GCIH Practice Test 1 — 10 Questions

Question 1

An analyst uses an LLM to generate a C++ exploit. The model provides code that uses an deprecated memory copy function. What is the most appropriate action for the analyst to take?

Accepted Answer

Modify the code to use modern alternatives and perform rigorous security testing.. The analyst must manually review and test all code generated by an LLM. Relying on AI-generated code without verification is dangerous, as LLMs often suggest outdated or insecure practices. The analyst should modernize the code, verify its functionality in a controlled sandbox environment, and ensure it complies with secure coding practices before attempting to deploy it in any real-world offensive operation or security test.

Answer

Execute the code immediately in the production environment to verify functionality.

Answer

Re-run the prompt with a higher temperature to get a different code version.

Answer

Accept the code as is, as the LLM has already accounted for the system requirements.

Question 2

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

Accepted Answer

To detect anomalies in process lineage and execution context.. PPID analysis reveals the execution chain, which is often a major red flag for malicious activity. For example, a web server process spawning a shell is highly suspicious. Understanding these relationships allows incident handlers to detect process hollowing and injection attacks. This context is essential because it distinguishes between legitimate system operations and adversarial techniques designed to blend into the system's normal process hierarchy.

Answer

To identify which user account initiated the malicious activity.

Answer

To determine the file creation date on the disk.

Answer

To ensure the process is running with administrative privileges.

Question 3

What is the primary risk associated with using 'aggressive' scan timing templates (like T4 or T5) in an environment with high network latency?

Accepted Answer

The scan will yield inaccurate results due to premature timeouts.. Aggressive timing templates rely on short timeouts, expecting quick responses from targets. In high-latency networks, these short timeouts lead to false negatives, where Nmap incorrectly labels a port as 'filtered' simply because the response did not arrive before the aggressive timer expired. This leads to inaccurate mapping and missed vulnerabilities, directly undermining the goals of the incident investigation.

Answer

The scan will consume excessive bandwidth.

Answer

The scan will trigger an automated shutdown of the network.

Answer

The scan will crash the Nmap engine.

Question 4

Which TWO of the following are primary security risks associated with the SMBv1 protocol in a modern Windows environment?

Accepted Answer

Susceptibility to remote code execution via EternalBlue. SMBv1 is an archaic protocol that lacks modern security features, making it a critical target for attackers. Its primary risks include vulnerability to well-known remote code execution exploits like EternalBlue and its susceptibility to man-in-the-middle attacks due to weak or absent integrity checks. Understanding these risks is vital for incident handlers to prioritize the deprecation of legacy protocols, which are often the primary entry points for ransomware and lateral movement.

Answer

Inability to support Kerberos authentication

Answer

Lack of support for SMB message signing

Answer

Incompatibility with NTFS permissions

Question 5

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

Accepted Answer

Continuous ingestion of high-quality, normalized telemetry data.. Effective malware hunting requires a combination of strong data hygiene, human intuition, and robust analytical loops. AI provides the speed and pattern recognition necessary to handle large volumes of data, but it requires carefully curated inputs and human oversight to remain effective. These components are essential because they ensure that hunting efforts are scalable, reproducible, and aligned with the actual behavioral patterns observed during the adversary's lifecycle within the enterprise environment.

Answer

Eliminating all manual review to maximize the hunting speed.

Answer

Focusing exclusively on known malware signatures for speed.

Question 6

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.

Question 7

An analyst is investigating a suspected Pass-the-Hash attack within an Active Directory environment. Which TWO Windows Security Event Log IDs should the analyst examine to detect the use of stolen NTLM credential material for lateral movement? (Choose TWO)

Accepted Answer

Event ID 4624 (An account was successfully logged on). Event ID 4624 records successful logons, and specifying Logon Type 3 (Network) combined with NTLM authentication indicates a potential Pass-the-Hash event when originating from an unusual source. Event ID 4672 details special privileges assigned to new logins, helping verify if the compromised security context obtained administrative privileges across the domain.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4720 (A user account was created)

Answer

Event ID 1102 (The audit log was cleared)

Question 8

An application uses a Base64 encoded string as a parameter for object references. An attacker decodes the string, modifies the ID, re-encodes it, and successfully accesses unauthorized data. Why did the security control fail?

Accepted Answer

Base64 encoding is inherently reversible. The failure occurred because the application relied on encoding (Base64) as a security control instead of proper authorization logic. Encoding is a data representation technique, not a security mechanism. Because the server failed to perform access control checks on the decoded identifier, it allowed the attacker to bypass the intended security model. This highlights the importance of never confusing data format obfuscation with actual authorization or identity management.

Answer

The server failed to enforce HTTPS

Answer

The session token was not included in the payload

Answer

The application used an insecure hashing algorithm

Question 9

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 10

Which THREE items are essential components of an API security documentation strategy for incident responders?

Accepted Answer

Up-to-date OpenAPI/Swagger specifications. Effective incident response for APIs requires comprehensive documentation. API specifications (like OpenAPI/Swagger) provide the baseline for expected behavior and valid endpoints. Inventory documentation ensures all endpoints are known and monitored. Finally, security headers and rate-limiting policies document the defense-in-depth posture. Without these, responders cannot differentiate between legitimate traffic patterns and malicious exploitation attempts during an active security event or during post-incident forensic analysis.

Answer

Hardcoded database credentials for internal services

Answer

Customer personal identifiable information (PII) logs