Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

GIAC GCIH GIAC Certified Incident Handler Exam Practice Test

Demo: 49 questions
Total 328 questions

GIAC Certified Incident Handler Questions and Answers

Question 1

You see the career section of a company's Web site and analyze the job profile requirements. You conclude that the company wants professionals who have a sharp knowledge of Windows server 2003 and Windows active directory installation and placement. Which of the following steps are you using to perform hacking?

Options:

A.

Scanning

B.

Covering tracks

C.

Reconnaissance

D.

Gaining access

Question 2

Which of the following statements are true about firewalking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall.

B.

In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall.

C.

A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall.

D.

Firewalking works on the UDP packets.

Question 3

What is the major difference between a worm and a Trojan horse?

Options:

A.

A worm spreads via e-mail, while a Trojan horse does not.

B.

A worm is a form of malicious program, while a Trojan horse is a utility.

C.

A worm is self replicating, while a Trojan horse is not.

D.

A Trojan horse is a malicious program, while a worm is an anti-virus software.

Question 4

Which of the following applications is an example of a data-sending Trojan?

Options:

A.

SubSeven

B.

Senna Spy Generator

C.

Firekiller 2000

D.

eBlaster

Question 5

Which of the following characters will you use to check whether an application is vulnerable to an SQL injection attack?

Options:

A.

Dash (-)

B.

Double quote (")

C.

Single quote (')

D.

Semi colon (;)

Question 6

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. On the We-are-secure login page, he enters ='or''=' as a username and successfully logs in to the user page of the Web site.

The we-are-secure login page is vulnerable to a __________.

Options:

A.

Dictionary attack

B.

SQL injection attack

C.

Replay attack

D.

Land attack

Question 7

Adam, a malicious hacker, wants to perform a reliable scan against a remote target. He is not concerned about being stealth at this point.

Which of the following type of scans would be most accurate and reliable?

Options:

A.

UDP sacn

B.

TCP Connect scan

C.

ACK scan

D.

Fin scan

Question 8

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str).

What attack will his program expose the Web application to?

Options:

A.

Format string attack

B.

Cross Site Scripting attack

C.

SQL injection attack

D.

Sequence++ attack

Question 9

Which of the following are types of access control attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Spoofing

B.

Brute force attack

C.

Dictionary attack

D.

Mail bombing

Question 10

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options:

A.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup

B.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

C.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

D.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

Question 11

Which of the following takes control of a session between a server and a client using TELNET, FTP, or any other non-encrypted TCP/IP utility?

Options:

A.

Dictionary attack

B.

Session Hijacking

C.

Trojan horse

D.

Social Engineering

Question 12

Which of the following statements about buffer overflow is true?

Options:

A.

It manages security credentials and public keys for message encryption.

B.

It is a collection of files used by Microsoft for software updates released between major service pack releases.

C.

It is a condition in which an application receives more data than it is configured to accept.

D.

It is a false warning about a virus.

Question 13

Which of the following is designed to protect the Internet resolvers (clients) from forged DNS data created by DNS cache poisoning?

Options:

A.

Stub resolver

B.

BINDER

C.

Split-horizon DNS

D.

Domain Name System Extension (DNSSEC)

Question 14

Jason, a Malicious Hacker, is a student of Baker university. He wants to perform remote hacking on the server of DataSoft Inc. to hone his hacking skills. The company has a Windows-based network. Jason successfully enters the target system remotely by using the advantage of vulnerability. He places a Trojan to maintain future access and then disconnects the remote session. The employees of the company complain to Mark, who works as a Professional Ethical Hacker for DataSoft Inc., that some computers are very slow. Mark diagnoses the network and finds that some irrelevant log files and signs of Trojans are present on the computers. He suspects that a malicious hacker has accessed the network. Mark takes the help from Forensic Investigators and catches Jason.

Which of the following mistakes made by Jason helped the Forensic Investigators catch him?

Options:

A.

Jason did not perform a vulnerability assessment.

B.

Jason did not perform OS fingerprinting.

C.

Jason did not perform foot printing.

D.

Jason did not perform covering tracks.

E.

Jason did not perform port scanning.

Question 15

Which of the following is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic?

Options:

A.

Klez

B.

Code red

C.

SQL Slammer

D.

Beast

Question 16

Which of the following functions can you use to mitigate a command injection attack?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

escapeshellarg()

B.

escapeshellcmd()

C.

htmlentities()

D.

strip_tags()

Question 17

Which of the following is the best method of accurately identifying the services running on a victim host?

Options:

A.

Use of the manual method of telnet to each of the open ports.

B.

