GCIH Practice Test 10 — 10 Questions

Question 1

How can an application distinguish between an authorized user requesting their own profile and an unauthorized user attempting to access a different profile via IDOR?

Accepted Answer

By verifying ownership of the requested resource in the backend. The application must correlate the authenticated user's identity (from the session) with the requested resource identifier on the back-end. By checking if the session user owns the requested resource ID before returning data, the application enforces authorization. This moves the logic from 'is this user allowed to access anything?' to 'is this user allowed to access THIS SPECIFIC object?', which is the foundation of secure resource access control.

Answer

By validating that the user has a session cookie

Answer

By checking if the resource ID is a valid integer

Answer

By using a CAPTCHA on every request

Question 2

Refer to the exhibit. An AI-based EDR identifies a suspicious process chain. Based on the provided JSON output, what is the most appropriate next step for an incident handler?

Accepted Answer

Examine process memory and network artifacts to confirm malicious injection.. The exhibit shows a clear anomaly where a parent-child relationship (PowerShell spawning svchost) is highly suspicious, especially when associated with an external connection. While the AI score is high, it is a heuristic indicator. The handler must verify this via manual inspection of the process memory and network artifacts to confirm if this is a legitimate system injection or a malicious beacon, ensuring that response actions are based on verified facts.

Answer

Assume the alert is a false positive due to the common nature of svchost.

Answer

Immediately isolate the host from the network based on the 0.98 AI score.

Answer

Restart the svchost service to terminate the suspicious connection.

Question 3

Which technique is most effective for preventing prompt injection when integrating an LLM into an automated security orchestration tool?

Accepted Answer

Using clear delimiters to differentiate between system instructions and user-supplied data.. Prompt injection occurs when untrusted input is treated as an instruction by the LLM. Implementing structured input validation and separating user input from system instructions is critical. By using delimiters like XML tags or JSON structures to encapsulate user-supplied data, the LLM can clearly distinguish between instructions and data, reducing the likelihood that the model will follow malicious commands embedded within the processed security data or incident reports.

Answer

Retraining the model on internal security documentation.

Answer

Encrypting the prompt before sending it to the LLM API.

Answer

Limiting the LLM context window to 1024 tokens.

Question 4

Which of the following describes the core difference between Path Traversal and IDOR?

Accepted Answer

Path Traversal is an OS-level vulnerability, while IDOR is an application-level flaw. Path Traversal targets the file system by manipulating paths to access arbitrary files, whereas IDOR targets application data by manipulating identifiers to access unauthorized database objects. While both involve parameter tampering, they operate at different layers: Path Traversal interacts with the underlying OS file structure, while IDOR interacts with the application's data model. Understanding this distinction is key to selecting the appropriate remediation strategy for each specific vulnerability.

Answer

IDOR is only applicable to RESTful APIs

Answer

Path Traversal is only possible on Windows systems

Answer

IDOR is a subtype of Path Traversal

Question 5

Which TWO of the following are significant risks associated with using LLMs for automated malware analysis?

Accepted Answer

Inadvertent disclosure of proprietary code or indicators of compromise.. Automated malware analysis with LLMs carries risks related to data leakage and the inherent inaccuracy of AI models. If the model is not properly sandboxed, it may inadvertently leak indicators of compromise (IOCs) or sensitive binary analysis results to the provider. Additionally, the tendency of models to hallucinate or misinterpret complex obfuscation patterns can lead to incorrect analysis reports, which may cause responders to overlook actual threats or pursue useless remediation strategies during an investigation.

Answer

The model will automatically execute the malware and infect the local network.

Answer

The LLM will automatically report the malware to the vendor for analysis.

Answer

The model will increase the time required to complete the analysis.

Question 6

What is the primary benefit of using a 'Chain-of-Thought' prompting strategy when asking an LLM to analyze complex security logs?

Accepted Answer

It forces the model to explain its reasoning process step-by-step.. Chain-of-thought prompting forces the model to articulate its reasoning step-by-step before reaching a final conclusion. This strategy significantly improves the model's performance on logical and diagnostic tasks by breaking down complex problems into manageable chunks. In security log analysis, this allows the analyst to follow the model's deductive process, making it easier to identify where the model might have made a logical error or an incorrect assumption.

Answer

It drastically increases the speed of the model's response.

Answer

It ensures the model only uses internal, pre-trained knowledge.

Answer

It automatically encrypts the analysis results for secure storage.

Question 7

When investigating an AI-generated spear-phishing campaign, what is the most effective indicator to look for that suggests the content was created by a Large Language Model (LLM)?

Accepted Answer

Consistent, overly formal tone that lacks specific organizational context.. LLMs often produce text that is grammatically perfect but lacks the specific, idiosyncratic context or 'human touch' of targeted communication. Identifying these characteristics requires comparing the suspect emails against known communication baselines of the purported sender. Understanding these patterns is crucial because AI can now produce highly convincing phishing lures at scale, requiring responders to look past the superficial professionalism to find the lack of contextual depth or intent alignment.

Answer

Presence of multiple spelling and grammatical errors.

Answer

Inclusion of malicious code within the email header metadata.

Answer

The email is sent from a known, compromised account.

Question 8

An analyst discovers a suspicious file named 'svchost.exe' running from a user's 'AppData' directory. Why is this highly suspicious?

Accepted Answer

Legitimate svchost.exe resides in System32.. The legitimate svchost.exe process is a core Windows system component that resides in the System32 directory and is launched by the Service Control Manager. It is designed to host multiple Windows services. Attackers often rename their malicious binaries to 'svchost.exe' to blend in with legitimate processes, but they rarely place them in user-writable directories like AppData. Detecting this is a key indicator of malware masquerading as system processes.

Answer

It is always a virus.

Answer

Svchost must always run as SYSTEM.

Answer

Svchost cannot be executed by users.

Question 9

A responder is performing a vulnerability scan on a segment containing industrial control systems. Which Nmap timing template should be used to avoid disrupting sensitive, potentially fragile hardware?

Accepted Answer

T0. Industrial control systems (ICS) and legacy devices are often highly sensitive to high-traffic volumes. Using T0 (paranoid) or T1 (sneaky) ensures that packets are sent at a slow rate, giving these devices sufficient time to process requests. This minimizes the risk of a buffer overflow or service crash that could result from overwhelming the device's limited computational resources with modern scanning speeds.

Answer

T3

Answer

T4

Answer

T5

Question 10

Which security principle is most directly violated when an organization allows guest access to sensitive SMB file shares?

Accepted Answer

Least privilege. Allowing guest access to SMB shares fundamentally violates the principle of least privilege, which dictates that users should only be granted access to the specific resources required for their role. By enabling guest access, the organization removes authentication requirements, allowing anyone with network access to view or modify sensitive files. This creates a significant security gap, as it bypasses authorization controls and increases the risk of unauthorized data exposure or malicious file modification.

Answer

Defense in depth

Answer

Availability

Answer

Non-repudiation