GIAC Certified Incident Handler GCIH Practice Questions with Explanations

Correct answer: B

All four actions listed-removing network cables, isolating on a VLAN, using firewalls/access lists, and changing DNS entries-are classic containment measures designed to limit the scope and impact of a security incident. Containment is the phase where responders take steps to stop the attack from spreading and prevent further damage, while preserving evidence. Identification focuses on detecting the incident, eradication removes the threat, and recovery restores systems to normal operation.

Why the other options are wrong:

• A. Identification is the detection and confirmation of a security incident, not the implementation of isolation measures.
• C. Eradication removes the attacker's tools and access, but the listed actions are preventative controls rather than removal steps.
• D. Recovery restores systems to normal operation after the threat is eliminated; it does not involve isolation or access prevention.

Correct answer: A

A stealth kernel-level rootkit operates at the system's deepest level and can hide its presence and activities from standard monitoring tools, antivirus, and anti-spyware software. The key indicator here is that the system is visibly slowing down with mysteriously disappearing windows, yet antivirus and anti-spyware software detect nothing -suggesting something hidden from these tools. The massive loss of disk space (190 GB consumed) combined with popups that vanish quickly points to rootkit activity that typical security tools cannot detect because the rootkit controls what the OS reports.

Why the other options are wrong:

• B. A stealth virus typically replicates by attaching to files and would be more likely detected by antivirus software, which is running on this system.
• C. Trojan viruses are generally detected by antivirus software and don't typically cause the hidden resource consumption characteristic of rootkits.
• D. Worms cause visible file replication and network spreading; they are usually detected by antivirus and would not evade detection as effectively as a kernel-level rootkit.

Correct answer: A

A Denial of Service (DoS) attack is specifically designed and intended solely to make a resource unavailable to legitimate users by overwhelming it with traffic or exploiting vulnerabilities to crash the service. The defining characteristic of a DoS attack is that its only goal is availability disruption, not data theft, authentication bypass, or other objectives.

Why the other options are wrong:

• B. A replay attack involves capturing and resending valid data to impersonate a user or gain unauthorized access, not merely denying availability.
• C. A teardrop attack is a specific DoS technique that sends fragmented packets, but it is a type of DoS rather than the category that encompasses only availability attacks.
• D. A land attack sends spoofed packets with the target's own IP as both source and destination, designed to crash the system, but is a specific DoS variant rather than the general category.

Correct answer: A

A brute force attack systematically tries many password combinations or hashes until a match is found. When attacking a hashed password, an attacker can generate hashes of candidate passwords and compare them to the target hash-a process that is computationally intensive but does not require the hash to be reversed. Brute force is the fundamental technique for guessing hashed passwords.

Why the other options are wrong:

• B. Evasion attacks are techniques to bypass security controls and detection systems, not password cracking methods.
• C. Denial of Service attacks aim to disrupt availability, not to guess or crack passwords.
• D. Teardrop attacks are a fragmented packet DoS technique with no connection to password guessing or hashing.

Correct answer: A

The Ping of Death is a classic DoS attack in which an attacker sends an ICMP echo request (ping) packet larger than the maximum allowed size of 65,536 bytes. When the target system attempts to process this oversized packet, it can cause a buffer overflow, crash, or system hang. This attack exploits a limitation in older TCP/IP implementations.

Why the other options are wrong:

• B. Jolt is a DoS attack that sends fragmented ICMP echo requests, not oversized single packets.
• C. Fraggle is a DoS attack that exploits the UDP echo and chargen services by sending spoofed broadcast traffic, not ICMP oversized packets.
• D. Teardrop sends overlapping IP fragments that cause processing errors, but is not specifically characterized by a single packet larger than 65,536 bytes.

Correct answer: C

MAC spoofing occurs when an attacker configures their network interface card to use a different MAC address than the one assigned by the manufacturer. In this case, the unfamiliar machine connected to Adam's wireless network has the same MAC address as Adam's laptop, meaning someone has spoofed Adam's MAC address to gain access to his network. Despite MAC filtering being enabled, the attacker mimicked Adam's laptop's MAC address to bypass this control.

