GPEN GIAC Exam Questions and Free Practice Test

Question 37

- (Topic 1)
Analyze the command output below. What information can the tester infer directly from the information shown?
GPEN dumps exhibit

A. The administrator account has no password

B. Null sessions are enabled on the target

C. The target host is running Linux with Samba services

D. Account lockouts must be reset by the Administrator

Correct Answer:C

Question 38

- (Topic 1)
You are conducting a penetration test for a private contractor located in Singapore. The scope extends to all internal hosts controlled by the company, you have gathered necessary hold-harmless and nondisclosure agreements. Which action by your group can incur criminal liability under Chapter 50a, Computer Misuse Act?

A. Exploiting vulnerable web services on internal hosts

B. Attempts at social engineering employees via telephone calls

C. Testing denial-of-service tolerance of the communications provider

D. Cracking password hashes on the corporate domain server

Correct Answer:D

Question 39

- (Topic 4)
Which of the following tools is a wireless sniffer and analyzer that works on the Windows operating system?

A. Aeropeek

B. Kismet

C. Airsnort

D. Void11

Correct Answer:A

Question 40

- (Topic 4)
Which of the following tools allow you to perform HTTP tunneling?
Each correct answer represents a complete solution. Choose all that apply.

A. BackStealth

B. HTTPort

C. Tunneled

D. Nikto

Correct Answer:ABC

Question 41

- (Topic 1)
While performing an assessment on a banking site, you discover the following link:
hnps://mybank.com/xfer.aspMer_toMaccount_number]&amount-[dollars]
Assuming authenticated banking users can be lured to your web site, which crafted html
tag may be used to launch a XSRF attack?

A. <imgsrc-"javascript alert (‘document cookie'):">

B. alert('hnps:/'mybank.com/xfer.a$p?xfer_io-[attacker_account]&amoutn-[dollars]')[removed]

C. document.\write('hTtp$://mybankxom/xfer.a$p?xfer_to-[attacker.accountl &amount-[dollars)[removed]

Correct Answer:C

Question 42

- (Topic 2)
John works as a Professional Penetration Tester. He has been assigned a project to test the Website security of www.we-are-secure Inc. On the We-are-secure Website login page, he enters='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-are-secure Inc. to improve the login page PHP script. Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

A. Use the session_regenerate_id() function

B. Use the escapeshellcmd() function

C. Use the mysql_real_escape_string() function for escaping input

D. Use the escapeshellarg() function

Correct Answer:C

START GPEN EXAM