GIAC GCIH dumps - 100% Pass Guarantee!

Why should organizations consider disabling auto-run as part of their Windows system hardening baselines?

A. Disabling auto-run prevents data transfer from external media to the hard drive

B. To help prevent malware from spreading through external media

C. To eliminate the risk of connecting unauthorized wireless devices

D. To prevent users from copying sensitive data to external media

Analysis of malicious code identifies a function that searches for specific processes and hardware on a victim host. If the processes or hardware are found, the malicious executable does not install itself. What is a common purpose of this type of malware functionality?

A. Detecting virtual machines

B. Remote code execution

C. Running polymorphic code

D. Disabling local anti-virus

A company's external DNS server was used by an attacker in a DDoS attack against a third party. Which of the following configurations should be changed to prevent this from happening again?

A. Disable recursive DNS queries on the server

B. Do not allow TCP to be used for large DNS queries

C. Require DNSSEC for DNS zone transfers

D. Remove the forward lookup zone on the server

Which of the following BEST represents a true virtual machine escape?

A. An attacker who has compromised a virtual machine using VMcat to run code on the physical host

B. An attacker who has compromised a virtual machine mapping a network drive on the physical host using SMB

C. An attacker who has compromised a virtual machine sniffing network traffic to and from the physical host

D. An attacker who has compromised a virtual machine, able to directly execute code on the physical host

Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters?

tcpdump -nn -r pingout.pcap `icmp and (dst host 8.8.8.8)'

A. 09:31:00.928389 IP 192.168.1.14.63263 > 8.8.8.8.33595: UDP, length 24

B. 08:54:07.451392 IP 8.8.8.8 > 192.168.1.14: ICMP echo reply, id 36234, seq 3, length 64

C. 09:06:09.085200 IP 192.168.1.14.49655 > 8.8.8.8.22: Flags [S], seq 2144394082, win 65535, options [mss 1460,sackOK,eol], length 0

D. 08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64