GIAC GCIH Exam Questions Free Practice Test

Viewing page 6 out of 10 pages

Viewing questions 51-60 out of questions

Questions # 51:

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str).

What attack will his program expose the Web application to?

Options:

Format string attack

Cross Site Scripting attack

SQL injection attack

Sequence++ attack

Expert Solution

Questions # 52:

Your company has been hired to provide consultancy, development, and integration services for a company named Brainbridge International. You have prepared a case study to plan the upgrade for the company. Based on the case study, which of the following steps will you suggest for configuring WebStore1?

Each correct answer represents a part of the solution. Choose two.

Options:

Customize IIS 6.0 to display a legal warning page on the generation of the 404.2 and 404.3 errors.

Move the WebStore1 server to the internal network.

Configure IIS 6.0 on WebStore1 to scan the URL for known buffer overflow attacks.

Move the computer account of WebStore1 to the Remote organizational unit (OU).

Expert Solution

Questions # 53:

Which of the following functions can you use to mitigate a command injection attack?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

escapeshellarg()

escapeshellcmd()

htmlentities()

strip_tags()

Expert Solution

Questions # 54:

Which of the following statements about Denial-of-Service (DoS) attack are true?

Each correct answer represents a complete solution. Choose three.

Options:

It disrupts services to a specific computer.

It changes the configuration of the TCP/IP protocol.

It saturates network resources.

It disrupts connections between two computers, preventing communications between services.

Expert Solution

Questions # 55:

Which of the following statements about buffer overflow is true?

Options:

It manages security credentials and public keys for message encryption.

It is a collection of files used by Microsoft for software updates released between major service pack releases.

It is a condition in which an application receives more data than it is configured to accept.

It is a false warning about a virus.

Expert Solution

Questions # 56:

Which of the following malicious software travels across computer networks without the assistance of a user?

Options:

Worm

Virus

Hoax

Trojan horses

Expert Solution

Questions # 57:

Which of the following commands can be used for port scanning?

Options:

nc -t

nc -z

nc -w

nc -g

Expert Solution

Questions # 58:

Which of the following statements about a Trojan horse are true?

Each correct answer represents a complete solution. Choose two.

Options:

It is a macro or script that attaches itself to a file or template.

The writers of a Trojan horse can use it later to gain unauthorized access to a computer.

It is a malicious software program code that resembles another normal program.

It infects the boot record on hard disks and floppy disks.

Expert Solution

Questions # 59:

Which of the following commands is used to access Windows resources from Linux workstation?

Options:

mutt

scp

rsync

smbclient

Expert Solution

Questions # 60:

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He performs Web vulnerability scanning on the We-are-secure server. The output of the scanning test is as follows:

C:\whisker.pl -h target_IP_address

-- whisker / v1.4.0 / rain forest puppy / www.wiretrip.net -- = - = - = - = - =

= Host: target_IP_address

= Server: Apache/1.3.12 (Win32) ApacheJServ/1.1

mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22

+ 200 OK: HEAD /cgi-bin/printenv

John recognizes /cgi-bin/printenv vulnerability ('Printenv' vulnerability) in the We_are_secure server. Which of the following statements about 'Printenv' vulnerability are true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

This vulnerability helps in a cross site scripting attack.

'Printenv' vulnerability maintains a log file of user activities on the Website, which may be useful for the attacker.

The countermeasure to 'printenv' vulnerability is to remove the CGI script.

With the help of 'printenv' vulnerability, an attacker can input specially crafted links and/or other malicious scripts.

Expert Solution

Viewing page 6 out of 10 pages

Viewing questions 51-60 out of questions

Pass the GIAC Security Administration GCIH Questions and answers with CertsForce