Why the other options are wrong:

• A. NAT spoofing is not a recognized standard attack terminology; NAT (Network Address Translation) is a routing function.
• B. DNS cache poisoning involves corrupting DNS records in a cache to redirect traffic, not spoofing MAC addresses to join a wireless network.
• D. ARP spoofing involves sending false ARP replies to associate an attacker's MAC address with someone else's IP address, but the scenario describes a MAC address duplication rather than ARP poisoning.

Correct answer: D

Wardialing is the technique of using a modem to automatically scan a range of telephone numbers in a systematic manner to discover computers, bulletin board systems, fax machines, and other devices that answer with modem tones. This was a common reconnaissance technique in earlier eras of computing to identify targets for further attack.

Why the other options are wrong:

• A. Demon dialing is not a recognized standard hacking terminology or technique.
• B. Warkitting refers to inserting malicious code or backdoors into wireless routers during manufacturing or supply chain compromise.
• C. War driving involves driving around with a laptop and wireless antenna to discover and map wireless networks, not using modems to scan telephone numbers.

Correct answer: D

Manual network mapping involves gathering technical information about the network infrastructure such as IP addresses (both public and private), performing banner grabbing to identify services and versions, and collecting publicly available information. Collecting detailed employee information is a social engineering and intelligence-gathering step that is part of reconnaissance but is not a standard component of the technical network mapping process itself. The term 'Neotracerouting' appears to be non-standard terminology, but even if it were a valid technique, employee information collection is not part of technical network mapping.

Why the other options are wrong:

• A. Gathering private and public IP addresses is a core part of network mapping to understand the network topology.
• B. This was the published answer, but collecting employee information is reconnaissance rather than technical network mapping.
• C. Banner grabbing identifies running services and their versions by connecting to open ports, which is a fundamental network mapping step.

Correct answer: D

Buffer overflow attacks result directly from poor programming techniques where developers fail to implement proper bounds checking on input data. This allows attackers to write beyond allocated memory boundaries, corrupting the stack and potentially executing arbitrary code. Evasion attacks are techniques to bypass security controls, DoS attacks aim to make services unavailable through resource exhaustion, and Ping of Death is a specific attack using malformed ICMP packets-none of these are inherently caused by poor programming practices in the fundamental sense that buffer overflows are.

Why the other options are wrong:

• A. Evasion attacks are techniques used to circumvent security mechanisms, not inherently rooted in programming vulnerabilities.
• B. Denial-of-Service attacks flood resources but are not specifically a result of poor programming techniques.
• C. Ping of Death exploits a specific network layer limitation rather than being caused by poor programming practices.

Correct answer: A

Removing Internet Printing Protocol (IPP) capability is a countermeasure specifically against IIS buffer overflow vulnerabilities. IPP has been a known vector for buffer overflow attacks in Internet Information Services, particularly in older versions of IIS. By disabling this service, administrators eliminate a common attack surface. While the community vote suggests SNMP enumeration, SNMP is not typically related to IPP services. NetBIOS NULL sessions and DNS zone transfers are separate enumeration techniques not specifically mitigated by removing IPP.

Why the other options are wrong:

• B. NetBIOS NULL sessions are enumerated through different services and ports, not through IPP removal.
• C. SNMP enumeration targets SNMP services on standard ports, not Internet Printing Protocol.
• D. DNS zone transfers are a DNS vulnerability, completely unrelated to IPP or IIS printing services.

Correct answer: D

Ryan's attack is persistent (stored) XSS because he submits the malicious code to a web forum where it is stored on the server. When other users visit the infected page, the code executes automatically in their browsers without any user interaction required. This enables account hijacking and other attacks against multiple victims. Non-persistent XSS requires the victim to click a specially crafted link, DOM-based XSS manipulates client- side objects, and SAX is an XML parsing standard unrelated to XSS attacks.

Why the other options are wrong:

• A. Non-persistent XSS requires the victim to click a malicious link; here the code is stored and automatically executed.
• B. DOM-based XSS manipulates Document Object Model properties but this scenario describes stored/persistent XSS.
• C. SAX is a standard for XML parsing and is not a type of XSS attack.

Correct answer: D

eBlaster is a monitoring Trojan specifically designed to exfiltrate sensitive data from infected systems, including keystrokes, emails, chat conversations, and browsing history. It represents the class of data-sending Trojans that covertly transmit stolen information to remote attackers. SubSeven is a remote access Trojan, Senna Spy Generator is a tool for creating spyware, and Firekiller 2000 is a firewall disabling utility-none are primarily classified as data-sending Trojans in the traditional sense.

