GCIH Exam Questions

Which of the following tools can be used to force password complexity in Linux?

What will the following Enum command display? C:\> enum '"G 127.0.0.1 -

A user is asking for an upgrade to Internet Explorer, because he constantly gets annoying windows popping up whenever he visits his online banking site from his laptop when on the...

You are in the process of recovering from an incident where a web server and database server were severely compromised due to a lack of patching. Both servers have been rebuilt and...

Analyze the nmap results shown. What is the first step the security administrator should take?

If an accounting department's computer system was compromised, who should make the decision about when that system is put back into production?

Which of the following commands would set up an administrative session with a remote system and mount 'one' on your system?

A helpdesk ticket has been escalated to the incident response team. According to the FIRST organization classification guidelines, during which incident response phase should the t...

Failing DNS, what will modern Windows systems use to resolve names of other systems?

Which tool is used to provide 128-bit encryption of passwords?

The incident response team has been working with the various systems teams to find a way to gain root access to systems in event of an incident. It has been proposed that the syste...

What can you do to proactively protect against DLL injection on your organization's Exchange server?

Which of the following is ALWAYS a good guideline for incident response processes?

How does an attacking host initiate a SYN flood attack?

Attackers are trying to connect from an internal host they have compromised to their own host on the Internet. They can ping their external host, but cannot connect. What should th...

Why would an analyst run the following command on a host they suspect is compromised? C:\> c:\temp\lads\lads /S c:\Windows\System32

What is one indication that someone is running a Windows event log editing tool on your server?

As an incident handler for the xyz widget company, you have responded to the breach of your mail server. The server is not in a DMZ but on your internal network and was being used...

During the identification phase of a potential incident, you examine the logs of a web server, which are full of lines like the one displayed below. During the preparation phase, w...

Which of the following occurs during the recovery phase of an incident?

If an attacker is attempting to use the Kaminsky method of DNS cache poisoning, what is the maximum number of unique Query IDs which must be presented to the victim DNS server befo...

Which file contains information about past successful user logins on Unix systems?

Which tool can be used to sniff probe requests from wireless clients, and pretends to be the access point the client is seeking?

Below is a Unix system configuration file below which sets kernel parameters upon booting. Which parameter did the systems administrator set as a defense against buffer overflow at...

Observe the following command; what is the analyst doing? $ rekal '"f /cases/20160726_39/RAM/memimage.dd

Which of the following accurately describes a 'Bot'?

Which of the following accurately describes the difference between worms and viruses?

In a network switch, what is the benefit of comparing the MAC address of a host to a known list of DHCP assignments?

One type of FTP scan allows you to find a weakness in a certain type of firewall. These firewalls will allow an FTP data connection to take place, even though the FTP control conne...

Regardless of the initial compromise or type of incident, which step is always a good practice during the Recovery phase of the Incident Handling Process?

You are a member of your organization's IT security team. Your team has limited resources, so investigating every suspicious event is impossible. Which one of the following items,...

You are responding to an incident in which the organization's Extranet server has been compromised. The Extranet is the browser home page for most users in the organization. You ha...

To defend against network mapping, which of the following packets should be denied at the border router?

As related to buffer overflows, what is the purpose of the Instruction Pointer?

You just acquired admin rights on a remote machine and gained remote access. What techniques would you use to determine if it is a virtual machine?

An attacker wants to intercept their target's network traffic using ARP cache poisoning. How should the attacker setup IP forwarding?

Which Wireless LAN discovery tool uses active scanning in order to detect wireless networks?

Which stage of an attack typically involves little or no direct interaction with the attack target(s)?

Computer 'remus' has traffic coming in on port 53. You want to forward the traffic to system 'romulus' on port 1234. Which command would you run on 'remus' to complete this task?

Which tool is designed to provide shell access over ICMP?

When using a Netcat backdoor listener for shell access, what userID will the commands be executed as?

A SOC analyst is reviewing event logs from several network devices across the enterprise and notices that there are an abnormally high number of logon attempts across the desktop s...

An analyst runs the following nmap scan from their Linux computer as a non-privileged user. The target host, 10.0.233.2, has tcp/445 open. What network traffic would be generated b...

MyDoom, Zotob, and Blaster are all examples of what type of malware?

An incident handler investigating abnormal system behavior has captured traffic from two client workstations. Both clients sent dozens of SYN packets to an external host WW3.ACME.N...

A client wants a system so that they can monitor connection queues on network equipment for too many half-open connections, as well as look for bandwidth consumption from the same...

If virtual machines are relatively easy for an attacker to detect, the next best thing might be to put so much honey in your honeypot, attackers won't be able to resist. Which acti...

Which reconnaissance source would you expect to provide the information in the below screen capture?

A company requires employees to sign an acknowledgement of the organization's security policy when they are hired. An employee with email access used the company's mail server to t...

If law enforcement asks you to perform an action on their behalf, what might require before rendering assistance?