GIAC Certified Incident Handler (GCIH) Practice Exam

These questions are part of the practice quiz. Start practicing

• In the Erad and Recovery phase, which action is recommended for wardialer defenses?
• Which password cracking method starts with a dictionary and then appends numbers or letters?
• IP fragmentation attacks are primarily used to
• What is the primary purpose of a FIN scan?
• What does SYSKEY do?
• Which statement about Wellenreiter's development status is true?
• Which of the following is NOT a defense described for CGI/Web Scanners?
• Why is it difficult to reassemble fragments for IDS detection?
• How is polymorphic code created?
• A baseline for response is established in order to
• What characterizes a DNS amplification attack?
• Which item is included in an emergency communications plan to verify communication readiness?
• Which statement describes active fingerprinting defenses?
• Which statement about BeEF hooking behavior is true?
• Which action is a defensive measure against vulnerability scanners that involves applying updates?
• Which security tool is cited as capable of mitigating XSS on Apache?
• Which Windows tool is explicitly mentioned for reporting ports and the corresponding processes?
• Which browser addon is listed for inspecting and manipulating web pages?
• Which information can be gathered from domain name registration?
• What does URL encoding do?
• Firewalking is used to determine which ports on a packet filter firewall are open. Is this statement true?
• What is a Smurf attack?
• Password cracking is best described as?
• Which defense can IPS provide for IP fragmentation attacks?
• Which of the following is a feature of The Hacker's Choice Scanner?
• Which statement best describes how bots are installed on compromised systems?
• In firewalk defenses, which preparation measure targets preventing ICMP Time Exceeded messages from exiting the internal network?
• Which of the following is a method Nikto uses to evade IDS?
• Which of the following is a commonly used reconnaissance source?
• Which statement describes the XSS Shell?
• Which of the following best describes the Slowloris attack?
• In the Identification phase of DNS zone transfer defenses, where would you look for evidence of a transfer attempt?
• CoWPAtty is a dictionary-based cracking tool for which keys?
• What is ASLEAP primarily used for?
• Which statement best describes a SYN flood?
• Which practice reduces SQL injection risk by isolating user input from the SQL query?
• Which search term is commonly used to reveal a web directory listing in Google results?
• What are some tools for ward driving?
• Public databases are examples of what kind of information source?
• URL session tracking attack involves which action?
• What is Nikto?
• What are some war dialer defenses?
• Which of the following is NOT listed as a potential incident response team member?
• XSS content appearing to originate from a different place describes which effect?
• What is the observable impact of Slowloris on servers?
• Which statement about FIN scanning is true?
• Which Google directive shows pages whose URL matches the search term?
• Fl0p passive fingerprinting identifies traffic flow by analyzing which of the following?
• What practice helps verify software authenticity when downloading from multiple mirrors?
• Which of the following is part of pass-the-hash defenses?
• In a Smurf attack, what kind of broadcast is used?
• Which port is commonly chosen to blend in for scanning?
• What is the goal of the identification phase?
• A Tiny Fragment attack is designed to
• Which item is explicitly listed to control moisture in the jump bag?
• Which of the following is a preparation activity for issue handling?
• Harvest session IDs, predict one and use the predicted value refers to which method?
• How is a CGI/PHP/ASP/JSP program run?
• Which Google search directive restricts results to a domain?
• P0F2 identifies the OS based on which header types?
• NT hashes are characterized by which of the following?
• Which statement about the Warhol/Flash technique is true?
• Which John the Ripper cracking mode uses variations of the account name?
• In the firewalking scanning phase, which condition indicates a port is open?
• Which netstat option displays the process ID (PID) associated with listening ports on Windows?
• Which defensive measure helps reduce reconnaissance exposure on a website?
• A brute force attack is characterized by:
• Which information can be gathered from WHOIS for research purposes?
• Which item is included in a jump bag?
• During the Preparation phase of Whois reconnaissance defenses, what is a recommended practice?
• What is reconnaissance in security contexts?
• Which of the following is a defense against SQL injection?
• A dictionary attack primarily relies on:
• FTP bounce scanning is associated with which devices?
• Which statement correctly describes SSL in terms of encryption and data integrity?
• LANMAN hashes are described by which of the following properties?
• Fl0p analysis is performed on what to identify traffic flow?
• Which directive shows pages similar to a given page?
• Which character is the Windows delimiter used in paths instead of the forward slash?
• Reassembling packets before IDS decisions helps primarily to detect which kind of attack?
• Which port is SMB/CIFS associated with and commonly blocked to defend against null sessions?
• Which statement about Wellenreiter's operation is true?
• Wardialing is primarily used to locate what type of entry points?
• Which statement describes a technique that lengthens the URL to evade IDS?
• What is the recommended method to remove a phone number from Google search results?
• What can Enum pull?
• How do you set up a NULL session?
• Which trend describes how modern attackers use self-replicating code to grow botnets?
• How does a CpuHog style attack disrupt normal operation on Windows?
• Second-generation OS fingerprinting uses which characteristics?
• Which browser addon is described for adding and editing cookies?
• What is a CGI Program?
• What is a web scanner?
• What is cross site scripting?
• What is SQL injection?
• Which set of packets does Nmap typically send to identify hosts in use?
• Which sequence achieves a DNS zone transfer on Windows using nslookup?
• What is a common use of ACK scanning?
• How are cross site scripting attacks launched?
• Which browser addon is listed for manipulating data?
• What risk does a DNS zone transfer pose to an organization?
• Copying the SAM file from which location is listed as a method to obtain password hashes?
• What is a common mechanism used to track web sessions?