Why the other options are wrong:

• A. SubSeven is a remote access Trojan used for system control, not primarily for data exfiltration.
• B. Senna Spy Generator is a creation tool for building spyware, not a Trojan itself.
• C. Firekiller 2000 is designed to disable firewalls, not to send stolen data back to attackers.

Correct answer: B

The input ='or''=' is a classic SQL injection payload designed to manipulate the authentication query. When inserted into a SQL query like SELECT * FROM users WHERE username='='or''='' AND password='='or''='', the condition becomes true because ''='' is always true, bypassing authentication. This grants unauthorized access to the user page. Dictionary attacks involve trying common passwords, replay attacks reuse captured credentials, and Land attacks are network-based DoS attacks-none fit this scenario.

Why the other options are wrong:

• A. Dictionary attacks involve trying lists of common usernames and passwords, not crafted SQL syntax.
• C. Replay attacks capture and retransmit valid authentication credentials, not inject SQL code.
• D. Land attacks are TCP/IP level DoS attacks using forged packets, unrelated to web application input.

Correct answer: C

NetBus is a remote access Trojan that exhibits all the described symptoms: it opens specific ports (commonly 12345 and 12346, matching the observed ports), modifies the Windows registry to achieve persistence by auto-starting with Windows boot, and displays unwanted content including pornographic material. The combination of open ports 12345 and 12346 with registry tampering causing auto-start behavior is the classic signature of NetBus infections. Cheops-ng is a network discovery tool, Elsave is a file encryption ransomware, and NetStumbler is a wireless network scanner-none produce these specific symptoms.

Why the other options are wrong:

• A. Cheops-ng is a legitimate network discovery and scanning utility, not a Trojan that displays pornography.
• B. Elsave is ransomware focused on file encryption, not remote access or displaying inappropriate content.
• D. NetStumbler is a wireless network auditing tool, not a Trojan that would cause these symptoms.

Correct answer: B

Nessus is a widely-used vulnerability scanning tool that integrates with Hydra, a password cracking and dictionary attack tool, to test for weak credentials during vulnerability assessments. Nessus can call Hydra to launch dictionary attacks against discovered services as part of its comprehensive scanning capabilities. This integration allows security professionals to identify both configuration vulnerabilities and weak authentication mechanisms in a single assessment.

Why the other options are wrong:

• A. Whisker is a CGI vulnerability scanner used for web application testing but does not integrate with Hydra for dictionary attacks.
• C. SARA (Security Auditor's Research Assistant) is a vulnerability scanner but is not known for integrating with Hydra for dictionary attack capabilities.
• D. Nmap is a network mapping and port scanning tool that does not perform vulnerability scanning or integrate with Hydra for dictionary attacks.

Correct answer: C

A buffer overflow is a condition in which an application receives or writes more data than it is configured to accept, causing data to overflow into adjacent memory and potentially corrupting other data or enabling arbitrary code execution. Option A describes credential management systems, B describes software update packages, and D describes malware warnings-none of which relate to buffer overflows.

Why the other options are wrong:

• A. Managing security credentials and public keys is the function of cryptographic systems, not buffer overflows.
• B. Collections of files for software updates are unrelated to buffer overflow vulnerabilities.
• D. False virus warnings are malware alerts, not technical descriptions of buffer overflow conditions.

Correct answer: D

Smbclient is the command-line tool used to access Windows resources (shares, printers, files) from a Linux workstation. It implements the SMB/CIFS protocol, which is the native file sharing protocol used by Windows systems. This tool allows Linux users to browse and interact with Windows network resources directly from the command line.

Why the other options are wrong:

• A. Mutt is an email client for Linux, not a tool for accessing Windows network resources.
• B. Scp is a secure copy utility for transferring files between systems over SSH, not specifically for accessing Windows network shares.
• C. Rsync is a file synchronization utility that can work across platforms but is not the standard tool for accessing Windows shares.

Correct answer: B

TCP Connect scan is the most accurate and reliable scan type because it completes full three-way TCP handshakes (SYN, SYN-ACK, ACK) with target ports, providing definitive confirmation of open ports. Since the question specifies that stealth is not a concern, the reliability of TCP Connect scan makes it ideal. UDP scans are unreliable due to ICMP rate limiting, ACK scans don't determine open/closed state, and FIN scans are evasion techniques that sacrifice accuracy for stealth.

