検証済み！GCIH問題集と解答でGCIHテストエンジン正確解答付き [Q68-Q86]

5/5 - (1 vote)

検証済み！GCIH問題集と解答でGCIHテストエンジン正確解答付き

あなたを必ず合格させるGCIH問題集PDF2023年最新のに更新された335問あります

GIAC GCIH 認定試験の出題範囲：

トピック	出題範囲
トピック 1	イベントを収集し、それらを分析し、インシデントがあるかどうかを判断するための重要な戦略の理解を示します
トピック 2	さまざまな種類のサービス拒否攻撃とそれらを防御する方法の包括的な理解
トピック 3	オーバーフロー攻撃がどのように機能するか、およびそれらを防御する方法を理解するパスワードクラッキングの3つの方法を詳細に理解する
トピック 4	スキャンで使用される技術とツールの理解、およびスキャンに対応して準備する方法を示します
トピック 5	セッションハイジャックとキャッシュポイズニング SQLインジェクション、クロスサイトスクリプティングおよびその他のWebセッション攻撃を実行するために使用されるツールとテクニックの理解
トピック 6	公開およびオープンソースの偵察手法の理解侵害されたマシン上の攻撃者のアーティファクトを取り除くための一般的なアプローチの理解

新問題 68
Which of the following is the difference between SSL and S-HTTP?

SSL operates at the application layer and S-HTTP operates at the network layer.

SSL operates at the application layer and S-HTTP operates at the transport layer.

SSL operates at the network layer and S-HTTP operates at the application layer.

SSL operates at the transport layer and S-HTTP operates at the application layer.

新問題 69
Which of the following can be used to perform session hijacking?
Each correct answer represents a complete solution. Choose all that apply.

Cross-site scripting

Session fixation

ARP spoofing

Session sidejacking

新問題 70
Which of the following is executed when a predetermined event occurs?

Trojan horse

Logic bomb

MAC

Worm

Section: Volume B
Explanation/Reference:

新問題 71
Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a company’s icon to mark the progress of the test. Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access.
How was security compromised and how did the firewall respond?

The attack was social engineering and the firewall did not detect it.

Security was not compromised as the webpage was hosted internally.

The attack was Cross Site Scripting and the firewall blocked it.

Security was compromised as keylogger is invisible for firewall.

新問題 72
Which of the following procedures is designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denialof-service, or unauthorized changes to system hardware, software, or data?

Disaster Recovery Plan

Cyber Incident Response Plan

Crisis Communication Plan

Occupant Emergency Plan

新問題 73
Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. What steps can be used as a countermeasure of ARP spoofing?
Each correct answer represents a complete solution. Choose all that apply.

Using smash guard utility

Using ARP Guard utility

Using static ARP entries on servers, workstation and routers

Using ARP watch utility

Using IDS Sensors to check continually for large amount of ARP traffic on local subnets

新問題 74
Which of the following tools can be used for network sniffing as well as for intercepting conversations through session hijacking?

Ethercap

Tripwire

IPChains

Hunt

新問題 75
Which of the following types of attacks is the result of vulnerabilities in a program due to poor programming techniques?

Evasion attack

Denial-of-Service (DoS) attack

Ping of death attack

Buffer overflow attack

Section: Volume A

新問題 76
Jason, a Malicious Hacker, is a student of Baker university. He wants to perform remote hacking on the server of
DataSoft Inc. to hone his hacking skills. The company has a Windows-based network. Jason successfully enters the
target system remotely by using the advantage of vulnerability. He places a Trojan to maintain future access and then
disconnects the remote session. The employees of the company complain to Mark, who works as a Professional
Ethical Hacker for DataSoft Inc., that some computers are very slow. Mark diagnoses the network and finds that some
irrelevant log files and signs of Trojans are present on the computers. He suspects that a malicious hacker has
accessed the network. Mark takes the help from Forensic Investigators and catches Jason.
Which of the following mistakes made by Jason helped the Forensic Investigators catch him?

Jason did not perform a vulnerability assessment.

Jason did not perform OS fingerprinting.

Jason did not perform foot printing.

Jason did not perform covering tracks.

Jason did not perform port scanning.

新問題 77
Your IDS discovers that an intruder has gained access to your system. You immediately stop that access, change
passwords for administrative accounts, and secure your network. You discover an odd account (not administrative)
that has permission to remotely access the network. What is this most likely?

