Free Sales Ending Soon - Use Real GCIH PDF Questions [Nov 30, 2023]
Updated Nov-2023 Exam GCIH Dumps - Pass Your Certification Exam
The GCIH certification exam is a comprehensive test that covers a wide range of topics related to incident handling and response. It covers topics such as network security, malware analysis, incident response planning, risk management, and digital forensics. GCIH exam consists of 150 multiple-choice questions and candidates are given four hours to complete the exam. GIAC Certified Incident Handler certification program also requires candidates to complete a proctored exam at one of GIAC's testing centers.
NEW QUESTION # 70
SIMULATION
Fill in the blank with the correct numeric value.
ARP poisoning is achieved in ______ steps.
Answer:
Explanation:
2
NEW QUESTION # 71
In the DNS Zone transfer enumeration, an attacker attempts to retrieve a copy of the entire zone file for a domain from a DNS server. The information provided by the DNS zone can help an attacker gather user names, passwords, and other valuable information. To attempt a zone transfer, an attacker must be connected to a DNS server that is the authoritative server for that zone. Besides this, an attacker can launch a Denial of Service attack against the zone's DNS servers by flooding them with a lot of requests. Which of the following tools can an attacker use to perform a DNS zone transfer?
Each correct answer represents a complete solution. Choose all that apply.
- A. DSniff
- B. Dig
- C. Host
- D. NSLookup
Answer: B,C,D
Explanation:
Section: Volume B
NEW QUESTION # 72
Which of the following tasks can be performed by using netcat utility?
Each correct answer represents a complete solution. Choose all that apply.
- A. Firewall testing
- B. Checking file integrity
- C. Creating a Backdoor
- D. Port scanning and service identification
Answer: A,C,D
NEW QUESTION # 73
John works as an Ethical Hacker for PassGuide Inc. He wants to find out the ports that are open in PassGuide's server using a port scanner. However, he does not want to establish a full TCP connection.
Which of the following scanning techniques will he use to accomplish this task?
- A. TCP SYN
- B. TCP FIN
- C. Xmas tree
- D. TCP SYN/ACK
Answer: A
NEW QUESTION # 74
Your IDS discovers that an intruder has gained access to your system. You immediately stop that access, change passwords for administrative accounts, and secure your network. You discover an odd account (not administrative) that has permission to remotely access the network. What is this most likely?
- A. A backdoor the intruder created so that he can re-enter the network.
- B. A normal account you simply did not notice before. Large networks have a number of accounts; it is hard to track them all.
- C. An example of IP spoofing.
- D. An example of privilege escalation.
Answer: A
NEW QUESTION # 75
Which of the following statements about threats are true?
Each correct answer represents a complete solution. Choose all that apply.
- A. A threat is a sequence of circumstances and events that allows a human or other agent to cause an information-related misfortune by exploiting vulnerability in an IT product.
- B. A threat is a potential for violation of security which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.
- C. A threat is a weakness or lack of safeguard that can be exploited by vulnerability, thus causing harm to the information systems or networks.
- D. A threat is any circumstance or event with the potential of causing harm to a system in the form of destruction, disclosure, modification of data, or denial of service.
Answer: A,B,D
Explanation:
Section: Volume C
Explanation
NEW QUESTION # 76
You have configured a virtualized Internet browser on your Windows XP professional computer. Using the virtualized Internet browser, you can protect your operating system from which of the following?
- A. Distributed denial of service (DDOS) attack
- B. Brute force attack
- C. Mail bombing
- D. Malware installation from unknown Web sites
Answer: D
NEW QUESTION # 77
Which of the following can be used to perform session hijacking?
Each correct answer represents a complete solution. Choose all that apply.
- A. Cross-site scripting
- B. ARP spoofing
- C. Session sidejacking
- D. Session fixation
Answer: A,C,D
Explanation:
Section: Volume B
NEW QUESTION # 78
Which of the following applications is an example of a data-sending Trojan?
- A. Firekiller 2000
- B. eBlaster
- C. Senna Spy Generator
- D. SubSeven
Answer: B
NEW QUESTION # 79
Which of the following techniques can be used to map 'open' or 'pass through' ports on a gateway?