Why the other options are wrong:

• A. UDP scans are unreliable because UDP doesn't provide connection confirmation and ICMP rate limiting produces ambiguous results.
• C. ACK scans are used for firewall mapping, not for reliably determining open ports; they cannot definitively identify open or closed states.
• D. FIN scans are evasion techniques designed for stealth rather than accuracy, sacrificing reliability to avoid detection.

Correct answer: D

A virtualized browser creates an isolated sandbox environment that can prevent malware from infecting the host operating system. If malware is downloaded or executed within the virtualized browser, it remains confined to that virtual environment and cannot compromise Windows XP Professional. This is the primary security advantage of browser virtualization. Brute force attacks, mail bombing, and DDoS attacks operate at network and authentication levels that virtualization cannot mitigate.

Why the other options are wrong:

• A. Brute force attacks target authentication mechanisms at the network level, which virtualization does not protect against.
• B. Mail bombing is a network-level attack that affects mail servers and is not mitigated by browser virtualization.
• C. DDoS attacks flood network infrastructure and cannot be prevented by isolating a single browser instance.

Correct answer: C

Reconnaissance is the first phase of hacking where an attacker gathers information about a target without directly interacting with systems. Analyzing a company's career page to identify their technology stack (Windows Server 2003, Active Directory) is classic reconnaissance-passive information gathering used to profile the target organization. Scanning involves active probing, covering tracks involves erasing evidence post-attack, and gaining access involves actual exploitation, none of which apply here.

Why the other options are wrong:

• A. Scanning involves active probing of systems with tools, not passive information gathering from public web pages.
• B. Covering tracks occurs after a successful attack to remove evidence, not during the initial information gathering phase.
• D. Gaining access requires active exploitation of vulnerabilities, which comes after reconnaissance and scanning phases.

Correct answer: C

The string ='or''=' is a classic SQL injection payload that exploits improperly escaped input to bypass authentication logic. The mysql_real_escape_string() function properly escapes special SQL characters in user input, preventing the injected SQL code from being interpreted as query logic. This directly addresses the vulnerability demonstrated by John's successful injection. The escapeshellarg() and escapeshellcmd() functions are for shell command injection prevention, not SQL injection. Session_regenerate_id() manages session security but does not prevent SQL injection at the input level.

Why the other options are wrong:

• A. escapeshellarg() prevents shell command injection, not SQL injection attacks.
• B. session_regenerate_id() manages session tokens and does not prevent SQL injection in login queries.
• D. escapeshellcmd() prevents shell metacharacter exploitation, not SQL injection in database queries.

Correct answer: C

A brute force attack is defined as systematically trying all possible password combinations until the correct one is found. The scenario describes exactly this: software automatically attempting password combinations until successful. This is the fundamental definition of a brute force attack. Denial-of-Service attacks disrupt availability, man-in-the-middle attacks intercept communications, and vulnerability is a weakness in systems rather than an attack type.

Why the other options are wrong:

• A. Denial-of-Service attacks overwhelm resources to disrupt availability, not attempt authentication with multiple passwords.
• B. Man-in-the-middle attacks intercept and modify communications between parties, not try password combinations.
• D. Vulnerability refers to a weakness in a system, not an attack technique or method.

Correct answer: D

Ping sweep scan uses ICMP ECHO Requests to rapidly identify live hosts on a network by broadcasting ping requests to a range of IP addresses and analyzing responses. This is the standard technique for quick network discovery and host enumeration. Idle scan, TCP SYN scan, and XMAS scan are specialized port scanning techniques designed to determine port status on specific hosts, not for rapid live host detection across a network range.

Why the other options are wrong:

• A. Idle scan is used for stealthy port scanning on specific hosts, not for rapid network- wide host discovery.
• B. TCP SYN scan detects open/closed ports on known hosts, not for discovering live hosts across a network.
• C. XMAS scan is a port scanning technique to identify port states, not for discovering live hosts across subnets.

