GCIH (GIAC Certified Incident Handler) 3
Exam Questions And Answers
Server-Side Request Forgery (SSRF) - ANS Allows the threat actor to read the source
code of the software/server (EX: CRM software exposed to internet). Gets around logins
Command Injection - ANS allow ability to run arbitrary commands without needing to be
logged in.
PICERL - ANS 6 step Incident Response process
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
DIAR - ANS A frame work that is more dynamic for incident response, is the one with a
circle in the middle of the line.
Get-CimInstance - ANS CIM is the Common Information Model part of WMI and lets us
interrogate detailed information about the windows host. It can tell you the process ID, name,
command line details and more.
Exam Questions And Answers
Server-Side Request Forgery (SSRF) - ANS Allows the threat actor to read the source
code of the software/server (EX: CRM software exposed to internet). Gets around logins
Command Injection - ANS allow ability to run arbitrary commands without needing to be
logged in.
PICERL - ANS 6 step Incident Response process
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
DIAR - ANS A frame work that is more dynamic for incident response, is the one with a
circle in the middle of the line.
Get-CimInstance - ANS CIM is the Common Information Model part of WMI and lets us
interrogate detailed information about the windows host. It can tell you the process ID, name,
command line details and more.
