GCIH Practice Test 15 — 15 Questions

Question 1

During an internal penetration test, you capture SMB traffic between a user workstation and a file server on the same Layer 2 segment. The captured exchange shows the client sending an authentication request containing a username and a challenge/response value, but no cleartext password. You want to recover the user's cleartext password offline using a wordlist. Which attack technique should you apply to the captured challenge/response pair?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform an offline dictionary attack against the captured NTLMv2 challenge/response using a tool such as Hashcat with mode 5600.. The captured exchange is a NetNTLMv2 authentication, which exposes a challenge/response rather than a cleartext password or NT hash. To recover the cleartext password, an attacker performs an offline dictionary or brute-force attack against that response using a tool configured for NetNTLMv2, such as Hashcat mode 5600. This avoids further interaction with the target and does not trigger account lockouts on the server.

Answer

Extract the user's NT hash from the capture and submit it to a Pass-the-Hash tool to authenticate to the file server.

Answer

Decrypt the SMB session with the server's machine account key to reveal the user's password from the encrypted payload.

Answer

Replay the captured challenge/response value directly to the file server to authenticate as the user without cracking it.

Question 2

An incident responder is analyzing a network capture to identify potential command-and-control (C2) communication. The capture shows a workstation making regular DNS queries to 'update.microsoft.com' every 60 seconds, each followed by a small HTTPS session to a different IP address. The HTTPS sessions use self-signed certificates and the User-Agent string is 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)'. Which TWO of the following indicators most strongly suggest malicious C2 activity? (Choose two.)

Accepted Answer

The User-Agent string is outdated and inconsistent with the operating system.. The correct answers are that the HTTPS sessions use self-signed certificates and the User-Agent string is outdated and inconsistent. Self-signed certificates are a hallmark of malware C2 because they are not trusted and often used to avoid detection. An outdated User-Agent like MSIE 6.0 on a modern system suggests the traffic is generated by malware with hardcoded strings. Together, these strongly indicate malicious C2 activity, whereas the other options can be benign.

Answer

The DNS queries are for a legitimate domain but resolve to multiple IP addresses.

Answer

The DNS queries occur at regular 60-second intervals.

Answer

The HTTPS sessions are to different IP addresses each time.

Question 3

A GCIH incident handler is investigating a suspected compromise on a Windows 10 workstation. The user reported unusual outbound network connections and sluggish performance. To determine the scope and impact of the incident, the handler must collect volatile evidence first. Which TWO artifacts should the handler prioritize to capture active network connections and running processes before memory is altered or lost? (Choose two.)

Accepted Answer

Output of the `netstat -anob` command. In incident response, volatile data such as active network connections and running processes must be collected first because they are lost when the system is shut down or memory is altered. The `netstat -anob` command provides a snapshot of network connections and associated processes, while `tasklist /v` lists running processes with details. Together, they offer a current view of system activity, enabling the handler to identify malicious processes and their network communications.

Answer

List of scheduled tasks from the Task Scheduler library

Answer

Contents of the Windows Security event log

Answer

Contents of the `C:\Windows\Prefetch` directory

Question 4

An attacker has gained access to a Linux server and wants to use it as a pivot point to scan the internal network. The attacker executes `ssh -D 1080 user@compromised-server` from their machine. Which of the following best describes the capability this provides to the attacker?

Accepted Answer

A SOCKS proxy that allows the attacker to route TCP traffic through the compromised server. The `ssh -D` command establishes a dynamic port forwarding tunnel that acts as a SOCKS proxy. The attacker can then direct tools through this proxy to scan or access internal hosts as if originating from the compromised server. It does not provide a reverse shell, file transfer, or VPN functionality; those require different SSH options or tools.

Answer

A reverse shell from the compromised server back to the attacker

Answer

An encrypted file transfer channel for exfiltrating data

Answer

A VPN tunnel that assigns the attacker an IP address on the internal network

Question 5

An incident handler is using a locally hosted LLM to summarize a 200-page intrusion report and extract indicators of compromise for a threat intel feed. The model returns a concise summary but omits several IP addresses present in the source document. What is the most likely explanation for this behavior?

Accepted Answer

The model's context window is too small to process the entire document in a single prompt, causing content truncation.. A 200-page report almost certainly exceeds the model's context window, so the input is truncated before inference and content beyond the limit is never seen. The result is a faithful but incomplete summary missing indicators from later sections. Chunking, retrieval-augmented approaches, or a model with a larger context window resolves the issue. Safety alignment, encryption, and hallucination do not match the observed accurate-but-incomplete behavior.

Answer

The IP addresses were encrypted in the source document and the model cannot decrypt them.

Answer

The LLM is deliberately suppressing IP addresses as part of a safety alignment policy.

Answer

The model is hallucinating the summary and never actually read the document.

Question 6

A red team operator is building an LLM-assisted reconnaissance workflow that ingests public DNS records, WHOIS data, and certificate transparency logs, then summarizes potential attack surface for each target. The operator wants to reduce the chance that the model fabricates hostnames that do not exist before the output reaches the engagement report. Which approach best addresses this requirement?

