GCIH Practice Test 12 — 15 Questions

Question 1

During incident response, you observe that a compromised host is sending ICMP echo request packets with a payload size of 1000 bytes to an external IP. The payload appears to contain non-printable characters. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The host is using ICMP tunneling for covert communication.. The correct answer is ICMP tunneling for covert communication. Large ICMP packets with non-printable payloads sent to a single external IP are a classic sign of ICMP tunneling, where data is hidden in the payload to evade detection.

Answer

The host is experiencing a network loop.

Answer

The host is infected with a worm that scans for vulnerabilities.

Answer

The host is performing a ping flood attack.

Question 2

An analyst is investigating a suspected compromise on a Windows 10 endpoint. Network telemetry shows periodic outbound HTTPS traffic to a domain that resolves to a legitimate cloud CDN IP, but the SNI in the TLS ClientHello does not match the destination domain. The endpoint has no browser activity at those times. Which technique best explains this traffic pattern?

Accepted Answer

Domain fronting through a CDN to hide the true command-and-control destination. Domain fronting exploits CDN behavior where the TLS SNI and the HTTP Host header can differ, allowing traffic to appear destined for a benign domain while actually reaching attacker infrastructure. The combination of periodic non-browser HTTPS, a legitimate CDN IP, and an SNI that does not match the destination domain is characteristic. DNS tunneling, ICMP covert channels, and fast flux produce different network signatures and would not generate this specific mismatch.

Answer

Fast flux DNS rotating A records to evade blocklists

Answer

DNS tunneling using TXT records to exfiltrate data

Answer

Beaconing over a covert channel using ICMP echo payloads

Question 3

A SOC analyst notices that a scheduled task on a workstation was created shortly after a user opened a malicious email attachment. The task runs a PowerShell command that downloads a file from an external IP every hour. The task is configured to run under the SYSTEM account and has no associated user logon. Which post-exploitation technique does this represent?

Accepted Answer

Persistence via scheduled task. Scheduled tasks are a favored persistence mechanism because they can run under SYSTEM, trigger on schedules or events, and survive reboots without user interaction. The scenario shows a task created after a phishing attachment, executing a recurring download, which matches this technique. Unquoted service path, LSASS credential dumping, and PsExec lateral movement involve different artifacts such as service creation or remote execution, none of which are described.

Answer

Credential dumping using LSASS memory access

Answer

Privilege escalation via unquoted service path

Answer

Lateral movement using PsExec

Question 4

During an incident response on a Windows 10 endpoint, you observe that a malicious process has injected a thread into a remote process on the same host using the CreateRemoteThread API. The injected code is now executing in the context of a legitimate system process. Which of the following best describes the primary purpose of this technique from the attacker's perspective?

Accepted Answer

To evade detection by masquerading malicious code within a trusted process.. Injecting a thread into a remote process using CreateRemoteThread enables an adversary to execute arbitrary code within the address space of a trusted process. This helps evade detection because many security solutions allowlist or trust system processes. The technique does not inherently escalate privileges, create network tunnels, or dump credentials, making the evasion-focused description the correct one.

Answer

To harvest credentials from the LSASS process memory.

Answer

To establish a covert channel over DNS for command and control.

Answer

To escalate privileges by exploiting a vulnerable driver in the kernel.

Question 5

During an incident response engagement, an analyst observes that a Windows workstation is making DNS queries for a domain that resolves to an IP address owned by a cloud provider. The queries are for subdomains that appear randomly generated and change frequently. The workstation also has periodic HTTPS connections to that IP. The analyst suspects domain fronting. Which of the following best describes how domain fronting is used in this scenario?

Accepted Answer

The attacker sends traffic to a legitimate domain's IP but uses a different Host header to reach the actual command-and-control server.. Domain fronting allows an attacker to hide command-and-control traffic by connecting to a legitimate domain's IP address while specifying a different Host header that routes to the attacker's server. This makes the traffic appear to go to a trusted domain, evading network filters. The random subdomains and periodic HTTPS connections are consistent with this technique.

Answer

The attacker compromises a legitimate website and uses it to host malicious payloads.

Answer

The attacker uses a fast-flux network to rapidly change DNS records and evade detection.

Answer

The attacker uses DNS tunneling to exfiltrate data through the DNS queries.

Question 6

An incident responder is examining a compromised Windows 10 workstation that an attacker used to pivot into the internal network. The responder runs `netstat -ano` and sees an established connection from the workstation to an internal server on TCP port 445, but no user has mapped a drive or accessed a share. Which of the following Windows artifacts would BEST reveal the remote service or process that initiated this SMB connection?

