[Full-Version] 2023 Updated GIAC Study Guide GCIH Dumps Questions [Q93-Q114]

4.7/5 - (10 votes)

[Full-Version] 2023 Updated GIAC Study Guide GCIH Dumps Questions

Newest GCIH Exam Dumps Achieve Success in Actual GCIH Exam

GIAC GCIH certification is recognized worldwide by leading organizations in the industry, including government agencies, military organizations, and private companies. It is widely regarded as a benchmark for incident handling and response skills, and it can help individuals advance their careers in the field of information security. The certification is valid for four years, and candidates must recertify by passing a current version of the exam or by earning continuing education credits.

NEW QUESTION 93
Which of the following IP packet elements is responsible for authentication while using IPSec?

Authentication Header (AH)

Layer 2 Tunneling Protocol (L2TP)

Internet Key Exchange (IKE)

Encapsulating Security Payload (ESP)

NEW QUESTION 94
You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state.
Which of the following actions will you perform to accomplish the task?

Use the Virtualization Management Console to save the state of the virtual machine.

Log on to the virtual host and create a new dynamically expanding virtual hard disk.

Use the Virtualization Management Console to create a snapshot of the virtual machine.

Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.

NEW QUESTION 95
Fill in the blank with the appropriate term.
______ is a technique used to make sure that incoming packets are actually from the networks that they claim to be from.

NEW QUESTION 96
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of
whether the port is open or closed?

TCP FIN

FTP bounce

XMAS

TCP SYN

NEW QUESTION 97
Which of the following tools uses common UNIX/Linux tools like the strings and grep commands to search core system programs for signatures of the rootkits?

rkhunter

OSSEC

chkrootkit

Blue Pill

NEW QUESTION 98
Which of the following attacks capture the secret value like a hash and reuse it later to gain access to a system without ever decrypting or decoding the hash?

Cross Site Scripting attack

Replay attack

Rainbow attack

Hashing attack

NEW QUESTION 99
Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. What steps can be used as a countermeasure of ARP spoofing?
Each correct answer represents a complete solution. Choose all that apply.

Using smash guard utility

Using ARP Guard utility

Using static ARP entries on servers, workstation and routers

Using ARP watch utility

Using IDS Sensors to check continually for large amount of ARP traffic on local subnets

NEW QUESTION 100
In which of the following methods does an hacker use packet sniffing to read network traffic between two parties to steal the session cookies?

Cross-site scripting

Physical accessing

Session fixation

Session sidejacking

NEW QUESTION 101
Which of the following is a reason to implement security logging on a DNS server?

For preventing malware attacks on a DNS server

For measuring a DNS server’s performance

For monitoring unauthorized zone transfer

For recording the number of queries resolved

NEW QUESTION 102
The IT administrator wants to implement a stronger security policy. What are the four most important security
priorities for PassGuide Software Systems Pvt. Ltd.?
(Click the Exhibit button on the toolbar to see the case study.)

Providing secure communications between the overseas office and the headquarters.

Implementing Certificate services on Texas office.

Protecting employee data on portable computers.

Providing two-factor authentication.

Ensuring secure authentication.

Preventing unauthorized network access.

Providing secure communications between Washington and the headquarters office.

Preventing denial-of-service attacks.

NEW QUESTION 103
TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.
Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

nmap -sS

nmap -sU -p

nmap -O -p

nmap -sT

NEW QUESTION 104
Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network
security of the company. He created a webpage to discuss the progress of the tests with employees who were
interested in following the test. Visitors were allowed to click on a company’s icon to mark the progress of the test.
Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the
network well and allows strict Internet access.
How was security compromised and how did the firewall respond?

The attack was social engineering and the firewall did not detect it.

Security was not compromised as the webpage was hosted internally.

The attack was Cross Site Scripting and the firewall blocked it.

Security was compromised as keylogger is invisible for firewall.

