Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

GIAC GCIH GIAC Certified Incident Handler Exam Practice Test

Page: 1 / 33
Total 328 questions

GIAC Certified Incident Handler Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses 'Faulkner' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone. Which of the following methods has the attacker used to crack Andrew's password?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Denial-of-service (DoS) attack

B.

Zero-day attack

C.

Brute force attack

D.

Social engineering

E.

Buffer-overflow attack

F.

Rainbow attack

G.

Password guessing

Question 2

You are hired as a Database Administrator for Jennifer Shopping Cart Inc. You monitor the server health through the System Monitor and found that there is a sudden increase in the number of logins.

Which of the following types of attack has occurred?

Options:

A.

Injection

B.

Virus

C.

Worm

D.

Denial-of-service

Question 3

Which of the following terms describes an attempt to transfer DNS zone data?

Options:

A.

Reconnaissance

B.

Encapsulation

C.

Dumpster diving

D.

Spam

Question 4

Which of the following malicious code can have more than one type of trigger, multiple task capabilities, and can replicate itself in more than one manner?

Options:

A.

Macro virus

B.

Blended threat

C.

Trojan

D.

Boot sector virus

Question 5

A user is sending a large number of protocol packets to a network in order to saturate its resources and to disrupt connections to prevent communications between services. Which type of attack is this?

Options:

A.

Vulnerability attack

B.

Impersonation attack

C.

Social Engineering attack

D.

Denial-of-Service attack

Question 6

You enter the netstat -an command in the command prompt and you receive intimation that port number 7777 is open on your computer. Which of the following Trojans may be installed on your computer?

Options:

A.

NetBus

B.

QAZ

C.

Donald Dick

D.

Tini

Question 7

Which of the following programs can be used to detect stealth port scans performed by a malicious hacker?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

nmap

B.

scanlogd

C.

libnids

D.

portsentry

Question 8

Which of the following viruses/worms uses the buffer overflow attack?

Options:

A.

Chernobyl (CIH) virus

B.

Nimda virus

C.

Klez worm

D.

Code red worm

Question 9

In which of the following attacks does the attacker gather information to perform an access attack?

Options:

A.

Land attack

B.

Reconnaissance attack

C.

Vulnerability attack

D.

DoS attack

Question 10

Mark works as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company uses Check Point SmartDefense to provide security to the network. Mark uses SmartDefense on the HTTP servers of the company to fix the limitation for the maximum response header length. Which of the following attacks can be blocked by defining this limitation?

Options:

A.

HTR Overflow worms and mutations

B.

Ramen worm attack

C.

Melissa virus attack

D.

Shoulder surfing attack

Question 11

Adam works as a Penetration Tester for Umbrella Inc. A project has been assigned to him check the security of wireless network of the company. He re-injects a captured wireless packet back onto the network. He does this hundreds of times within a second. The packet is correctly encrypted and Adam assumes it is an ARP request packet. The wireless host responds with a stream of responses, all individually encrypted with different IVs.

Which of the following types of attack is Adam performing?

Options:

A.

Replay attack

B.

MAC Spoofing attack

C.

Caffe Latte attack

D.

Network injection attack

Question 12

Which of the following statements about reconnaissance is true?

Options:

A.

It describes an attempt to transfer DNS zone data.

B.

It is a computer that is used to attract potential intruders or attackers.

C.

It is any program that allows a hacker to connect to a computer without going through the normal authentication process.

D.

It is also known as half-open scanning.

Question 13

Fill in the blank with the appropriate term.

______ is a free Unix subsystem that runs on top of Windows.

Options:

Question 14

Which of the following is a technique for creating Internet maps?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Active Probing

B.

AS PATH Inference

C.

Object Relational Mapping

D.

Network Quota

Question 15

You work as an Incident handling manager for a company. The public relations process of the company includes an event that responds to the e-mails queries. But since few days, it is identified that this process is providing a way to spammers to perform different types of e-mail attacks. Which of the following phases of the Incident handling process will now be involved in resolving this process and find a solution?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Eradication

B.

Contamination

C.

Preparation

D.

Recovery

E.

Identification

Question 16

Victor wants to send an encrypted message to his friend. He is using certain steganography technique to accomplish this task. He takes a cover object and changes it accordingly to hide information. This secret information is recovered only when the algorithm compares the changed cover with the original cover.

Which of the following Steganography methods is Victor using to accomplish the task?

Options:

A.

The distortion technique

B.

The spread spectrum technique

C.

The substitution technique

D.

The cover generation technique

Question 17

Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?

Options:

A.

Van Eck Phreaking

B.

Phreaking

C.

Biometrician

D.

Port scanning

Question 18

Which of the following types of attacks is the result of vulnerabilities in a program due to poor programming techniques?

Options:

A.

Evasion attack

B.

Denial-of-Service (DoS) attack

C.

Ping of death attack

D.

Buffer overflow attack

Question 19

You are responsible for security at a company that uses a lot of Web applications. You are most concerned about flaws in those applications allowing some attacker to get into your network. What method would be best for finding such flaws?