An example of privilege escalation.

A normal account you simply did not notice before. Large networks have a number of accounts; it is hard to track
them all.

A backdoor the intruder created so that he can re-enter the network.

An example of IP spoofing.

新問題 78
Which of the following statements about buffer overflow are true?
Each correct answer represents a complete solution. Choose two.

It is a situation that occurs when a storage device runs out of space.

It is a situation that occurs when an application receives more data than it is configured to accept.

It can improve application performance.

It can terminate an application.

新問題 79
Which of the following wireless network security solutions refers to an authentication process in which a user can connect wireless access points to a centralized server to ensure that all hosts are properly authenticated?

Remote Authentication Dial-In User Service (RADIUS)

IEEE 802.1x

Wired Equivalent Privacy (WEP)

Wi-Fi Protected Access 2 (WPA2)

新問題 80
Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it with chess.exe. Which of the following tools are required in such a scenario?
Each correct answer represents a part of the solution. Choose three.

NetBus

Absinthe

Yet Another Binder

Chess.exe

新問題 81
You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company wants to fix potential vulnerabilities existing on the tested systems. You use Nessus as a vulnerability scanning program to fix the vulnerabilities. Which of the following vulnerabilities can be fixed using Nessus?
Each correct answer represents a complete solution. Choose all that apply.

Misconfiguration (e.g. open mail relay, missing patches, etc.)

Vulnerabilities that allow a remote cracker to control sensitive data on a system

Vulnerabilities that allow a remote cracker to access sensitive data on a system

Vulnerabilities that help in Code injection attacks

Section: Volume A

新問題 82
Adam, a malicious hacker is running a scan. Statistics of the scan is as follows:
Scan directed at open port: ClientServer
192.5.2.92:4079 ———FIN———>192.5.2.110:23192.5.2.92:4079 <—-NO RESPONSE—
—192.5.2.110:23
Scan directed at closed port:
ClientServer
192.5.2.92:4079 ———FIN———>192.5.2.110:23
192.5.2.92:4079<—–RST/ACK———-192.5.2.110:23
Which of the following types of port scan is Adam running?

ACK scan

FIN scan

XMAS scan

Idle scan

Section: Volume A

新問題 83
You work as a System Administrator for Happy World Inc. Your company has a server named uC1 that runs Windows Server 2008. The Windows Server virtualization role service is installed on the uC1 server which hosts one virtual machine that also runs Windows Server 2008. You are required to install a new application on the virtual machine. You need to ensure that in case of a failure of the application installation, you are able to quickly restore the virtual machine to its original state.
Which of the following actions will you perform to accomplish the task?

Use the Virtualization Management Console to save the state of the virtual machine.

Log on to the virtual host and create a new dynamically expanding virtual hard disk.

Use the Virtualization Management Console to create a snapshot of the virtual machine.

Use the Edit Virtual Hard Disk Wizard to copy the virtual hard disk of the virtual machine.

新問題 84
Which of the following statements are true about firewalking?
Each correct answer represents a complete solution. Choose all that apply.

To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall.

In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall.

A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall.

Firewalking works on the UDP packets.

Section: Volume A
Explanation/Reference:

新問題 85
Which of the following tools combines two programs, and also encrypts the resulting package in an attempt to foil
antivirus programs?

Trojan Man

EliteWrap

Tiny

NetBus

新問題 86
John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we- are-secure.com. He performs Web vulnerability scanning on the We-are-secure server. The output of the scanning test is as follows:
C:whisker.pl -h target_IP_address
— whisker / v1.4.0 / rain forest puppy / www.wiretrip.net — = – = – = – = –
= Host: target_IP_address
= Server: Apache/1.3.12 (Win32) ApacheJServ/1.1
mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22
+ 200 OK: HEAD /cgi-bin/printenv
John recognizes /cgi-bin/printenv vulnerability (‘Printenv’ vulnerability) in the We_are_secure server. Which of the following statements about ‘Printenv’ vulnerability are true?
Each correct answer represents a complete solution. Choose all that apply.

This vulnerability helps in a cross site scripting attack.

‘Printenv’ vulnerability maintains a log file of user activities on the Website, which may be useful for the attacker.

The countermeasure to ‘printenv’ vulnerability is to remove the CGI script.

With the help of ‘printenv’ vulnerability, an attacker can input specially crafted links and/or other malicious scripts.

Section: Volume A

Loading …