GIAC Certified Incident Handler - GCIH Exam Practice Test

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc.
Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer.
After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting.
for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done Which of the following actions does Adam want to perform by the above command?

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint.
Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Which of the following can be used to perform session hijacking?
Each correct answer represents a complete solution. Choose all that apply.

As a professional hacker, you want to crack the security of secureserver.com. For this, in the information gathering step, you performed scanning with the help of nmap utility to retrieve as many different protocols as possible being used by the secureserver.com so that you could get the accurate knowledge about what services were being used by the secure server.com. Which of the following nmap switches have you used to accomplish the task?

Which of the following is the best method of accurately identifying the services running on a victim host?

Which of the following is a type of computer security vulnerability typically found in Web applications that allow code injection by malicious Web users into the Web pages viewed by other users?

Which of the following statements are true about worms?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following types of scan does not open a full TCP connection?

You want to measure the number of heaps used and overflows occurred at a point in time. Which of the following commands will you run to activate the appropriate monitor?

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.
we-are-secure.com. He has successfully completed the following steps of the pre-attack phase:
l Information gathering
l Determining network range
l Identifying active machines
l Finding open ports and applications
l OS fingerprinting
l Fingerprinting services
Now John wants to perform network mapping of the We-are-secure network. Which of the following tools can he use to accomplish his task?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following is executed when a predetermined event occurs?

Which of the following refers to a condition in which a hacker sends a bunch of packets that leave TCP ports half open?