- A. Tracegate
- B. Traceport
- C. Traceroute
- D. Tracefire
Answer: C
Explanation:
Section: Volume C
NEW QUESTION # 80
You see the career section of a company's Web site and analyze the job profile requirements. You conclude that the company wants professionals who have a sharp knowledge of Windows server 2003 and Windows active directory installation and placement. Which of the following steps are you using to perform hacking?
- A. Gaining access
- B. Covering tracks
- C. Reconnaissance
- D. Scanning
Answer: C
NEW QUESTION # 81
In which of the following attacks does an attacker use packet sniffing to read network traffic between two parties to steal the session cookie?
- A. ARP spoofing
- B. Cross-site scripting
- C. Session fixation
- D. Session sidejacking
Answer: D
NEW QUESTION # 82
John works as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. The company is aware of various types of security attacks and wants to impede them. Hence, management has assigned John a project to port scan the company's Web Server. For this, he uses the nmap port scanner and issues the following command to perform idle port scanning:
nmap -PN -p- -sI IP_Address_of_Company_Server
He analyzes that the server's TCP ports 21, 25, 80, and 111 are open.
Which of the following security policies is the company using during this entire process to mitigate the risk of hacking attacks?
- A. Antivirus policy
- B. Audit policy
- C. Non-disclosure agreement
- D. Acceptable use policy
Answer: B
NEW QUESTION # 83
You work as a System Administrator in SunSoft Inc. You are running a virtual machine on Windows Server
2003. The virtual machine is protected by DPM. Now, you want to move the virtual machine to another host.
Which of the following steps can you use to accomplish the task?
Each correct answer represents a part of the solution. Choose all that apply.
- A. Remove the original virtual machine from the old server and stop the protection for the original virtual machine.
- B. Add the copied virtual machine to a protection group.
- C. Copy the virtual machine to the new server.
- D. Run consistency check.
Answer: A,B,C
Explanation:
Section: Volume B
Explanation
NEW QUESTION # 84
CORRECT TEXT
Fill in the blank with the appropriate name of the attack.
______ takes best advantage of an existing authenticated connection
Answer:
Explanation:
session hijacking
NEW QUESTION # 85
You are concerned about rootkits on your network communicating with attackers outside your network. Without using an IDS how can you detect this sort of activity?
- A. You cannot, you need an IDS.
- B. By examining your firewall logs.
- C. By examining your domain controller server logs.
- D. By setting up a DMZ.
Answer: B
Explanation:
Section: Volume C
NEW QUESTION # 86
Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a company's icon to mark the progress of the test. Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access.
How was security compromised and how did the firewall respond?
- A. The attack was social engineering and the firewall did not detect it.
- B. The attack was Cross Site Scripting and the firewall blocked it.
- C. Security was not compromised as the webpage was hosted internally.
- D. Security was compromised as keylogger is invisible for firewall.
Answer: A
NEW QUESTION # 87
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He has successfully completed the following steps of the pre-attack phase:
l Information gathering
l Determining network range
l Identifying active machines
l Finding open ports and applications
l OS fingerprinting
l Fingerprinting services
Now John wants to perform network mapping of the We-are-secure network. Which of the following tools can he use to accomplish his task?
Each correct answer represents a complete solution. Choose all that apply.
- A. Cheops
- B. Traceroute
- C. NeoTrace
- D. Ettercap
Answer: A,B,C
NEW QUESTION # 88
SIMULATION
Fill in the blank with the appropriate name of the attack.
______ takes best advantage of an existing authenticated connection
Answer:
Explanation:
session hijacking
NEW QUESTION # 89
Maria works as a professional Ethical Hacker. She has been assigned the project of testing the security of www.gentech.com. She is using dumpster diving to gather information about Gentech Inc.
In which of the following steps of malicious hacking does dumpster diving come under?
- A. Multi-factor authentication
- B. Reconnaissance
- C. Mutual authentication
- D. Role-based access control
Answer: B
Explanation:
Section: Volume C
NEW QUESTION # 90
......
GCIH Dumps To Pass GIAC Information Security Exam in One Day: https://simplilearn.lead1pass.com/GIAC/GCIH-practice-exam-dumps.html