Correct answer: B

The scan sends FIN packets to ports and interprets responses: open ports produce no response, while closed ports respond with RST/ACK. This is the classic behavior of a FIN scan, which exploits RFC 793 stipulations that closed ports should respond to unexpected packets with a reset. FIN scans are used for stealthy port discovery. ACK scan tests firewall rules, XMAS scan combines FIN, PSH, and URG flags, and idle scan uses zombie hosts-none match this behavior pattern.

Why the other options are wrong:

• A. ACK scan sends ACK packets to determine firewall filtering rules, not to identify open/closed ports by FIN response behavior.
• C. XMAS scan sends packets with FIN, PSH, and URG flags set simultaneously, not individual FIN packets.
• D. Idle scan uses a third-party zombie host to bounce packets, not direct client-to-target FIN packet exchanges.

Correct answer: C

Win32/Conficker (also known as Conficker) is the well-documented network worm that exploits the DCERPC (Distributed Computing Environment/Remote Procedure Call) vulnerability in Windows operating systems, particularly affecting systems without the MS08-067 patch. It spreads through network shares and USB drives, making it a significant RPC-based worm. Win32/Agent is a Trojan, WMA/TrojanDownloader.GetCodec targets media players, and Win32/PSW.OnLineGames is a password stealer-none are RPC-exploiting worms.

Why the other options are wrong:

• A. Win32/Agent is a Trojan malware family, not an RPC vulnerability-exploiting network worm.
• B. WMA/TrojanDownloader.GetCodec targets media codec vulnerabilities, not RPC subsystems in Windows.
• D. Win32/PSW.OnLineGames is a password-stealing Trojan targeting gaming accounts, not an RPC vulnerability worm.

Correct answer: C

A Denial-of-Service (DoS) attack is specifically designed to degrade or eliminate the performance and availability of a computer or network by overwhelming it with requests or traffic. Vulnerability attacks target weaknesses to gain access, man-in-the-middle attacks intercept communications, and impersonation attacks involve pretending to be someone else-none of these have the primary objective of degrading performance.

Why the other options are wrong:

• A. Vulnerability attacks aim to exploit weaknesses for unauthorized access, not to degrade performance.
• B. Man-in-the-middle attacks focus on intercepting and eavesdropping on communications, not degrading performance.
• D. Impersonation attacks involve assuming a false identity to gain access, not attacking performance.

Correct answer: C

Session hijacking refers to the exploitation of an already-authenticated user session to gain unauthorized access to systems or information without needing to provide credentials. Piggybacking involves physical tailgating, hacking is a broad term for unauthorized access, and keystroke logging captures key presses-none specifically describe exploiting an existing valid session.

Why the other options are wrong:

• A. Piggybacking refers to physical unauthorized entry by following someone through a door, not exploiting sessions.
• B. Hacking is a general term for unauthorized computer access and doesn't specifically refer to session exploitation.
• D. Keystroke logging records keystrokes to capture credentials or information, not exploit existing sessions.

Correct answer: A

A worm is malicious software that propagates automatically across networks without requiring user interaction or assistance, spreading from one system to another independently. Viruses require user action to spread, Trojan horses do not self-replicate or spread independently, and hoaxes are false alerts rather than executable malicious code.

Why the other options are wrong:

• B. Viruses require user action or execution to spread, unlike worms which spread autonomously.
• C. Trojan horses do not self-replicate or spread on their own; they must be manually deployed.
• D. Hoaxes are false security warnings or scareware, not actual malicious software that travels networks.

Correct answer: C

The fundamental difference between a worm and a Trojan horse is that a worm is self- replicating and can spread autonomously across networks, while a Trojan horse is a non- replicating malicious program that relies on social engineering or deception to be installed. Worms do not need user intervention once they begin spreading, whereas Trojan horses are static pieces of malware.

Why the other options are wrong:

• A. Both worms and Trojans can spread via email; email is not exclusive to worms.
• B. Both worms and Trojan horses are forms of malicious programs, not utilities.
• D. Both are malicious programs; neither is antivirus software.

Correct answer: A

Adam's attack was social engineering-he created a trusted-looking webpage to entice employees to click on embedded malicious code (a keylogger). The firewall did not detect this attack because the webpage appeared legitimate and came through normal web traffic, and social engineering relies on human psychology rather than technical exploitation. This bypassed the firewall's network-level protections because the threat was delivered through trust and deception.

