GIAC GIAC Information Security GCIH Questions & Answers

• Question 41:

  What is the definition of an event as it applies to incident handling?

  A. Any observable occurrence in a system and/or network

  B. The introduction of malicious code into your network

  C. Something that triggers an alert from your Intrusion Detection System

  D. An adverse occurrence in an information system and/or network or the threat of such an occurrence

  Correct Answer: A

  Reference: https://www.sans.org/reading-room/whitepapers/incident/events-incidents-646 (3)

• Question 42:

  Analyze the data shown below. Where does this data originate from?

  

  A. Established connections

  B. Routing table

  C. ARP cache

  D. Network interfaces

  Correct Answer: C

  Reference: https://petri.com/csc_arp_cache

• Question 43:

  Which volatility plugin shows the command line path for a recently launched application?

  A. hivelist

  B. dlllist

  C. pslist

  D. netscan

  Correct Answer: D

• Question 44:

  Which of the following actions can prevent the successful use of Metasploit against a Windows host?

  A. Deploying User and Entity Behavior Analytics (UEBA) tools

  B. Using the Microsoft Anti-Cross Site Scripting Library

  C. Deploying controls on what applications are allowed to run

  D. Tracking UserIDs for unsuccessful login attempts

  Correct Answer: C

• Question 45:

  Which UNIX log file contains information about currently logged in users?

  A. wtmp

  B. btmp

  C. utmp

  D. lastlog

  Correct Answer: A

  Reference: https://www.cyberciti.biz/faq/unix-linux-list-current-logged-in-users/

• Question 46:

  What is the goal of the command sequence shown below? >nslookup

  >server [authoritative_server_IP_or_name]

  >set type=any

  >ls -d [target_domain]

  A. Arp Spoofing

  B. Zone Transfer

  C. DNS Cache Poisoning

  D. IP Spoofing

  Correct Answer: B

• Question 47:

  What can be used to link UNIX authentication with other mechanisms?

  A. SYSKEY

  B. PAM

  C. S/KEY

  D. Shadow

  Correct Answer: B

  Reference: https://www.oreilly.com/library/view/linux-server-hacks/0596100825/ch01.html

• Question 48:

  Which of the following Metasploit tools will generate a payload that can be introduced to a Windows system as shown in the image?

  

  A. Msfvenom

  B. Msfd

  C. Msfrpc

  D. Msfconsole

  Correct Answer: D

  Reference: https://www.varonis.com/blog/what-is-metasploit/

• Question 49:

  Which of the following statements describes the data below from volatility's pstree plugin?

  

  A. Cmd.exe was the child process of OneDrive.exe

  B. Chrmstp.exe was launched by MSASCuiL.exe

  C. Explorer.exe was the parent process for firefox.exe

  D. Notepad.exe was launched with Administrative privileges

  Correct Answer: B

• Question 50:

  What is the result of unloading a process' forward and backwards links in memory?

  A. The process is hidden from the operating system

  B. Analysis tools cannot find the process when scanning memory

  C. The process owner is elevated to SYSTEM permissions

  D. The application crashes

  Correct Answer: D