Options:

A.

Manual penetration testing

B.

Code review

C.

Automated penetration testing

D.

Vulnerability scanning

Question 20

You run the following bash script in Linux:

for i in 'cat hostlist.txt' ;do

nc -q 2 -v $i 80 < request.txt done

Where, hostlist.txt file contains the list of IP addresses and request.txt is the output file. Which of the following tasks do you want to perform by running this script?

Options:

A.

You want to put nmap in the listen mode to the hosts given in the IP address list.

B.

You want to perform banner grabbing to the hosts given in the IP address list.

C.

You want to perform port scanning to the hosts given in the IP address list.

D.

You want to transfer file hostlist.txt to the hosts given in the IP address list.

Question 21

Adam works as a Security Analyst for Umbrella Inc. Company has a Windows-based network. All computers run on Windows XP. Manager of the Sales department complains Adam about the unusual behavior of his computer. He told Adam that some pornographic contents are suddenly appeared on his computer overnight. Adam suspects that some malicious software or Trojans have been installed on the computer. He runs some diagnostics programs and Port scanners and found that the Port 12345, 12346, and 20034 are open. Adam also noticed some tampering with the Windows registry, which causes one application to run every time when Windows start.

Which of the following is the most likely reason behind this issue?

Options:

A.

Cheops-ng is installed on the computer.

B.

Elsave is installed on the computer.

C.

NetBus is installed on the computer.

D.

NetStumbler is installed on the computer.

Question 22

Fill in the blank with the appropriate term.

_______is the practice of monitoring and potentially restricting the flow of information outbound from one network to another

Options:

Question 23

Which of the following commands can be used for port scanning?

Options:

A.

nc -t

B.

nc -z

C.

nc -w

D.

nc -g

Question 24

Which of the following is a reason to implement security logging on a DNS server?

Options:

A.

For preventing malware attacks on a DNS server

B.

For measuring a DNS server's performance

C.

For monitoring unauthorized zone transfer

D.

For recording the number of queries resolved

Question 25

John works as a professional Ethical Hacker. He has been assigned a project to test the security of He performs Web vulnerability scanning on the We-are-secure server. The output of the scanning test is as follows:

C:\whisker.pl -h target_IP_address

-- whisker / v1.4.0 / rain forest puppy / www.wiretrip.net -- = - = - = - = - =

= Host: target_IP_address

= Server: Apache/1.3.12 (Win32) ApacheJServ/1.1

mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22

+ 200 OK: HEAD /cgi-bin/printenv

John recognizes /cgi-bin/printenv vulnerability ('Printenv' vulnerability) in the We_are_secure server. Which of the following statements about 'Printenv' vulnerability are true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

This vulnerability helps in a cross site scripting attack.

B.

'Printenv' vulnerability maintains a log file of user activities on the Website, which may be useful for the attacker.

C.

The countermeasure to 'printenv' vulnerability is to remove the CGI script.

D.

With the help of 'printenv' vulnerability, an attacker can input specially crafted links and/or other malicious scripts.

Question 26

Which of the following tools can be used to detect the steganography?

Options:

A.

Dskprobe

B.

Blindside

C.

ImageHide

D.

Snow

Question 27

Which of the following commands is used to access Windows resources from Linux workstation?

Options:

A.

mutt

B.

scp

C.

rsync

D.

smbclient

Question 28

Which of the following tools combines two programs, and also encrypts the resulting package in an attempt to foil antivirus programs?

Options:

A.

Trojan Man

B.

EliteWrap

C.

Tiny

D.

NetBus

Question 29

Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd.

Which of the following is the mostly likely the cause of the problem?

Options:

A.

Computer is infected with the stealth kernel level rootkit.

B.

Computer is infected with stealth virus.

C.

Computer is infected with the Stealth Trojan Virus.

D.

Computer is infected with the Self-Replication Worm.

Question 30

You work as a Network Administrator for InformSec Inc. You find that the TCP port number 23476 is open on your server. You suspect that there may be a Trojan named Donald Dick installed on your server. Now you want to verify whether Donald Dick is installed on it or not. For this, you want to know the process running on port 23476, as well as the process id, process name, and the path of the process on your server. Which of the following applications will you most likely use to accomplish the task?

Options:

A.

Tripwire

B.

SubSeven

C.

Netstat

D.

Fport

Question 31

Which of the following is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic?

Options:

A.

Klez

B.

Code red

C.

SQL Slammer

D.

Beast

Question 32

Which of the following functions can you use to mitigate a command injection attack?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

escapeshellarg()

B.

escapeshellcmd()

C.

htmlentities()

D.

strip_tags()

Question 33

Adam, a malicious hacker, wants to perform a reliable scan against a remote target. He is not concerned about being stealth at this point.

Which of the following type of scans would be most accurate and reliable?

Options:

A.

UDP sacn

B.

TCP Connect scan

C.

ACK scan

D.

Fin scan

Question 34

Your network is being flooded by ICMP packets. When you trace them down they come from multiple different IP addresses. What kind of attack is this?

