GIAC
GPEN · Question #388
GPEN Question #388: Real Exam Question with Answer & Explanation
Sign in or unlock GPEN to reveal the answer and full explanation for question #388. The question stem and answer options stay visible for context.
Question
While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers: C:>sc winternet.host.com create ncservicebinpath- "c:\tools\ncexe -I -p 2222 -e cmd.exe" C:>sc vJnternet.host.com query ncservice. What is the intent of the commands?
Options
- AThe first command creates a backdoor shell as a service. It is being started on TCP2222 using
- BThe first command creates a backdoor shell as a service. It is being started on UDP2222
- CThis creates a service called ncservice which is linked to the cmd.exe command andits
- DThe first command verifies the service is created and its status. The secondcommand creates
Unlock GPEN to see the answer
You've previewed enough free GPEN questions. Unlock GPEN for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.