Why the other options are wrong:

• B. Security was compromised; even if internally hosted, the embedded keylogger represents a successful attack.
• C. While this could involve XSS techniques, the answer misses the social engineering component and incorrectly states the firewall blocked it.
• D. While it's true keyloggers may be invisible to firewalls, this doesn't explain the social engineering mechanism used to deploy it.

Correct answer: D

A sniffer (packet sniffer) can detect session hijacking by capturing and analyzing network traffic to identify anomalous patterns, such as unexpected sequence numbers, out-of-order packets, or duplicate acknowledgments that indicate session hijacking. Nmap is a port scanner, Brutus is a password cracking tool, and ntop is a network monitoring tool-while ntop could help with traffic analysis, a sniffer is the most direct and appropriate tool for detecting hijacking at the packet level.

Why the other options are wrong:

• A. Nmap is a port scanning tool used for network discovery and enumeration, not for detecting active session hijacking.
• B. Brutus is a password cracking and brute-force tool, not designed to detect session hijacking attacks.
• C. Ntop is a network traffic monitoring tool, but it is not specifically designed or commonly used for detecting session hijacking attacks.

Correct answer: A

SPI (Stateful Packet Inspection) is most useful against DoS attacks because it monitors the state of active connections and can identify and block suspicious traffic patterns characteristic of DoS attacks, such as incomplete connection attempts or unusual traffic volumes. SPI firewalls can detect and mitigate both volumetric and protocol-based DoS attacks by analyzing packet states.

Why the other options are wrong:

• B. A distributive firewall is not specifically designed to prevent DoS attacks; it focuses on distributed architecture rather than attack prevention mechanisms.
• C. Honey pots are used for detection and research of attacks, not for preventing DoS attacks from affecting the network.
• D. Internet bots are tools used by attackers to launch DoS attacks, not to prevent them.

Correct answer: D

ICMP type 3 (Destination Unreachable) messages are used by Hping2 and similar tools to conduct covert scans and reconnaissance of internal networks. By blocking ICMP type 3 messages outbound, the network prevents attackers from using these messages to map the network topology and identify active hosts. Blocking outbound ICMP type 3 responses denies the attacker feedback necessary for scanning.

Why the other options are wrong:

• A. Blocking port 21 (FTP) does not specifically address the covert channels used by Hping2.
• B. Blocking port 53 (DNS) is not directly relevant to preventing Hping2-based network scanning.
• C. ICMP type 13 (Timestamp Request) is less commonly used by Hping2 for network reconnaissance compared to type 3 messages.

Correct answer: D

RF (Radio Frequency) jamming attack is a layer 2 DoS attack that disrupts wireless communications at the physical/data link layer by flooding the frequency spectrum with noise, preventing legitimate data transmission. This directly targets layer 2 (data link layer) functionality.

Why the other options are wrong:

• A. Spoofing attacks operate at higher layers and are not classified as layer 2 DoS attacks.
• B. SYN flood attacks operate at layer 4 (transport layer), not layer 2.
• C. Password cracking is an access control attack, not a layer 2 DoS attack.

Correct answer: D

A dramatic increase in broadcast traffic is a strong indicator of a DoS attack, particularly broadcast-based DoS attacks such as smurf attacks or UDP floods that generate excessive broadcast packets to overwhelm network capacity and consume bandwidth, degrading network performance.

Why the other options are wrong:

• A. While some viruses may generate traffic, a sudden dramatic increase in broadcast traffic is more characteristic of a targeted DoS attack.
• B. SYN floods target specific hosts with unicast traffic, not broadcast traffic.
• C. A misconfigured router might cause some unusual traffic, but a dramatic spike in broadcasts is more indicative of an active attack than a configuration issue.

Correct answer: C

Monitoring unauthorized zone transfers is a critical security reason for implementing logging on DNS servers. Zone transfers should only occur between authorized primary and secondary DNS servers; logging allows administrators to detect and investigate unauthorized zone transfer attempts, which could indicate DNS compromise or reconnaissance by attackers.

Why the other options are wrong:

• A. Security logging does not directly prevent malware attacks; it records events for detection and analysis.
• B. Performance measurement is an operational concern, not a security reason for logging.
• D. Recording query counts is a performance metric, not a security objective for logging.

Correct answer: B

EliteWrap is a known tool that combines two programs and encrypts the resulting package to evade antivirus detection. It wraps executables together and applies encryption to obscure the code from antivirus scanners, making it difficult for security software to identify and analyze malicious components.

