Pass the GIAC Security Administration GCIH Questions and answers with CertsForce

Viewing page 3 out of 10 pages
Viewing questions 21-30 out of questions
Questions # 21:

Which of the following scanning tools is also a network analysis tool that sends packets with nontraditional IP stack parameters and allows the scanner to gather information from the response packets generated?

Options:

A.

Tcpview


B.

Nessus


C.

Legion


D.

HPing


Expert Solution
Questions # 22:

Which of the following protocols is a maintenance protocol and is normally considered a part of the IP layer, but has also been used to conduct denial-of-service attacks?

Options:

A.

ICMP


B.

L2TP


C.

TCP


D.

NNTP


Expert Solution
Questions # 23:

Which of the following protocols uses only User Datagram Protocol (UDP)?

Options:

A.

POP3


B.

FTP


C.

ICMP


D.

TFTP


Expert Solution
Questions # 24:

Which of the following statements about smurf is true?

Options:

A.

It is a UDP attack that involves spoofing and flooding.


B.

It is an ICMP attack that involves spoofing and flooding.


C.

It is an attack with IP fragments that cannot be reassembled.


D.

It is a denial of service (DoS) attack that leaves TCP ports open.


Expert Solution
Questions # 25:

Which of the following is used to determine the operating system on the remote computer in a network environment?

Options:

A.

Spoofing


B.

Reconnaissance


C.

OS Fingerprinting


D.

Social engineering


Expert Solution
Questions # 26:

Which of the following HTTP requests is the SQL injection attack?

Options:

A.

http://www.xsecurity.com/cgiin/bad.cgi?foo=..%fc%80%80%80%80%af../bin/ls%20-al


B.

http://www.victim.com/example?accountnumber=67891 &creditamount=999999999


C.

http://www.myserver.com/search.asp?lname=adam%27%3bupdate%20usertable%20set% 20pass wd%3d %27hCx0r%27%3b--%00


D.

http://www.myserver.com/script.php?mydata=%3cscript%20src=%22http%3a%2f%

2fwww.yourser ver.c0m %2fbadscript.js%22%3e%3c%2fscript%3e


Expert Solution
Questions # 27:

Which of the following controls is described in the statement given below?

"It ensures that the enforcement of organizational security policy does not rely on voluntary web application user compliance. It secures information by assigning sensitivity labels on information and comparing this to the level of security a user is operating at."

Options:

A.

Role-based Access Control


B.

Attribute-based Access Control


C.

Discretionary Access Control


D.

Mandatory Access Control


Expert Solution
Questions # 28:

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.weare- secure.com. He enters a single quote in the input field of the login page of the We-are-secure Web site and receives the following error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14'

This error message shows that the We-are-secure Website is vulnerable to __________.

Options:

A.

A buffer overflow


B.

A Denial-of-Service attack


C.

A SQL injection attack


D.

An XSS attack


Expert Solution
Questions # 29:

Your IDS discovers that an intruder has gained access to your system. You immediately stop that access, change passwords for administrative accounts, and secure your network. You discover an odd account (not administrative) that has permission to remotely access the network. What is this most likely?

Options:

A.

An example of privilege escalation.


B.

A normal account you simply did not notice before. Large networks have a number of accounts; it is hard to track them all.


C.

A backdoor the intruder created so that he can re-enter the network.


D.

An example of IP spoofing.


Expert Solution
Questions # 30:

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to perform a stealth scan to discover open ports and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party. Which of the following scanning techniques will John use to accomplish his task?

Options:

A.

RPC


B.

IDLE


C.

UDP


D.

TCP SYN/ACK


Expert Solution
Viewing page 3 out of 10 pages
Viewing questions 21-30 out of questions