GIAC Certified Incident Handler (GCIH) — Question 94

Which of the following occurs when a penetration tester attempts to connect to a host with the following command? net use \\192.168.44.213

Answer options

• A. Guest user account permissions will be granted
• B. Local logon credentials will be sent to 192.168.44.213
• C. IPC$ share returns a list of running processes
• D. Host at 192.168.44.213 will exchange a temporary authentication key

Correct answer: C

Explanation

The correct answer is C because the IPC$ share is a special administrative share that allows access to information about running processes on the target system. Option A is incorrect as guest account permissions are not automatically granted. Option B is wrong because while credentials may be used, they aren't specifically sent in this command. Option D is also incorrect since no temporary authentication key is exchanged with this command.