Online Access Free GCED Practice Test

What does the following WMIC command accomplish?
process where name='malicious.exe' delete

• A.Stops the 'malicious.exe' process from running and being restarted at the next reboot
• B.Stops current process handles associated with the process named 'malicious.exe'
• C.Removes the 'malicious.exe' process form the Start menu and Run registry key
• D.Removes the executable 'malicious.exe' from the file system

A company wants to allow only company-issued devices to attach to the wired and wireless networks.
Additionally, devices that are not up-to-date with OS patches need to be isolated from the rest of the network until they are updated. Which technology standards or protocols would meet these requirements?

• A.802.1x and Network Access Control
• B.802.11i and Authentication, Authorization and Accounting (AAA)
• C.LDAP and Authentication, Authorization and Accounting (AAA)
• D.Kerberos and Network Access Control

An incident response team investigated a database breach, and determined it was likely the result of an internal user who had a default password in place. The password was changed. A week later, they discover another loss of database records. The database admin provides logs that indicate the attack came from the front-end web interface. Where did the incident response team fail?

• A.They did not lock the account after changing the password
• B.They did not properly identify the source of the breach
• C.They did not eradicate tools left behind by the attacker
• D.They did not patch the database server after the event

Which of the following is an outcome of the initial triage during incident response?

• A.Determining whether encryption is in use on in scope systems
• B.Removal of unnecessary accounts from compromised systems
• C.Segmentation of the network to protect critical assets
• D.Resetting registry keys that vary from the baseline configuration

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

• A.Media from the infected host, copied to the dedicated IR host
• B.Restored media from full backup of the infected host
• C.Original media from the infected host
• D.Bit-for-bit image from the infected host