• Karma exploitation can affect which components?
• What is Karma's behavior in relation to a client seeking a network?
• How can you look for SQL injection vulnerabilities?
• Which technique involves splitting data into separate packets to avoid IDS detection?
• How can FTP be used as a source port for scanning?
• First-generation OS fingerprinting uses which method?
• What does a hybrid attack do?
• Which of the following is a feature of a war room as described?
• Which action best defends against Google reconnaissance by reducing exposure in search results?
• Which defense measure increases resilience against SYN flood by allowing more half-open connections?
• Which of the following is listed as a trend in the underground community?
• What is a NULL session?
• Which channel is NOT listed as a botnet communication method?
• Cookie hacking involves which action?
• In defenses against passive OS fingerprinting, which statement is true about detecting a passive scanner?
• TTL shenanigans in network traffic can be detected by which mechanism?
• What is the effect of a cross-site scripting attack?
• What is a DNS zone transfer?
• Which of the following is a traditional IDS evasion technique described in the material?
• In a fragment overlap attack, which statement is accurate?
• Which of the following is NOT listed as a user input string in SQL in the material?
• Which of the following best describes a dictionary attack?
• Which item is not typically used as a reconnaissance source?
• Which tool is listed as binary image creation software for jump bag?
• What is winfingerprint?
• What are some goals of wardialing?
• What does an UPDATE statement look like?
• In idle scanning, what does the attacker use to determine if a port on the target is open?
• What is The Hacker's Choice Scanner?
• How does nmap do first generation active os fingerprinting?
• Which topic is identified as a main training issue for incident response teams?
• Which TCP control bit indicates that urgent data is included?
• To crack WPA with CoWPAtty, which frame sequence must be captured?
• What defense helps identify rogue dial-up devices?
• LANMAN hashes are created by which algorithm and structure?
• Which Google phonebook search pattern is commonly used?
• How does nmap do second generation active OS fingerprinting?
• What is THC Hydra primarily used for?
• Which of the following is an example of open source information location?
• In reconnaissance, the term script kiddies typically refers to attackers who:
• Which Google directive shows pages whose title matches the search criteria?
• Which of the following should be included on an incident response team?
• In network mapping defense, IDS signatures for ping sweep or traceroute often lead to what?
• Which statement best describes firewalking in network security?
• Which of the following is listed as a web technology that can trigger server-side script execution?
• Which channel is commonly used by botnets to communicate (command and control)?
• During the scanning phase of firewalking, what indicates an open port?
• FTP bounce scanning is used to obscure the scan by what mechanism?
• Which practice helps protect the integrity of sensitive information stored in client-side state such as URLs, cookies, or hidden form elements?
• Disabling ICMP Echo Requests to defend against network mapping would cause which impact?
• What does a SELECT statement look like?
• Which action helps defend against rogue access points in war driving?
• BeEF stands for which of the following?
• What are some ways wireless devices are misconfigured?
• Demon dialers refer to dialing a single number to perform what?
• Nikto looks for default material and well-known server problems. Which option best matches this focus?
• What is the IP ID field in the IP header used for?
• Which of the following is a feature of Cain?
• Which statement describes non-persistent cookies?
• NT hashes are described by which of the following properties?
• In firewalking, what is used during the discovery phase to determine hops to the firewall?
• What is WarVOX?
• How does traceroute work?
• In an XSS scenario, where does the malicious code execute?
• How should the incident response team be organized?
• Which item is a feature of a war room setup?
• Which of the following is a potential consequence of password guessing attempts?
• Which cracking mode uses an external program to generate guesses?
• What is a metamorphic worm?
• IP ID increments: typical behavior?
• Why would you apply a timestamp inside a data variable in web application defense?
• Which statement best characterizes active OS fingerprinting defenses?
• What does split DNS refer to in defensive DNS architecture?
• How many numbers per hour can WarVOX dial?
• Which sequence characterizes the Warhol/Flash technique?
• Why is WEP considered insecure?
• Null session defenses for Win2k?
• Which item is part of IP Fragmentation Attack defenses during the Preparation phase?
• Which of the following is a recommended defense against war driving?
• Which of the following statements best describes a brute force attack?
• What are the two broad categories of DoS attacks?
• Which command performs a DNS zone transfer on Unix systems?
• Which practice is a defensive measure during the Preparation phase against DNS zone transfers?
• What is Maltego?
• In Nmap's traceroute feature, what is the general approach?
• Which technique is commonly used to obtain password hashes from Windows systems?
• ASLEAP uses a sniffed LEAP challenge/response to attack which credentials?
• THC Hydra is best described as?
• Which SQL statement is commonly used to query data and is highlighted in the material as a focus of SQL injection discussions?
• Why should session IDs be long enough?
• Which tool is used to automate Google reconnaissance?
• Which statement is used to modify data in a database table?
• What privilege level does a CGI program typically run with?
• Which Windows command shows listening ports?
• What happens when a CpuHog runs at priority 16 on Windows?
• Hidden form elements attack describes which action?
• What are war dialers?
• During the Identification phase of Whois reconnaissance defenses, what is typically observed?
• XSS defenses should filter which characters on the server side?
• P0F2 passive fingerprinting focuses on which headers to determine the operating system?
• Which of the following is a recommended defense against SQL injection?
• Which sequence best describes the typical flow of an XSS attack as described in the material?
• Under pass-the-hash defenses, which item is part of the Identification phase?
• Which of the following is NOT a recommended defense against SYN flood?
• What containment action can be used to mitigate ping sweeps?
• What is a polymorphic worm?