensure...

Which of the following controls is described in the statement given below? "It ensures that the enforcement of organizational security policy does not rely on voluntary web applica...

Which of the following refers to a condition in which a hacker sends a bunch of packets that leave TCP ports half open?

Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his senior members, stating that "security defenses has been breached and ex...

Logs show that a malicious host has remotely accessed the file 'Documents and Settings:logs'. At what step of the attack process is the attacker most likely operating in?

A search using the term inurl: 'ViewerFrame?Mode=' is looking for what?

Which of the following is the most helpful way to protect a host against application level backdoor trojans from infecting a system?

Which control could help detect insider abuse of an organization's intellectual property?

You are an incident handler from a Fortune 500 oil and gas company. While reviewing the Data Loss Prevention (DLP) email software alerts, you find an email with Personally Identifi...

A host has been compromised with a rootkit through Internet activity. The analyst wishes to reconstruct the binary file used to infect the host. Which of the following sources of e...

How does an attacker try to trick a database into revealing information that can help with an attack?

Identify the nature of the traffic shown below:

Which special character or character sequence is often used in SQL injection attacks because it acts as a SQL comment delimiter?

How would an attacker prevent another system user from viewing malicious files added to an existing Linux directory?

What are the differences between patents, copyrights, and trademarks?

A workstation with an IP address of 10.10.20.115/24 is suspected of being compromised. Which of the following is supported by the information in the process table?

What is the first step that a containment team should take?

dns.victim.com DNS server using the Kaminsky method of DNS cache poisoning. Of the following choices, which would be an example of an effective query sent by the attacker?

An organization is moving away from legacy network management tools like telnet. What would be a fast way of ensuring that telnet is not being used on the network?

Which of the following is one of the fields that Covert TCP uses to transmit data?

Which symbol is used to properly terminate a SQL query?

There are six control bits to describe a packet's role in a Transmission Control Protocol (TCP) connection. Which of the following control bits initiates a graceful end to a connec...

Covert_TCP will use which of the following byte offsets on the TCP header to carry ASCII data?

You are the leader of an incident handling team for a mid-size manufacturer in the United States. Several of your company's products are patented and several processes used in the...

Your company's web server administrator reports that the Apache servers are running slowly, but the IIS servers are not. Based on this report, which of the following pieces of info...

An analyst notices ICMP Timestamp replies sent from multiple IP addresses on a client LAN to a single IP address on another network segment within a short period of time. What is l...

What is a DNS zone transfer?

Which of the following is a primary outcome of an effective Incident Handling program?

Which remote control program can be used as an application-level backdoor and typically listens for connections on port 5900?

What would be the classification of a worm with the following characteristics?

What is the value of salting password hashes?

Prior to restoring clean data from backups, what are the recommended activities for bringing a server's operating system and applications back online following a buffer overflow ex...

In the network logs there are ACK/FIN/PSH/URG packets from a host going to a closed port, and SYN/FIN/URG/PSH packets going to open ports. What is the host likely doing?

When containing an incident, who makes the final decision on whether a box should be taken offline?

Suppose a web application builds the SQL command "select PhoneNumber from contacts where Company = '[value]';". What would the result likely be if an attacker submitted the value "...

What is one of the functions CyberCPR performs?