Accepted Answer

Sysmon Event ID 3 (network connection detected). Sysmon Event ID 3 captures network connection events with the initiating process image, source and destination IPs, and ports. On the compromised workstation, this event directly links the SMB connection to a specific executable or service, which is exactly what the responder needs. Other artifacts either reside on the remote server, lack process context, or do not record network activity.

Answer

Windows Security event ID 4624 with logon type 3

Answer

Security event ID 5140 (network share object was accessed)

Answer

Prefetch file for the executable that made the connection

Question 7

A healthcare organization's incident response team is investigating unusual SMB activity on a Windows file server. NetFlow data shows a single internal workstation opened SMB connections to more than 200 distinct hosts on TCP 445 within five minutes, and each connection lasted under two seconds. The workstation's user reports no unusual behavior. Which of the following is the most likely explanation for this traffic pattern?

Accepted Answer

The workstation is infected with malware performing SMB worm-style lateral movement or network discovery.. A single workstation opening TCP 445 connections to over 200 distinct hosts in five minutes, with each session lasting under two seconds, matches automated SMB scanning or worm-style lateral movement. Legitimate backup or load-balancing traffic would be documented, targeted, and longer-lived. The silent nature of the activity and the user's unawareness reinforce malware as the likely cause, so the host should be isolated and examined.

Answer

The file server is load-balancing SMB sessions across the network, causing the workstation to reconnect frequently.

Answer

The workstation is experiencing a DNS misconfiguration causing it to resolve many hostnames to the same server.

Answer

A legitimate backup application is enumerating shares across the environment.

Question 8

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys managed by AWS Key Management Service (KMS) and that the encryption is enforced automatically for all new objects. Which configuration should they implement?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key.. Enabling default encryption with SSE-KMS and a customer managed key ensures that all new objects are encrypted using KMS-managed keys, meeting both the encryption at rest and key management requirements. It also provides auditability and control over the keys. Other options either use non-KMS keys, only enforce encryption without specifying key type, or address transit encryption instead of at rest.

Answer

Use AWS Certificate Manager (ACM) to provision SSL/TLS certificates for the S3 bucket.

Answer

Create a bucket policy that denies unencrypted PutObject requests.

Answer

Enable default encryption on the S3 bucket using SSE-S3 (AES-256).

Question 9

A security analyst notices that a user's workstation is communicating with an external IP address on port 443, but the traffic is not TLS. Instead, the packets contain a custom protocol with a fixed header. The connection is persistent and occurs every night at 2 AM. Which type of covert communication is this most likely?

Accepted Answer

A covert channel using a non-standard protocol over a common port. The correct answer is a covert channel using a non-standard protocol over a common port. Attackers often use ports like 443 to blend in with normal traffic, but they may implement their own protocol instead of TLS to avoid detection or because it's simpler. The persistent, scheduled connection suggests a beaconing implant that checks in with a C2 server. This technique can evade firewalls that allow outbound 443 traffic.

Answer

A misconfigured application using the wrong port

Answer

A legitimate software update service

Answer

A denial-of-service attack

Question 10

A security analyst is investigating a suspected compromise of an AWS environment. The analyst discovers that an IAM user's access key was used from an unknown IP address to enumerate S3 buckets and download objects. The analyst needs to secure the environment and gather evidence. Which TWO actions should the analyst take to both contain the incident and preserve forensic data? (Choose two.)

Accepted Answer

Deactivate the compromised access key.. Deactivating the compromised access key immediately stops the attacker from using it, while reviewing CloudTrail logs provides the necessary forensic evidence to understand the extent of the breach. Together, these actions contain the incident without destroying evidence. Deleting the user, enabling new logging, or rotating all keys either destroy evidence, fail to address the active threat, or cause unnecessary disruption.

Answer

Rotate all IAM user access keys in the account.

Answer

Enable AWS CloudTrail logging for all regions.

Answer

Delete the IAM user associated with the access key.

Question 11

A GCIH responder is investigating a compromised AWS account where an EC2 instance's IAM role credentials were stolen from the instance metadata service. The attacker used those temporary credentials from an external IP address to download sensitive objects from an S3 bucket. Which AWS service or mechanism would have provided the earliest detection of this specific anomalous behavior?

