GIAC Certified Incident Handler GCIH Exam Questions

Adam works as a Security Analyst for Umbrella Inc. Company has a Windows-based network. All computers run on Windows XP. Manager of the Sales department complains Adam about the unusual behavior of his computer. He told Adam that some pornographic contents are suddenly appeared on his computer overnight. Adam suspects that some malicious software or Trojans have been installed on the computer. He runs some diagnostics programs and Port scanners and found that the Port 12345, 12346, and 20034 are open. Adam also noticed some tampering with the Windows registry, which causes one application to run every time when Windows start.

Which of the following is the most likely reason behind this issue?

Which of the following methods can be used to detect session hijacking attack?

Brutus is a password cracking tool that can be used to crack the following authentications:

l HTTP (Basic Authentication)

l HTTP (HTML Form/CGI)

l POP3 (Post Office Protocol v3)

l FTP (File Transfer Protocol)

l SMB (Server Message Block)

l Telnet

Which of the following attacks can be performed by Brutus for password cracking?

Each correct answer represents a complete solution. Choose all that apply.

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.

Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?

Which of the following is a reason to implement security logging on a DNS server?

What is the major difference between a worm and a Trojan horse?