Use of a port scanner to scan each port to confirm the services running.

C.

Use of hit and trial method to guess the services and ports of the victim host.

D.

Use of a vulnerability scanner to try to probe each port to verify which service is running.

Question 18

Which of the following can be used to perform session hijacking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Cross-site scripting

B.

Session fixation

C.

ARP spoofing

D.

Session sidejacking

Question 19

In which of the following steps of the incident handling processes does the Incident Handler make sure that all business processes and functions are back to normal and then also wants to monitor the system or processes to ensure that the system is not compromised again?

Options:

A.

Eradication

B.

Lesson Learned

C.

Recovery

D.

Containment

Question 20

You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables and an appropriate policy that will be decided by you. Which of the following stages in the Incident handling process involves your decision making?

Options:

A.

Identification

B.

Containment

C.

Eradication

D.

Preparation

Question 21

Rick works as a Computer Forensic Investigator for BlueWells Inc. He has been informed that some confidential information is being leaked out by an employee of the company. Rick suspects that someone is sending the information through email. He checks the emails sent by some employees to other networks. Rick finds out that Sam, an employee of the Sales department, is continuously sending text files that contain special symbols, graphics, and signs. Rick suspects that Sam is using the Steganography technique to send data in a disguised form. Which of the following techniques is Sam using?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Linguistic steganography

B.

Perceptual masking

C.

Technical steganography

D.

Text Semagrams

Question 22

Against which of the following does SSH provide protection?

Each correct answer represents a complete solution. Choose two.

Options:

A.

DoS attack

B.

IP spoofing

C.

Password sniffing

D.

Broadcast storm

Question 23

Which of the following systems is used in the United States to coordinate emergency preparedness and incident management among various federal, state, and local agencies?

Options:

A.

US Incident Management System (USIMS)

B.

National Disaster Management System (NDMS)

C.

National Emergency Management System (NEMS)

D.

National Incident Management System (NIMS)

Question 24

Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?

Options:

A.

Van Eck Phreaking

B.

Phreaking

C.

Biometrician

D.

Port scanning

Question 25

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

Options:

A.

Shoulder surfing

B.

File integrity auditing

C.

Reconnaissance

D.

Spoofing

Question 26

Which of the following types of malware can an antivirus application disable and destroy?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Rootkit

B.

Trojan

C.

Crimeware

D.

Worm

E.

Adware

F.

Virus

Question 27

Which of the following rootkits is used to attack against full disk encryption systems?

Options:

A.

Boot loader rootkit

B.

Library rootkit

C.

Hypervisor rootkit

D.

Kernel level rootkit

Question 28

Adam works as a Penetration Tester for Umbrella Inc. A project has been assigned to him check the security of wireless network of the company. He re-injects a captured wireless packet back onto the network. He does this hundreds of times within a second. The packet is correctly encrypted and Adam assumes it is an ARP request packet. The wireless host responds with a stream of responses, all individually encrypted with different IVs.

Which of the following types of attack is Adam performing?

Options:

A.

Replay attack

B.

MAC Spoofing attack

C.

Caffe Latte attack

D.

Network injection attack

Question 29

John works as a Penetration Tester in a security service providing firm named you-are-secure Inc. Recently, John's company has got a project to test the security of a promotional Website www.missatlanta.com and assigned the pen-testing work to John. When John is performing penetration testing, he inserts the following script in the search box at the company home page:

<script>alert('Hi, John')</script>

After pressing the search button, a pop-up box appears on his screen with the text - "Hi, John." Which of the following attacks can be performed on the Web site tested by john while considering the above scenario?

Options:

A.

Replay attack

B.

CSRF attack

C.

Buffer overflow attack

D.

XSS attack

Question 30

Which of the following tools will you use to prevent from session hijacking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

OpenSSH

B.

Rlogin

C.

Telnet

D.

SSL

Question 31

Which of the following rootkits patches, hooks, or replaces system calls with versions that hide information about the attacker?

Options:

A.

Library rootkit

B.

Kernel level rootkit

C.

Hypervisor rootkit

D.

Boot loader rootkit

Question 32

You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux-based server. Recently, you have updated the password policy of the company in which the server will disable passwords after four trials. What type of attack do you want to stop by enabling this policy?

Options:

A.

Brute force

B.

Replay

C.

XSS

D.

Cookie poisoning

Question 33

Which of the following statements are true about Dsniff?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It contains Trojans.

B.

It is a virus.

C.

It is antivirus.

D.

It is a collection of various hacking tools.

