GCED Practice Test practice questions, page 2 of 4, with answer review and explanations.
Question 6
Which of the following attacks would use ".." notation as part of a web request to access restricted files and directories, and possibly execute code on the web server?
URL directory
HTTP header attack
SQL injection
IDS evasion
Cross site scripting
Question 7
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
To create a file on the USB drive that contains a listing of the C: drive
To show hidden and archived files on the C: drive and copy them to the USB drive
To copy a forensic image of the local C: drive onto the USB drive
To compare a list of known good hashes on the USB drive to files on the local C: drive
Question 8
Why might an administrator not be able to delete a file using the Windows del command without specifying additional command line switches?
Because it has the read-only attribute set
Because it is encrypted
Because it has the nodel attribute set
Because it is an executable file
Question 9
Why would the pass action be used in a Snort configuration file?
The pass action simplifies some filtering by specifying what to ignore.
The pass action passes the packet onto further rules for immediate analysis.
The pass action serves as a placeholder in the snort configuration file for future rule updates.
Using the pass action allows a packet to be passed to an external process.
The pass action increases the number of false positives, better testing the rules.
Question 10
On which layer of the OSI Reference Model does the FWSnort utility function?