Accepted Answer

Amazon GuardDuty with findings for unauthorized access to IAM credentials. GuardDuty analyzes CloudTrail management events to identify when EC2 instance role credentials are used from an external IP address. This specific finding type, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration, triggers because GuardDuty correlates the credential usage with the originating IP and flags it as anomalous. CloudTrail data events alone only log the API calls without assessing whether the source is expected, while Trusted Advisor and Macie focus on configuration and data classification respectively.

Answer

AWS CloudTrail data events for S3 object-level operations

Answer

Amazon Macie sensitive data discovery jobs on the S3 bucket

Answer

AWS Trusted Advisor security checks for S3 bucket permissions

Question 12

An incident responder is analyzing a packet capture and observes a Windows workstation sending an SMB2 NEGOTIATE request listing only the SMB 2.0.2 dialect, followed by a SESSION_SETUP request containing an NTLMSSP Type 3 message. The server responds with STATUS_SUCCESS. The workstation normally communicates with this file server using SMB 3.1.1. What is the most likely explanation for this behavior?

Accepted Answer

An attacker performed an SMB downgrade attack by intercepting the negotiation and stripping higher dialect offers.. The correct answer is the scenario where an attacker intercepts SMB negotiation and strips higher dialect offers, forcing the client to use SMB 2.0.2 and NTLMSSP authentication. This is a classic SMB downgrade attack aimed at capturing or relaying credentials. The other options describe misconfigurations or benign fallbacks that do not match the sudden change from SMB 3.1.1 with Kerberos to SMB 2.0.2 with NTLMSSP.

Answer

The workstation's SMB client is misconfigured to use only SMB 2.0.2 due to a missing registry key.

Answer

The file server is configured to only accept SMB 2.0.2 connections, forcing the client to downgrade.

Answer

The capture shows normal fallback behavior because the client and server could not agree on SMB 3.1.1 encryption.

Question 13

A threat hunter observes outbound DNS queries from an internal workstation to a domain that resolves to an IP address owned by a cloud provider. The queries contain long, random-looking subdomains such as 'a1b2c3d4e5f6g7h8.example.com'. The volume of queries is high and consistent, occurring every few seconds. Which post-exploitation technique is most likely in use?

Accepted Answer

DNS tunneling for command-and-control or data exfiltration. DNS tunneling encodes data or C2 instructions in DNS queries, often using long, random-looking subdomains and high query volumes. The consistent timing and cloud-hosted destination are typical of a covert channel that abuses allowed DNS traffic to bypass egress filtering. Detecting such patterns requires analyzing DNS query length, entropy, and volume per host.

Answer

DNS cache poisoning to redirect internal users

Answer

Fast flux DNS to rotate C2 infrastructure

Answer

Domain fronting to hide C2 traffic behind a legitimate CDN

Question 14

An incident responder is analyzing a potential compromise in an AWS environment. The responder notices that an IAM role attached to an EC2 instance has been used to access an S3 bucket from an external IP address. The role's trust policy allows the EC2 service to assume it. Which technique is the attacker MOST likely using to abuse this role?

Accepted Answer

Credential exfiltration from the EC2 instance metadata service (IMDS).. The attacker most likely exfiltrated temporary credentials from the EC2 instance metadata service (IMDS) and used them from an external IP. Since the role's trust policy only allows EC2, the credentials must have been obtained from the instance itself. Cross-account assumption is blocked, confused deputy involves service manipulation, and long-term credentials are not used with roles.

Answer

Use of long-term IAM user credentials embedded in the EC2 instance.

Answer

Cross-account role assumption via sts:AssumeRole.

Answer

Exploitation of a confused deputy vulnerability in the S3 bucket policy.

Question 15

An incident responder is reviewing a compromised Linux host and notices that the attacker modified the /etc/ld.so.preload file to include a path to a shared object file. Shortly after, the responder observes that common commands like 'ls' and 'ps' are returning incomplete or manipulated output. Which post-exploitation technique has the attacker most likely employed?

Accepted Answer

Userland rootkit using LD_PRELOAD to hook library calls. The modification of /etc/ld.so.preload to load a malicious shared object is a hallmark of a userland rootkit. The dynamic linker preloads the library into every process, allowing it to hook system calls like readdir and open, which hides files and processes and manipulates command output. This technique is stealthy because it operates in userland without kernel modifications.

Answer

Cron job persistence to maintain access

Answer

SUID binary exploitation to escalate privileges

Answer

Kernel module rootkit loaded via insmod