Question 34

Which of the following US Acts emphasized a "risk-based policy for cost-effective security" and makes mandatory for agency program officials, chief information officers, and inspectors general (IGs) to conduct annual reviews of the agency's information security program and report the results to Office of Management and Budget?

Options:

A.

The Electronic Communications Privacy Act of 1986 (ECPA)

B.

The Fair Credit Reporting Act (FCRA)

C.

The Equal Credit Opportunity Act (ECOA)

D.

Federal Information Security Management Act of 2002 (FISMA)

Question 35

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Whisker

B.

Fragroute

C.

Nessus

D.

Y.A.T.

Question 36

Which of the following attacks allows an attacker to retrieve crucial information from a Web server's database?

Options:

A.

Database retrieval attack

B.

PHP injection attack

C.

SQL injection attack

D.

Server data attack

Question 37

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.weare-secure.com. He installs a rootkit on the Linux server of the We-are-secure network. Which of the following statements are true about rootkits?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

They allow an attacker to conduct a buffer overflow.

B.

They allow an attacker to set a Trojan in the operating system and thus open a backdoor for anytime access.

C.

They allow an attacker to replace utility programs that can be used to detect the attacker's activity.

D.

They allow an attacker to run packet sniffers secretly to capture passwords.

Question 38

You have forgotten your password of an online shop. The web application of that online shop asks you to enter your email so that they can send you a new password. You enter your email

you@gmail.com

And press the submit button.

The Web application displays the server error. What can be the reason of the error?

Options:

A.

You have entered any special character in email.

B.

Email entered is not valid.

C.

The remote server is down.

D.

Your internet connection is slow.

Question 39

In which of the following attacks does an attacker use packet sniffing to read network traffic between two parties to steal the session cookie?

Options:

A.

Session fixation

B.

Cross-site scripting

C.

Session sidejacking

D.

ARP spoofing

Question 40

A Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance of a computer or network. It is also known as network saturation attack or bandwidth consumption attack. Attackers perform DoS attacks by sending a large number of protocol packets to a network. The problems caused by a DoS attack are as follows:

l Saturation of network resources

l Disruption of connections between two computers, thereby preventing communications between services

l Disruption of services to a specific computer

l Failure to access a Web site

l Increase in the amount of spam

Which of the following can be used as countermeasures against DoS attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Blocking undesired IP addresses

B.

Applying router filtering

C.

Disabling unneeded network services

D.

Permitting network access only to desired traffic

Question 41

You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state.

Which of the following actions will you perform to accomplish the task?

Options:

A.

Use the Virtualization Management Console to save the state of the virtual machine.

B.

Log on to the virtual host and create a new dynamically expanding virtual hard disk.

C.

Use the Virtualization Management Console to create a snapshot of the virtual machine.

D.

Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.

Question 42

Which of the following programs is used for bypassing normal authentication for securing remote access to a computer?

Options:

A.

Backdoor

B.

Worm

C.

Adware

D.

Spyware

Question 43

Which of the following types of scan does not open a full TCP connection?

Options:

A.

FIN scan

B.

ACK scan

C.

Stealth scan

D.

Idle scan

Question 44

Which of the following types of attacks come under the category of hacker attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Smurf

B.

IP address spoofing

C.

Teardrop

D.

Password cracking

Question 45

John is a malicious attacker. He illegally accesses the server of We-are-secure Inc. He then places a backdoor in the We-are-secure server and alters its log files. Which of the following steps of malicious hacking includes altering the server log files?

Options:

A.

Maintaining access

B.

Covering tracks

C.

Gaining access

D.

Reconnaissance

Question 46

You work as an Incident handler in Mariotrixt.Inc. You have followed the Incident handling process to handle the events and incidents. You identify Denial of Service attack (DOS) from a network linked to your internal enterprise network. Which of the following phases of the Incident handling process should you follow next to handle this incident?

Options:

A.

Containment

B.

Preparation

C.

Recovery

D.

Identification

Question 47

Which of the following is a method of gaining access to a system that bypasses normal authentication?

Options:

A.

Teardrop

B.

Trojan horse

C.

Back door

D.

Smurf

Question 48

Which of the following practices come in the category of denial of service attack?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Performing Back door attack on a system

B.

Disrupting services to a specific computer

C.

Sending thousands of malformed packets to a network for bandwidth consumption

D.

Sending lots of ICMP packets to an IP address

Question 49

Which of the following statements about buffer overflow are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is a situation that occurs when a storage device runs out of space.

B.

It is a situation that occurs when an application receives more data than it is configured to accept.

C.

It can improve application performance.

D.

It can terminate an application.

Demo: 49 questions
Total 328 questions