Verified GCIH dumps Q&As - Pass Guarantee or Full Refund [Apr-2024]
GCIH PDF Dumps | Apr 10, 2024 Recently Updated Questions
GIAC GCIH Certification Exam is an excellent way for security professionals and incident handlers to validate their skills and knowledge in the field of incident handling and response. By earning this certification, individuals can demonstrate their expertise to employers and clients, and enhance their career prospects in the field of cybersecurity.
NEW QUESTION # 95
You want to perform passive footprinting against we-are-secure Inc. Web server. Which of the following tools will you use?
- A. Ettercap
- B. Nmap
- C. Ethereal
- D. Netcraft
Answer: D
NEW QUESTION # 96
Which of the following tools can be used for steganography?
Each correct answer represents a complete solution. Choose all that apply.
- A. Stegbreak
- B. Image hide
- C. Snow.exe
- D. Anti-x
Answer: B,C
NEW QUESTION # 97
Which of the following US Acts emphasized a "risk-based policy for cost-effective security" and makes mandatory for
agency program officials, chief information officers, and inspectors general (IGs) to conduct annual reviews of the
agency's information security program and report the results to Office of Management and Budget?
- A. Federal Information Security Management Act of 2002 (FISMA)
- B. The Equal Credit Opportunity Act (ECOA)
- C. The Fair Credit Reporting Act (FCRA)
- D. The Electronic Communications Privacy Act of 1986 (ECPA)
Answer: A
NEW QUESTION # 98
You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state.
Which of the following actions will you perform to accomplish the task?
- A. Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.
- B. Use the Virtualization Management Console to create a snapshot of the virtual machine.
- C. Log on to the virtual host and create a new dynamically expanding virtual hard disk.
- D. Use the Virtualization Management Console to save the state of the virtual machine.
Answer: B
NEW QUESTION # 99
Which of the following statements about reconnaissance is true?
- A. It is also known as half-open scanning.
- B. It is any program that allows a hacker to connect to a computer without going through the normal authentication
process. - C. It is a computer that is used to attract potential intruders or attackers.
- D. It describes an attempt to transfer DNS zone data.
Answer: D
NEW QUESTION # 100
Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections?
Each correct answer represents a complete solution. Choose all that apply.
- A. Knark
- B. Phalanx2
- C. Beastkit
- D. Adore
Answer: A,D
NEW QUESTION # 101
Which of the following incident response team members ensures that the policies of the organization are enforced during the incident response?
- A. Technical representative
- B. Legal representative
- C. Information Security representative
- D. Human Resource
Answer: D
NEW QUESTION # 102
James works as a Database Administrator for Techsoft Inc. The company has a SQL Server 2005 computer.
The computer has a database named Sales. Users complain that the performance of the database has deteriorated. James opens the System Monitor tool and finds that there is an increase in network traffic. What kind of attack might be the cause of the performance deterioration?
- A. Internal attack
- B. Denial-of-Service
- C. Virus
- D. Injection
Answer: B
Explanation:
Section: Volume B
NEW QUESTION # 103
Adam, a malicious hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct Man-in-The-Middle attack.
Which of the following is the destination MAC address of a broadcast frame?
- A. 0x00000000000
- B. 0xAAAAAAAAAA
- C. 0xFFFFFFFFFFFF
- D. 0xDDDDDDDDD
Answer: C
Explanation:
Section: Volume B
NEW QUESTION # 104
You work as a professional Ethical Hacker. You are assigned a project to test the security of www.weare-secure.com.
You somehow enter in we-are-secure Inc. main server, which is Windows based.
While you are installing the NetCat tool as a backdoor in the we-are-secure server, you see the file credit.dat having
the list of credit card numbers of the company's employees. You want to transfer the credit.dat file in your local
computer so that you can sell that information on the internet in the good price. However, you do not want to send
the contents of this file in the clear text format since you do not want that the Network Administrator of the we-are-
secure Inc. can get any clue of the hacking attempt. Hence, you decide to send the content of the credit.dat file in the
encrypted format. What steps should you take to accomplish the task?
- A. You will use the ftp service.
- B. You will use brutus.
- C. You will use CryptCat instead of NetCat.
- D. You will use Wireshark.
Answer: C
NEW QUESTION # 105
You are monitoring your network's behavior. You find a sudden increase in traffic on the network. It seems to come in bursts and emanate from one specific machine. You have been able to determine that a user of that machine is unaware of the activity and lacks the computer knowledge required to be responsible for a computer attack. What attack might this indicate?
