During which phase of incident response would an analyst review the data below?
#91
Answer: A✅ Correct❌ Incorrect
How could an attacker set up a persistent backdoor listener to a login shell on TCP port 53 using netcat on a Linux system?
#92
Answer: B✅ Correct❌ Incorrect
As indicated in the following image, an analyst runs the dir and more commands. What can the analyst conclude about Judges.txt?
#93
Answer: A✅ Correct❌ Incorrect
Which file type can be used to execute code in Excel without issuing a warning about opening a macro-supporting file type?
#94
Answer: A✅ Correct❌ Incorrect
What version of Windows natively supports SMB encryption?
#95
Answer: B✅ Correct❌ Incorrect
Which of the following netcat commands will connect to tcp port 2222 on a remote system (10.0.0.1)?
#96
Answer: B✅ Correct❌ Incorrect
Jill ran the following command below against a DNS server.But the command did not work. What other command can Jill use to accomplish the same task?
#97
Answer: B✅ Correct❌ Incorrect
Which of the following commands will identify hidden file streams within the C:\Documents folder?
#98
Answer: D✅ Correct❌ Incorrect
Observe the following command; what is the analyst doing?
#99
Answer: B✅ Correct❌ Incorrect
What happened in the following screenshot?
#100
Answer: A✅ Correct❌ Incorrect
When would a web-based reconnaissance tool be preferred over a direct/local reconnaissance tool?
#101
Answer: C✅ Correct❌ Incorrect
Which of the following network applications is better suited for using a connection-oriented protocol than a stateless protocol?
#102
Answer: D✅ Correct❌ Incorrect
Nathan is examining the security event log on a file server that contains sensitive data. He finds a number of Event ID 1234s with substatus code 0xC000006A.There are 4 or less failures against any individual account. Which type of password attack is indicated by these events?
#103
Answer: C✅ Correct❌ Incorrect
Which of the following statements describes the data below from volatility's pstree plugin?
#104
Answer: C✅ Correct❌ Incorrect
Which of the following Metasploit tools will generate a payload that can be introduced to a Windows system as shown in the image?
#105
Answer: D✅ Correct❌ Incorrect
Which UNIX log file contains information about currently logged in users?
#106
Answer: A✅ Correct❌ Incorrect
Which volatility plugin shows the command line path for a recently launched application?
#107
Answer: D✅ Correct❌ Incorrect
What is the definition of an event as it applies to incident handling?
#108
Answer: A✅ Correct❌ Incorrect
What hash type is being cracked in the command below?hashcat -m 1000 -a 0 customer.ntds wordlist.txt --potfile-path ./hashcat.potfile
#109
Answer: A✅ Correct❌ Incorrect
Which of the following occurs when a penetration tester attempts to connect to a host with the following command? net use \\192.168.44.213
#110
Answer: C✅ Correct❌ Incorrect
A security auditor is using John the Ripper to review password strength on Windows machines. The auditor knows that the company requires a 15-character minimum in their passwords. In this scenario, what format parameter must be passed to John (with Jumbo Patch) to crack the passwords?
#111
Answer: D✅ Correct❌ Incorrect
Which of the following is the most effective technique for identifying live client systems on a LAN?
#112
Answer: C✅ Correct❌ Incorrect
Which of the following squid proxy log fields is easiest for an attacker to spoof?
#113
Answer: A✅ Correct❌ Incorrect
A responder runs the two commands below looking for the number of lines that contain the word powershell. Which of the following is a reason why the output is different between the two plugins?
#114
Answer: C✅ Correct❌ Incorrect
An attacker has tricked a user into executing content he placed on a social networking site. The malicious content executes in the victim's browser and allows the attacker to determine if machines behind the user's firewall are up and running. What type of attack is this?
#115
Answer: D✅ Correct❌ Incorrect
Following the recent acquisition of a new business, your manager asks you to investigate their DNS service and report back on its status. He is concerned as they only have one DNS server in the organization and it is visible on the Internet. What actions and recommendations should be taken as a first step?
#116
Answer: A✅ Correct❌ Incorrect
A system administrator finds the entry below in an Apache log. What can be done to mitigate against this?192.168.116.201 - - [22/Apr/2016:13:43:26 -0400] `GET http://www.giac.org%2Farticles.php%3Fid%3D3+and+%28select+1+from+mysql.user+limit+0%2C1%29%3D1HTTP/1.1` 200 453 `-` `Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0`
#117
Answer: B✅ Correct❌ Incorrect
What is the Linux administrator doing with the commands below?$ rpcclient -U fezzik florinrpcclient $> lsaenumsid
#118
Answer: C✅ Correct❌ Incorrect
When probing for command injection opportunities on a remote host, why would an attacker target her own address space from the remote host?
#119
Answer: D✅ Correct❌ Incorrect
An administrator needs to protect his organization's IIS webservers from Cross-Site Scripting attacks. Which action should he take?