Skip to main content

GCIH Online Exam

GIAC Certified Incident Handler (GCIH)

705 questions available ยท Page 1 of 71

View study plans
Question 1 Single choice

What is an alternate data stream?

  1. A

    A file stream on an NTFS partition

  2. B

    Encoded text within an image file

  3. C

    The Volume Shadow Copy version of a file

  4. D

    A secondary file stream on a FAT partition

Show answer and explanation

Correct answer: A

Explanation

References:
https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/

Question 2 Single choice

How would an attacker hide an executable from being viewed by Windows Explorer?

  1. A

    Rename it to `.. `

  2. B

    Change the extension from .exe to .dll

  3. C

    Encrypt it with RC4

  4. D

    Place it into an ADS of a .txt file

Show answer and explanation

Correct answer: B

Explanation

References:
https://www.bleepingcomputer.com/news/microsoft/hiding-windows-file-extensions-is-a-security-risk-enable-now/

Question 3 Single choice

When switching traffic on a LAN, what element of the Ethernet frame does a switch use to make its decision on where to send the data?

  1. A

    Destination IP address

  2. B

    Destination MAC address

  3. C

    Destination ARP response

  4. D

    Source DHCP packet

Show answer and explanation

Correct answer: B

Explanation

References:
https://www.oreilly.com/library/view/ethernet-switches/9781449367299/ch01.html

Question 4 Single choice

Which of the following Volatility commands will display the date and time an image was collected?

  1. A

    python vol.py -f Win2k12x64.vmsn --profile=Win2012R2x64 --kdbg=0xf800f17dd9b0 timeliner --
    type=_CMHIVE

  2. B

    python vol.py -f ~/Desktop/win7_trial_64bit.raw imageinfo

  3. C

    python vol.py -f ~/Desktop/win7_trial_64bit.raw --profile=Win7SP0x64 printkey -K "Microsoft\Security
    Center\Svc"

  4. D

    python vol.py -f win7.vmem --profile=Win7SP0x86 userassist

Show answer and explanation

Correct answer: A

Explanation

References:
https://www.andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/

Question 5 Single choice

What information will be returned when an administrator executes the command below?

# last -f /var/log/btmp

  1. A

    See successful logins

  2. B

    Erase bash history

  3. C

    Delete failed login logs

  4. D

    See failed logins

Show answer and explanation

Correct answer: D

Explanation

References:
http://log0ymxm.github.io/slcc-eportfolio/su13-cs-1032-001-walsh/linux-notes/071-common-log-files.html

Question 6 Single choice

During the identification phase of a Web server compromise, you notice the following entries in the web server logs.
If "admin" is a valid username, but its corresponding password is not "pass1", and "root" is not a valid username, what can you infer solely from these logs?

  1. A

    This is a web spidering attack using wget

  2. B

    This is an account harvesting attack

  3. C

    This is a session hijacking attack

  4. D

    This is a password brute-forcing attack

Show answer and explanation

Correct answer: D

Question 7 Single choice

What is the goal of an attacker who has entered the commands shown in the screenshot?

  1. A

    Enumerate listening ports on the target machine

  2. B

    Create a mountable snapshot to access older versions of the filesystem

  3. C

    Gather password and hash data for off-line cracking

  4. D

    Corrupt system backups

Show answer and explanation

Correct answer: C

Question 8 Single choice

Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters?

tcpdump -nn -r pingout.pcap `icmp and (dst host 8.8.8.8)'

  1. A

    09:31:00.928389 IP 192.168.1.14.63263 > 8.8.8.8.33595: UDP, length 24

  2. B

    08:54:07.451392 IP 8.8.8.8 > 192.168.1.14: ICMP echo reply, id 36234, seq 3, length 64

  3. C

    09:06:09.085200 IP 192.168.1.14.49655 > 8.8.8.8.22: Flags [S], seq 2144394082, win 65535, options
    [mss 1460,sackOK,eol], length 0

  4. D

    08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64

Show answer and explanation

Correct answer: A

Question 9 Single choice

What is one of the simplest AND most common ways for an attacker to camouflage files on a UNIX system?

  1. A

    Use S-Tools to embed the files into a graphic image

  2. B

    Run "chmod 600" on the files to be hidden

  3. C

    Use a dot-space or dot-dot-space as the file or directory name

  4. D

    Insert the data into an alternate data stream using the colon (:)

  5. E

    Install a kernel-level rootkit

Show answer and explanation

Correct answer: E

Explanation

References:
https://www.sciencedirect.com/topics/computer-science/rootkits

Question 10 Single choice

Which file contains information about failed login attempts on a Unix system?

  1. A

    ctmp

  2. B

    wtmp

  3. C

    btmp

  4. D

    utmp

Show answer and explanation

Correct answer: B

Explanation

References:
https://www.thegeekdiary.com/how-to-check-failed-or-bad-login-attempts-in-linux/