Why the other options are wrong:

• A. Trojan Man is not a recognized tool for combining and encrypting programs to foil antivirus software.
• C. Tiny is not a recognized tool with these specific characteristics of combining and encrypting packages.
• D. NetBus is a remote access trojan, not a tool designed to combine programs and encrypt packages to evade antivirus.

Correct answer: A

Spector is spy software specifically designed for Macintosh systems that monitors and records user activity through snapshots, keystroke logging, and website history logging. It captures detailed information about user behavior on Mac systems without user knowledge.

Why the other options are wrong:

• B. Magic Lantern is primarily associated with Windows systems, not Macintosh systems.
• C. eBlaster is primarily designed for Windows monitoring, not Macintosh systems.
• D. NetBus is a remote access trojan for Windows systems, not Macintosh spyware.

Correct answer: C

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunS ervices HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is the correct registry key for programs that execute at system startup in Windows 2003. The RunServices key specifically holds services and background programs that launch during the boot process and continue running in the background, making it the ideal location for persistent malware placement.

Why the other options are wrong:

• A. The Startup key refers to the user's Startup folder, not a registry key for system-wide persistence.
• B. The Auto key does not exist as a standard Windows registry location for startup programs.
• D. The Start key does not exist in this path and is not used for startup program configuration.

Correct answer: A

Manual telnet connections to open ports (A) provide the most accurate method for identifying services because they allow direct interaction with the service banner and protocol responses. Telnet reveals authentic service information, version details, and protocol specifics through actual communication. While port scanners and vulnerability scanners provide useful data, they rely on signature matching and can produce false positives. The manual telnet method provides definitive confirmation through direct service interrogation.

Why the other options are wrong:

• B. Port scanners rely on signature databases and assumptions; they can misidentify services and produce false positives.
• C. Hit and trial guessing is unreliable and inefficient for accurate service identification.
• D. Vulnerability scanners attempt probing but rely on signatures and heuristics, less accurate than direct service interrogation via telnet.

Correct answer: D

Jason's critical mistake was failing to cover his tracks (D). By leaving Trojan files, log files, and other forensic evidence on the compromised systems, he provided clear indicators of the compromise that allowed the forensic investigators to discover his attack, trace his actions, and ultimately identify him. Proper track-covering techniques-such as clearing logs, removing artifacts, and sanitizing evidence-are essential for maintaining stealth after gaining access. While the other phases of hacking are important for initial access, the failure to eliminate evidence was the decisive factor that led to his capture.

Why the other options are wrong:

• A. Vulnerability assessment is for defenders; attackers exploit vulnerabilities, they don't assess them.
• B. OS fingerprinting is a reconnaissance technique; its omission wouldn't help investigators catch him.
• C. Footprinting is early reconnaissance; its absence wouldn't create forensic evidence.
• E. Port scanning is reconnaissance; its omission wouldn't leave forensic traces.

Correct answer: D

The nmap -sU flag performs a UDP port scan. UDP (User Datagram Protocol) scanning is used to discover open UDP ports on target systems. This is distinct from TCP scanning methods. The -sY flag is for SCTP scanning, -sS performs a TCP SYN stealth scan, and -sN performs a TCP Null scan. The -sU flag is the correct and standard Nmap option for UDP port scanning.

Why the other options are wrong:

• A. nmap -sY performs SCTP scanning, not UDP scanning.
• B. nmap -sS performs a TCP SYN stealth scan, not UDP scanning.
• C. nmap -sN performs a TCP Null scan, not UDP scanning.

Correct answer: B

Code review is the most effective method for finding flaws in web applications because it allows for thorough examination of application logic, data validation, and security controls at the source level. While vulnerability scanning and penetration testing are useful, code review provides the deepest insight into application design flaws before deployment. Manual penetration testing is time-consuming and may not catch all issues, while automated scanning typically only finds known signatures.

Why the other options are wrong:

• A. Manual penetration testing is reactive and time-consuming, occurring after deployment rather than during development.
• C. Automated penetration testing may miss logic flaws and zero-day vulnerabilities specific to custom application code.
• D. Vulnerability scanning detects known issues but cannot identify custom application logic flaws or design weaknesses.

