10 free GIAC Certified Incident Handler GCIH practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 842 questions. Work through them, then open each answer to check your reasoning.
Get all 842 questions (US$39) · Download these 10 as a PDF
Question 1
Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team.
As a demo project he asked members of the incident response team to perform the following actions:
• Remove the network cable wires.
• Isolate the system on a separate VLAN
• Use a firewall or access lists to prevent communication into or out of the system.
• Change DNS entries to direct traffic away from compromised system
Which of the following steps of the incident handling process includes the above actions?
Show answer and explanation
Correct answer: B. Containment
All four actions listed, removing network cables, isolating on a VLAN, using firewalls/access lists, and changing DNS entries, are classic containment measures designed to limit the scope and impact of a security incident. Containment is the phase where responders take steps to stop the attack from spreading and prevent further damage, while preserving evidence. Identification focuses on detecting the incident, eradication removes the threat, and recovery restores systems to normal operation.
Why the other options are wrong
- A. Identification is the detection and confirmation of a security incident, not the implementation of isolation measures.
- C. Eradication removes the attacker's tools and access, but the listed actions are preventative controls rather than removal steps.
- D. Recovery restores systems to normal operation after the threat is eliminated; it does not involve isolation or access prevention.
Question 2
Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd.
Which of the following is the mostly likely the cause of the problem?
Show answer and explanation
Correct answer: A. Computer is infected with the stealth kernel level rootkit.
A stealth kernel-level rootkit runs at the deepest level of the operating system and controls what the OS reports, so it can hide files, processes, and disk consumption from antivirus and anti-spyware tools. That matches the symptoms exactly: a patched, protected machine that steadily slows down, shows pop-ups that appear and vanish even when offline, and loses roughly 190 GB of disk space while the security software reports nothing. Hidden resource consumption combined with clean scans is the classic signature of a kernel-level rootkit.
Why the other options are wrong
- B. A stealth virus hides changes to the files it infects, but it spreads through host files rather than concealing an entire OS-level footprint and massive disk use.
- C. Trojan programs rely on tricking the user into running them and do not subvert the kernel to conceal hidden resource consumption.
- D. A worm spreads copies across networks and shares, generating traffic and files that installed antivirus software would very likely flag.
Question 3
Which of the following types of attacks is only intended to make a computer resource unavailable to its users?
Show answer and explanation
Correct answer: A. Denial of Service attack
A Denial of Service (DoS) attack is specifically designed and intended solely to make a resource unavailable to legitimate users by overwhelming it with traffic or exploiting vulnerabilities to crash the service. The defining characteristic of a DoS attack is that its only goal is availability disruption, not data theft, authentication bypass, or other objectives.
Why the other options are wrong
- B. A replay attack involves capturing and resending valid data to impersonate a user or gain unauthorized access, not merely denying availability.
- C. A teardrop attack is a specific DoS technique that sends fragmented packets, but it is a type of DoS rather than the category that encompasses only availability attacks.
- D. A land attack sends spoofed packets with the target's own IP as both source and destination, designed to crash the system, but is a specific DoS variant rather than the general category.
Question 4
Which of the following types of attack can guess a hashed password?
Show answer and explanation
Correct answer: A. Brute force attack
A brute force attack systematically tries many password combinations or hashes until a match is found. When attacking a hashed password, an attacker can generate hashes of candidate passwords and compare them to the target hash, a process that is computationally intensive but does not require the hash to be reversed. Brute force is the fundamental technique for guessing hashed passwords.
Why the other options are wrong
- B. Evasion attacks are techniques to bypass security controls and detection systems, not password cracking methods.
- C. Denial of Service attacks aim to disrupt availability, not to guess or crack passwords.
- D. Teardrop attacks are a fragmented packet DoS technique with no connection to password guessing or hashing.
Question 5
In which of the following DoS attacks does an attacker send an ICMP packet larger than 65,536 bytes to the target system?
Show answer and explanation
Correct answer: A. Ping of death
The Ping of Death is a classic DoS attack in which the attacker sends an ICMP echo request that, after reassembly, exceeds the 65,535-byte maximum size of an IP packet. Older TCP/IP stacks did not validate the reassembled length, so the oversized packet caused a buffer overflow, crash, freeze, or reboot of the target.
Why the other options are wrong
- B. Jolt sends a stream of fragmented ICMP packets against older Windows systems rather than the classic oversized ping.
- C. Fraggle floods a target with spoofed UDP echo and chargen traffic aimed at a broadcast address, not with oversized ICMP packets.
- D. Teardrop sends IP fragments with overlapping offsets that break reassembly logic; the fragments themselves are not oversized.
