GIAC GIAC Information Security GCIH Questions & Answers

• Question 691:

  John works as a Professional Penetration Tester. He has been assigned a project to test the Website security of www.we-are-secure Inc. On the We-are-secure Website login page, he enters ='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-aresecure Inc. to improve the login page PHP script. Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

  A. Use the escapeshellarg() function

  B. Use the session_regenerate_id() function

  C. Use the mysql_real_escape_string() function for escaping input

  D. Use the escapeshellcmd() function

  Correct Answer: C

• Question 692:

  You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network. An attacker uses software that keeps trying password combinations until the correct password is found. Which type of attack is this?

  A. Denial-of-Service

  B. Man-in-the-middle

  C. Brute Force

  D. Vulnerability

  Correct Answer: C

• Question 693:

  You want to scan your network quickly to detect live hosts by using ICMP ECHO Requests. What type of scanning will you perform to accomplish the task?

  A. Idle scan

  B. TCP SYN scan

  C. XMAS scan

  D. Ping sweep scan

  Correct Answer: D

• Question 694:

  Adam, a malicious hacker is running a scan. Statistics of the scan is as follows:

  Scan directed at open port: ClientServer

  192.5.2.92:4079 ---------FIN--------->192.5.2.110:23192.5.2.92:4079 <----NO RESPONSE-----192.5.2.110:23 Scan directed at closed port: ClientServer 192.5.2.92:4079 ---------FIN--------->192.5.2.110:23 192.5.2.92:4079<-----RST/ACK----------192.5.2.110:23

  Which of the following types of port scan is Adam running?

  A. ACK scan

  B. FIN scan

  C. XMAS scan

  D. Idle scan

  Correct Answer: B

• Question 695:

  Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?

  A. Win32/Agent

  B. WMA/TrojanDownloader.GetCodec

  C. Win32/Conflicker

  D. Win32/PSW.OnLineGames

  Correct Answer: C

• Question 696:

  Which of the following statements are true about netcat?

  Each correct answer represents a complete solution. (Choose all that apply.)

  A. It provides special tunneling, such as UDP to TCP, with the possibility of specifying all network parameters.

  B. It can be used as a file transfer solution.

  C. It provides outbound and inbound connections for TCP and UDP ports.

  D. The nc -z command can be used to redirect stdin/stdout from a program.

  Correct Answer: ABC

• Question 697:

  Which of the following types of attacks is mounted with the objective of causing a negative impact on the performance of a computer or network?

  A. Vulnerability attack

  B. Man-in-the-middle attack

  C. Denial-of-Service (DoS) attack

  D. Impersonation attack

  Correct Answer: C

• Question 698:

  Which of the following refers to the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system?

  A. Piggybacking

  B. Hacking

  C. Session hijacking

  D. Keystroke logging

  Correct Answer: C

• Question 699:

  Which of the following malicious software travels across computer networks without the assistance of a user?

  A. Worm

  B. Virus

  C. Hoax

  D. Trojan horses

  Correct Answer: A

• Question 700:

  What is the major difference between a worm and a Trojan horse?

  A. A worm spreads via e-mail, while a Trojan horse does not.

  B. A worm is a form of malicious program, while a Trojan horse is a utility.

  C. A worm is self replicating, while a Trojan horse is not.

  D. A Trojan horse is a malicious program, while a worm is an anti-virus software.

  Correct Answer: C