Correct answer: C

The single quote (') character is the standard test vector for SQL injection vulnerabilities because it terminates SQL string literals and allows an attacker to inject arbitrary SQL commands. When a single quote is inserted into a vulnerable parameter and causes an error or unexpected behavior, it indicates the application does not properly sanitize input. This is the most commonly used and reliable test character for identifying SQL injection flaws.

Why the other options are wrong:

• A. Dashes are used in SQL comments but are not the primary probe character for injection detection.
• B. Double quotes are less commonly used as a test vector since many SQL implementations use single quotes for string literals.
• D. Semicolons terminate SQL statements but are not the initial probe character and are often filtered.

Correct answer: A

Dskprobe is a forensic tool designed to examine disk sectors and file structures, enabling detection of hidden data embedded within files or disk space. It can identify steganographic content by revealing anomalies in data patterns and unused space. ImageHide and Snow are steganography tools used to hide data, not detect it. Blindside is not a recognized steganography detection tool.

Why the other options are wrong:

• B. Blindside is not a standard tool for steganography detection.
• C. ImageHide is a steganography tool for hiding data, not for detecting it.
• D. Snow is a steganography tool used to conceal messages in whitespace, not to detect steganography.

Correct answer: A

TCP FIN scanning sends FIN packets and receives RST packets from Windows systems regardless of port state. Windows (and other operating systems) respond to FIN probes on closed ports with RST packets, whereas open ports typically do not respond or respond differently. This behavior is characteristic of FIN scanning and helps identify port states through the absence or presence of responses.

Why the other options are wrong:

• B. FTP bounce scanning relies on FTP server behavior, not RST packet responses from the target system.
• C. XMAS scanning sends packets with FIN, PSH, and URG flags set and produces different response patterns on Windows.
• D. TCP SYN scanning uses SYN packets and receives SYN-ACK or RST responses depending on port state, not RST on both states.

Correct answer: A

wget is a command-line utility specifically designed to download files and web pages from websites to a local system. It supports recursive downloads, can mirror entire websites, and is widely used for web scraping and archiving. jplag is a plagiarism detection tool, Nessus is a vulnerability scanner, and Ettercap is a network security tool for man-in-the- middle attacks.

Why the other options are wrong:

• B. jplag is used for detecting plagiarism in code and documents, not downloading web pages.
• C. Nessus is a vulnerability assessment scanner, not a web download tool.
• D. Ettercap is a network sniffing and manipulation tool used for security testing, not web page downloading.

Correct answer: B

Session hijacking is the technique of taking control of an established session between a client and server, particularly with unencrypted protocols like TELNET and FTP. The attacker intercepts and takes over the communication stream after authentication occurs, allowing them to execute commands or access resources with the victim's privileges.

Why the other options are wrong:

• A. Dictionary attacks target password authentication by trying common words and phrases, not by taking control of active sessions.
• C. Trojan horses are malicious programs that must be installed on a system; they don't inherently take control of network sessions between existing client-server connections.
• D. Social engineering manipulates people into divulging confidential information or taking certain actions; it doesn't directly take control of TCP/IP sessions.

Correct answer: A

Using printf(str) instead of printf("%s", str) creates a format string vulnerability. When user input is passed directly as the format string argument, an attacker can craft input containing format specifiers (like %x, %n) to read from or write to arbitrary memory locations, potentially leading to information disclosure or code execution.

Why the other options are wrong:

• B. Cross Site Scripting (XSS) attacks involve injecting malicious scripts into web pages; this is a backend C/C++ printf issue unrelated to web page rendering.
• C. SQL injection attacks target databases through improper handling of SQL queries; printf format string vulnerabilities are distinct memory manipulation issues.
• D. Sequence++ is not a recognized attack vector; it appears to be a fabricated term.

Correct answer: D

MD5 hashing provides cryptographic verification of file integrity. By comparing the MD5 signature of the downloaded software against the published hash on the official distribution media, Adam can definitively verify that the software has not been modified, corrupted, or trojaned. Any modification to the file will produce a different hash value.

Why the other options are wrong:

• A. File size can be easily manipulated by trojaned software and is not a reliable indicator of authenticity.
• B. Version numbers can be spoofed by attackers and provide no cryptographic proof of integrity.
• C. Virus signatures only detect known malware; they won't catch zero-day trojans or malicious modifications not in the signature database.