GCIH Exam Questions

Assuming you use each program listed, of the choices listed below, which represents the BEST defense against protocol parser vulnerabilities?

What is a war dialer?

Organizations with a requirement for high security may provide their workers a single computer with multiple guest operating systems installed. Each guest is allowed access to a ne...

Observe the image below for context. Which of the following steps would be next in the process of reconnaissance?

As an employee of Enfield & Sons, you have been tasked with adding a warning banner to computer systems. You develop the below warning banner. What should be your next step? 'Warni...

A new helpdesk employee at a multinational corporation took it upon himself to test the security of the servers that holds highly confidential information regarding specific govern...

An attacker designs malware to remain dormant when it detects a shifted interrupt descriptor table. On which of the following hosts would this malware remain dormant?

You are a member of your organization's security team. A new ticket just came into your service desk and was escalated to you. One of the system administrators noticed the followin...

What is the best approach to successfully filter out potentially harmful characters from user input?

Which of the following tasks would take place during the incident containment phase?

When launching a SQL Injection attack, what characters might an attacker start experimenting with first?

When performing reconnaissance what is a good way to speed up the process and collect results from many different search engines at once?

Why should organizations consider disabling auto-run as part of their Windows system hardening baselines?

The screenshot from Kismet below shows details of a WiFi network with SSID Cloaking enabled. How was Kismet able to collect the SSID information?

The Network Operations Center has identified and escalated an active denial of service incident on the mail server and several externally facing web sites to the security team for...

Unix files beginning with which of the following characters are considered hidden?

Which of the following makes it difficult to block the source of DNS amplification attacks?

What is the goal of the containment phase of incident handling?

With the screenshot below, what is the penetration tester likely looking for?

Which of the following incident handling mistakes would occur as part of the eradication phase?

During the eradication phase, what information should be analyzed to determine the cause and symptoms of an incident?

A sysadmin would use SYSKEY to accomplish which objective?

Many of your company's customers have been complaining that their web forum accounts have been compromised, so you have been asked to investigate. After creating an account as a no...

Deleting an attacker's scheduled tasks on a victim host is something that would typically occur during which phase of incident handling?

Why was Shellshock a threat to platforms like DHCP servers and home WiFi routers in addition to web servers?

Analyze the image below. In which stage of the attack process is the attacker operating?

A systems administrator notices an increase in errors in a DNS server log. Further investigation determines the errors are related to incoming DNS packets with incorrect query ID's...

Several fully patched machines from different vendors are found to be compromised. The only processes that contacted the network prior to the compromise were automatic software upd...

Which of the following is a common method for hosts to be infected with bot software?

You are investigating a potential web server compromise involving user authentication. During the identification phase, you examine the web server log file and find thousands of li...

Out of the following, which is the most effective way to protect against rogue modems and the risk they introduce?

What can be concluded from the picture below?

What is the third step in the three-way handshake?

How does a worm utilize the Warhol/Flash technique?

Becky is reviewing the password policy for the Firm's Windows network. She would like to make the password minimum length 15 characters. What will be the effect of this change?

An investigation led to the identification of several systems showing suspicious activity. At regular time intervals, the systems send data over port 80 to different external hosts...

Which of the following is recommended to include in your incident response jump bag?

After a system that was compromised in an incident is brought back into production, which part of the incident handling process must be done?

Which Win32 based command will display DNS record names and types, as well as the current time to live for the record?

View the following screen capture. Which of the following security mechanisms detected downloader.exe as a possible threat?

Following a virtual machine escape attack, a rebuilt Windows server hosting multiple VMWare guests is placed on a protected VLAN for monitoring. What activity would indicate that t...

What will a host do when it receives a packet with an invalid TCP checksum?

The target company's IP range is 151.113.0.0/16 and their border router's ASN (autonomous system numbers) includes their entire IP range. An attacker stands up their own border rou...

Analysis of malicious code identifies a function that searches for specific processes and hardware on a victim host. If the processes or hardware are found, the malicious executabl...

Which of the following can be done using Covert_TCP's built in functionality?

The penetration testing team is attempting to intercept DNS queries and poison the ARP cache of the Windows host at the IP address of 192.168.10.205. Their testing platform has the...

Which of the following is the most effective at eradicating a system infected with a Rootkit?

Which of the following could help prevent the threat of an external entity mapping a network's internal systems and filtering rules?

Which Windows tool can be used to view the contents of the following file directly in the command shell? C:\Users\JaneD\funnyjokes.doc:file1

Which technique allows an attacker logged into a computer attached to switch port 8 to see traffic sent to hosts on other ports?