Options:

A.

Syn flood

B.

Ping storm

C.

Smurf attack

D.

DDOS

Question 35

Which of the following attacks saturates network resources and disrupts services to a specific computer?

Options:

A.

Replay attack

B.

Teardrop attack

C.

Denial-of-Service (DoS) attack

D.

Polymorphic shell code attack

Question 36

Which of the following controls is described in the statement given below?

"It ensures that the enforcement of organizational security policy does not rely on voluntary web application user compliance. It secures information by assigning sensitivity labels on information and comparing this to the level of security a user is operating at."

Options:

A.

Role-based Access Control

B.

Attribute-based Access Control

C.

Discretionary Access Control

D.

Mandatory Access Control

Question 37

The IT administrator wants to implement a stronger security policy. What are the four most important security priorities for PassGuide Software Systems Pvt. Ltd.?

Options:

A.

Providing secure communications between the overseas office and the headquarters.

B.

Implementing Certificate services on Texas office.

C.

Protecting employee data on portable computers.

D.

Providing two-factor authentication.

E.

Ensuring secure authentication.

F.

Preventing unauthorized network access.

G.

Providing secure communications between Washington and the headquarters office.

Question 38

You are monitoring your network's behavior. You find a sudden increase in traffic on the network. It seems to come in bursts and emanate from one specific machine. You have been able to determine that a user of that machine is unaware of the activity and lacks the computer knowledge required to be responsible for a computer attack. What attack might this indicate?

Options:

A.

Spyware

B.

Ping Flood

C.

Denial of Service

D.

Session Hijacking

Question 39

Which of the following are based on malicious code?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Denial-of-Service (DoS)

B.

Biometrics

C.

Trojan horse

D.

Worm

Question 40

You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state.

Which of the following actions will you perform to accomplish the task?

Options:

A.

Use the Virtualization Management Console to save the state of the virtual machine.

B.

Log on to the virtual host and create a new dynamically expanding virtual hard disk.

C.

Use the Virtualization Management Console to create a snapshot of the virtual machine.

D.

Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.

Question 41

Maria works as a professional Ethical Hacker. She has been assigned the project of testing the security of She is using dumpster diving to gather information about Gentech Inc.

In which of the following steps of malicious hacking does dumpster diving come under?

Options:

A.

Multi-factor authentication

B.

Role-based access control

C.

Mutual authentication

D.

Reconnaissance

Question 42

Which of the following types of attacks slows down or stops a server by overloading it with requests?

Options:

A.

DoS attack

B.

Impersonation attack

C.

Network attack

D.

Vulnerability attack

Question 43

US Garments wants all encrypted data communication between corporate office and remote location.

They want to achieve following results:

l Authentication of users

l Anti-replay

l Anti-spoofing

l IP packet encryption

They implemented IPSec using Authentication Headers (AHs). Which results does this solution provide?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Anti-replay

B.

IP packet encryption

C.

Authentication of users

D.

Anti-spoofing

Question 44

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer.

After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting.

for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done

Which of the following actions does Adam want to perform by the above command?

Options:

A.

Infecting the hard disk with polymorphic virus strings.

B.

Deleting all log files present on the system.

C.

Wiping the contents of the hard disk with zeros.

D.

Making a bit stream copy of the entire hard disk for later download.

Question 45

Which of the following statements about threats are true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

A threat is a weakness or lack of safeguard that can be exploited by vulnerability, thus causing harm to the information systems or networks.

B.

A threat is a potential for violation of security which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.

C.

A threat is a sequence of circumstances and events that allows a human or other agent to cause an information-related misfortune by exploiting vulnerability in an IT product.

D.

A threat is any circumstance or event with the potential of causing harm to a system in the form of destruction, disclosure, modification of data, or denial of service.

Question 46

You run the following PHP script:

<?php $name = mysql_real_escape_string($_POST["name"]);

$password = mysql_real_escape_string($_POST["password"]); ?>

What is the use of the mysql_real_escape_string() function in the above script.

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It can be used to mitigate a cross site scripting attack.

B.

It can be used as a countermeasure against a SQL injection attack.

C.

It escapes all special characters from strings $_POST["name"] and $_POST["password"] except ' and ".

D.

It escapes all special characters from strings $_POST["name"] and $_POST["password"].

Question 47

Which of the following IP packet elements is responsible for authentication while using IPSec?

Options:

A.

Authentication Header (AH)

B.

Layer 2 Tunneling Protocol (L2TP)

C.

Internet Key Exchange (IKE)

D.

Encapsulating Security Payload (ESP)

Question 48

Which of the following attacks capture the secret value like a hash and reuse it later to gain access to a system without ever decrypting or decoding the hash?

Options:

A.

Cross Site Scripting attack

B.

Replay attack

C.

Rainbow attack

D.

Hashing attack

Question 49

Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

Options:

A.

Signature-based IDS

B.

Network-based IDS

C.

Passive IDS

D.

Active IDS

Page: 1 / 33
Total 328 questions