- A. Spyware
- B. Session Hijacking
- C. Ping Flood
- D. Denial of Service
Answer: A
NEW QUESTION # 106
Victor wants to send an encrypted message to his friend. He is using certain steganography technique to accomplish this task. He takes a cover object and changes it accordingly to hide information. This secret information is recovered only when the algorithm compares the changed cover with the original cover.
Which of the following Steganography methods is Victor using to accomplish the task?
- A. The distortion technique
- B. The spread spectrum technique
- C. The cover generation technique
- D. The substitution technique
Answer: A
NEW QUESTION # 107
Which of the following steps of incident response is steady in nature?
- A. Preparation
- B. Recovery
- C. Eradication
- D. Containment
Answer: A
NEW QUESTION # 108
Which of the following is used to gather information about a remote network protected by a firewall?
- A. Firewalking
- B. Wardialing
- C. Warchalking
- D. Firechalking
Answer: A
NEW QUESTION # 109
Which of the following statements are true about tcp wrappers?
Each correct answer represents a complete solution. Choose all that apply.
- A. When a user uses a TCP wrapper, the inetd daemon runs the wrapper program tcpd instead of running the server
program directly. - B. tcp wrapper allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens to
filter for access control purposes. - C. tcp wrapper protects a Linux server from IP address spoofing.
- D. tcp wrapper provides access control, host address spoofing, client username lookups, etc.
Answer: A,B,D
NEW QUESTION # 110
Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:
C:\WINDOWS>netstat -an | find "UDP" UDP IP_Address:31337 *:*
Now you check the following registry address:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
In the above address, you notice a 'default' key in the 'Name' field having " .exe" value in the corresponding 'Data' field. Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?
- A. Donald Dick
- B. Qaz
- C. Tini
- D. Back Orifice
Answer: D
NEW QUESTION # 111
Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion. When a user visits the infected Web page, code gets automatically executed and Ryan can easily perform acts like account hijacking, history theft etc. Which of the following types of Cross-Site Scripting attack Ryan intends to do?
- A. Document Object Model (DOM)
- B. Persistent
- C. Non persistent
- D. SAX
Answer: B
Explanation:
Section: Volume A
NEW QUESTION # 112
Victor works as a professional Ethical Hacker for SecureEnet Inc. He wants to scan the wireless network of the company. He uses a tool that is a free open-source utility for network exploration. The tool uses raw IP packets to determine the following:
What ports are open on our network systems.
What hosts are available on the network.
Identify unauthorized wireless access points.
What services (application name and version) those hosts are offering.
What operating systems (and OS versions) they are running.
What type of packet filters/firewalls are in use.
Which of the following tools is Victor using?
- A. Sniffer
- B. Kismet
- C. Nmap
- D. Nessus
Answer: C
NEW QUESTION # 113
The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in
Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows
Address Book (WAB). Which of the following registry values can be used to identify this worm?
- A. HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"
- B. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
- C. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- D. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Answer: A
NEW QUESTION # 114
Which of the following terms describes an attempt to transfer DNS zone data?
- A. Encapsulation
- B. Reconnaissance
- C. Dumpster diving
- D. Spam
Answer: B
Explanation:
Section: Volume B
NEW QUESTION # 115
Which of the following types of attacks is often performed by looking surreptitiously at the keyboard or monitor of an employee's computer?
- A. Shoulder surfing attack
- B. Buffer-overflow attack
- C. Denial-of-Service (DoS) attack
- D. Man-in-the-middle attack
Answer: A
NEW QUESTION # 116
......
GIAC GCIH (GIAC Certified Incident Handler) Certification Exam is an excellent way for individuals to demonstrate their expertise in incident handling and advance their careers in cybersecurity. With the right training and preparation, candidates can successfully pass the exam and join the ranks of certified incident handlers around the world.
The GCIH certification exam is a rigorous test that requires significant preparation and study. Candidates are tested on their ability to identify and analyze security incidents, as well as their ability to develop and implement effective incident response plans. GIAC Certified Incident Handler certification exam is recognized by employers worldwide, making it a valuable credential for those looking to further their career in the cybersecurity field.
GCIH Exam Questions – Valid GCIH Dumps Pdf: https://www.exam-killer.com/GCIH-valid-questions.html
GCIH Practice Test Questions Answers Updated 335 Questions: https://drive.google.com/open?id=1600U017wgTRQlTsX3pU5ANYueUYO333g