Question 6
Adam has installed and configured his wireless network. He has enabled numerous security features such as changing the default SSID, enabling WPA encryption, and enabling MAC filtering on his wireless router. Adam notices that when he uses his wireless connection, the speed is sometimes 16 Mbps and sometimes it is only 8 Mbps or less. Adam connects to the management utility wireless router and finds out that a machine with an unfamiliar name is connected through his wireless connection. Paul checks the router's logs and notices that the unfamiliar machine has the same MAC address as his laptop.
Which of the following attacks has been occurred on the wireless network of Adam?
Show answer and explanation
Correct answer: C. MAC spoofing
MAC spoofing occurs when an attacker configures their network interface card to use a different MAC address than the one assigned by the manufacturer. In this case, the unfamiliar machine connected to Adam's wireless network has the same MAC address as Adam's laptop, meaning someone has spoofed Adam's MAC address to gain access to his network. Despite MAC filtering being enabled, the attacker mimicked Adam's laptop's MAC address to bypass this control.
Why the other options are wrong
- A. NAT spoofing is not a recognized standard attack terminology; NAT (Network Address Translation) is a routing function.
- B. DNS cache poisoning involves corrupting DNS records in a cache to redirect traffic, not spoofing MAC addresses to join a wireless network.
- D. ARP spoofing involves sending false ARP replies to associate an attacker's MAC address with someone else's IP address, but the scenario describes a MAC address duplication rather than ARP poisoning.
Question 7
Which of the following is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems, and fax machines?
Show answer and explanation
Correct answer: D. Wardialing
Wardialing uses a modem to automatically dial a range of phone numbers, typically an entire area code, to find computers, BBSes, fax machines, and other devices answering with modem tones. It was a standard way to locate unsecured dial-up entry points.
Why the other options are wrong
- A. Demon dialing repeatedly dials a single number or modem to break in or tie it up, rather than scanning a block of numbers.
- B. Warkitting replaces the firmware of a deployed wireless router with the attacker's version to control traffic through it.
- C. War driving means roaming with a laptop and wireless antenna to find and map wireless networks, not dialing phone numbers.
Question 8
Network mapping provides a security testing team with a blueprint of the organization.
Which of the following steps is NOT a part of manual network mapping?
Show answer and explanation
Correct answer: D. Performing Neotracerouting
Manual network mapping is the work a tester performs by hand: gathering private and public IP addresses, collecting employee and organizational information from public sources, and banner grabbing to identify services and versions. NeoTrace is a commercial route-tracing product, so performing Neotracerouting is automated, tool-driven mapping rather than a manual step. That places it outside the manual network mapping process described in the question.
Why the other options are wrong
- A. Gathering private and public IP addresses is a core manual step used to outline the target address space and topology.
- B. Collecting employee information is compiled by hand from public sources and is part of manual mapping and footprinting.
- C. Banner grabbing identifies running services and their versions by connecting to open ports, which a tester can do manually with a simple client.
Question 9
Which of the following statements are true about tcp wrappers?
Each correct answer represents a complete solution. (Choose all that apply.)
Show answer and explanation
Correct answer: A, B, C
A. tcp wrapper provides access control, host address spoofing, client username lookups, etc. B. When a user uses a TCP wrapper, the inetd daemon runs the wrapper program tcpd instead of running the server program directly. C. tcp wrapper allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens to filter for access control purposes. TCP wrappers is a host-based access control mechanism that screens service requests before they reach the real daemon. A is true: its documented features are access control, host name and address spoofing detection, and client username lookups via ident. B is true: inetd launches the tcpd wrapper, which evaluates the request against hosts.allow and hosts.deny before handing the connection to the actual server. C is true: host and subnetwork IP addresses, host names, and ident replies are all valid tokens in those rule files. Detecting name to address mismatches is not the same as stopping forged source addresses, so only A, B, and C apply.
Why the other options are wrong
- D. TCP wrappers cannot stop IP spoofing, which occurs at the network layer, while the wrapper filters only on unverified source addresses at the application layer.
Question 10
Which of the following types of attacks is the result of vulnerabilities in a program due to poor programming techniques?
Show answer and explanation
Correct answer: D. Buffer overflow attack
Buffer overflow attacks result directly from poor programming techniques where developers fail to implement proper bounds checking on input data. This allows attackers to write beyond allocated memory boundaries, corrupting the stack and potentially executing arbitrary code. Evasion attacks are techniques to bypass security controls, DoS attacks aim to make services unavailable through resource exhaustion, and Ping of Death is a specific attack using malformed ICMP packets, none of these are inherently caused by poor programming practices in the fundamental sense that buffer overflows are.
Why the other options are wrong
- A. Evasion attacks are techniques used to circumvent security mechanisms, not inherently rooted in programming vulnerabilities.
- B. Denial-of-Service attacks flood resources but are not specifically a result of poor programming techniques.
- C. Ping of Death exploits a specific network layer limitation rather than being caused by poor programming practices.
That was 10 of 842.
The full GIAC Certified Incident Handler GCIH pack has all 842 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.