GCIH Adam Practice Questions

Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team. As a demo project he asked members of the incident response team to perform the following actions: Remove the network cable wires. Isolate the system on a separate VLAN Use a firewall or access lists to prevent communication into or out of the system. Change DNS entries to direct traffic away from compromised system Which of the following steps of the incident handling process includes the above actions?

• AA. Identification
• BB. Containment
• CC. Eradication
• DD. Recovery

Adam works as a Security Analyst for Umbrella Inc. Company has a Windows-based network. All computers run on Windows XP. Manager of the Sales department complains Adam about the unusual behavior of his computer. He told Adam that some pornographic contents are suddenly appeared on his computer overnight. Adam suspects that some malicious software or Trojans have been installed on the computer. He runs some diagnostics programs and Port scanners and found that the Port 12345, 12346, and 20034 are open. Adam also noticed some tampering with the Windows registry, which causes one application to run every time when Windows start. Which of the following is the most likely reason behind this issue?

• AA. Cheops-ng is installed on the computer.
• BB. Elsave is installed on the computer.
• CC. NetBus is installed on the computer.
• DD. NetStumbler is installed on the computer.

5.2.92:4079<-----RST/ACK----------192.5.2.110:23 Which of the following types of port scan is Adam running?

• AA. ACK scan
• BB. FIN scan
• CC. XMAS scan
• DD. Idle scan