NEW QUESTION 105
Which of the following types of attacks is mounted with the objective of causing a negative impact on the
performance of a computer or network?

Vulnerability attack

Man-in-the-middle attack

Denial-of-Service (DoS) attack

Impersonation attack

NEW QUESTION 106
Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a company’s icon to mark the progress of the test. Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access.
How was security compromised and how did the firewall respond?

The attack was social engineering and the firewall did not detect it.

Security was not compromised as the webpage was hosted internally.

The attack was Cross Site Scripting and the firewall blocked it.

Security was compromised as keylogger is invisible for firewall.

NEW QUESTION 107
Maria works as a professional Ethical Hacker. She is assigned a project to test the security of www.we-are-secure.com.
She wants to test a DoS attack on the We-are-secure server. She finds that the firewall of the server is blocking the
ICMP messages, but it is not checking the UDP packets. Therefore, she sends a large amount of UDP echo request
traffic to the IP broadcast addresses. These UDP requests have a spoofed source address of the We-are-secure server.
Which of the following DoS attacks is Maria using to accomplish her task?

Ping flood attack

Fraggle DoS attack

Teardrop attack

Smurf DoS attack

NEW QUESTION 108
Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of the marketing department has been affected by a malicious hacking attack. Supervisors are also claiming that some sensitive data are also stolen.
Adam immediately arrived to the server room of the marketing department and identified the event as an incident. He isolated the infected network from the remaining part of the network and started preparing to image the entire system. He captures volatile data, such as running process, ram, and network connections.
Which of the following steps of the incident handling process is being performed by Adam?

Recovery

Eradication

Identification

Containment

NEW QUESTION 109
Which of the following statements are true about worms?
Each correct answer represents a complete solution. Choose all that apply.

Worms cause harm to the network by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

Worms can exist inside files such as Word or Excel documents.

One feature of worms is keystroke logging.

Worms replicate themselves from one system to another without using a host file.

NEW QUESTION 110
Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:
C:WINDOWS>netstat -an | find “UDP” UDP IP_Address:31337 *:*
Now you check the following registry address:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices In the above address, you notice a ‘default’ key in the ‘Name’ field having ” .exe” value in the corresponding ‘Data’ field. Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?

Qaz

Donald Dick

Tini

Back Orifice

NEW QUESTION 111
Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web
server of the company runs on Apache. He has downloaded sensitive documents and database files from the
computer.
After performing these malicious tasks, Adam finally runs the following command on the Linux command box before
disconnecting.
for (( i = 0;i<11;i++ )); do
dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done
Which of the following actions does Adam want to perform by the above command?

Infecting the hard disk with polymorphic virus strings.

Deleting all log files present on the system.

Wiping the contents of the hard disk with zeros.

Making a bit stream copy of the entire hard disk for later download.

NEW QUESTION 112
You work as a System Engineer for Cyber World Inc. Your company has a single Active Directory domain. All servers in
the domain run Windows Server 2008. The Microsoft Hyper-V server role has been installed on one of the servers,
namely uC1. uC1 hosts twelve virtual machines. You have been given the task to configure the Shutdown option for
uC1, so that each virtual machine shuts down before the main Hyper-V server shuts down. Which of the following
actions will you perform to accomplish the task?

Enable the Shut Down the Guest Operating System option in the Automatic Stop Action Properties on each virtual
machine.

Manually shut down each of the guest operating systems before the server shuts down.

Create a batch file to shut down the guest operating system before the server shuts down.

Create a logon script to shut down the guest operating system before the server shuts down.

NEW QUESTION 113
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?

TCP FIN

FTP bounce

XMAS

TCP SYN

NEW QUESTION 114
John works as a Network Security Professional. He is assigned a project to test the security of www.we-are-secure.com. He establishes a connection to a target host running a Web service with netcat and sends a bad html request in order to retrieve information about the service on the host.

Which of the following attacks is John using?