Accepted Answer

Constrain the model to only transform and summarize records supplied in the prompt, and validate extracted hostnames against the original data before reporting.. Fabricated reconnaissance output is best prevented by restricting the model to extraction and summarization of the records actually provided, then verifying every hostname against those records programmatically. This removes free generation of entities and adds an independent check. Adjusting temperature, trusting self-reported confidence, or relying on a larger model all leave the model free to invent data and provide no deterministic validation against the source records.

Answer

Ask the model to include a confidence percentage next to each hostname and discard entries scoring below ninety percent.

Answer

Switch to a larger parameter model, since increased model size eliminates fabricated hostnames in reconnaissance outputs.

Answer

Increase the model's temperature setting so it produces more diverse candidate hostnames for the operator to review manually.

Question 7

During a security incident, a GCIH analyst discovers that an attacker used PowerShell to download and execute a malicious script from a remote server. The analyst wants to determine the full command line and parent process of the PowerShell execution to understand the attack vector. Which Windows artifact should the analyst examine to retrieve this information?

Accepted Answer

Sysmon event ID 1 (Process Create). Sysmon event ID 1 provides comprehensive process creation data, including the full command line and parent process, which are critical for understanding how PowerShell was invoked and what it executed. Other logs either lack command-line detail (Security 4688 by default) or focus on script content (PowerShell 4104) rather than process lineage. Thus, Sysmon is the most appropriate artifact to retrieve the required information.

Answer

PowerShell operational log, event ID 4104

Answer

Windows System event log, event ID 7045

Answer

Windows Security event log, event ID 4688

Question 8

A security team is integrating an LLM into an automated vulnerability triage pipeline that ingests scanner output and produces prioritized remediation tickets. The team wants to reduce the risk of the LLM fabricating vulnerability details or misattributing CVEs. Which TWO practices best address this concern? (Choose two.)

Accepted Answer

Validate the LLM's CVE attributions against an authoritative source such as the NVD API before creating tickets.. Fabrication and misattribution are best controlled by grounding output in verifiable evidence and validating identifiers against authoritative sources. Requiring citations to raw scanner findings forces the model to anchor claims, while NVD validation deterministically catches invented or mismatched CVEs. Higher temperature, fine-tuning, and self-reported confidence scores do not provide ground truth and can increase or fail to reduce the risk of incorrect vulnerability details reaching remediation tickets.

Answer

Fine-tune the model on the organization's historical ticket data to teach it the correct CVE mappings.

Answer

Ask the LLM to express a confidence score for each CVE attribution and auto-approve tickets above 90 percent confidence.

Answer

Increase the model's temperature setting so it explores a wider range of possible vulnerability interpretations.

Question 9

During a network investigation, an incident responder notices a high volume of outbound DNS queries to a single external domain, with each query containing a long, random-looking subdomain. The queries occur at regular intervals of approximately 30 seconds. Which type of attack is most likely indicated?

Accepted Answer

DNS tunneling for data exfiltration. The combination of high volume, long random subdomains, and regular intervals strongly suggests DNS tunneling for data exfiltration. Attackers use this technique to encode stolen data into DNS queries, which are often allowed through firewalls. The regular interval indicates automated beaconing or a scheduled exfiltration process. Other DNS-based attacks like cache poisoning or amplification would present different traffic patterns, such as spoofed source IPs or redirection of legitimate queries.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Fast flux DNS

Question 10

An incident handler is analyzing a packet capture to identify command-and-control (C2) communication. Which two characteristics are most indicative of C2 traffic? (Choose two.)

Accepted Answer

Periodic connections to the same external IP address at regular intervals. Beaconing and DNS tunneling are two strong indicators of C2 communication. Beaconing involves regular, periodic connections that malware uses to check in with its controller. DNS tunneling encodes data in DNS queries, often using high entropy subdomains to carry commands or exfiltrate data. Other characteristics like non-standard ports or large transfers may be present but are not as specific to C2, as they can occur in legitimate traffic. Combining multiple indicators increases confidence.

Answer

Use of HTTP GET requests with long, random-looking URI parameters

Answer

Large outbound data transfers to an external IP address during non-business hours

Answer

Connections to an external IP address on a non-standard port that is not associated with any known service

Question 11

An incident handler reviews web server logs from an e-commerce application and finds a burst of requests where the JSON body of a POST to /api/v2/orders/checkout contains a deeply nested object several thousand levels deep, causing the backend deserializer to exhaust CPU and memory until the worker crashes. The application accepts arbitrary JSON and binds it directly to internal model objects. Which vulnerability class best describes this attack?

Accepted Answer

Unsafe deserialization of untrusted JSON input. The crash is caused by the deserializer recursively building an extremely deep object graph from attacker-supplied JSON, exhausting CPU and memory. When an API binds untrusted JSON directly to internal models without enforcing maximum depth, size, or allowed-property rules, the parsing stage itself becomes the attack surface. Incident handlers should correlate the crash with payload structure, then recommend depth limits, schema validation, and safe parser configuration.

Answer

Mass assignment through the checkout JSON binding

Answer

Injection through unvalidated JSON string values

Answer

Server-side request forgery triggered by the checkout payload

Question 12

A red team is using an LLM to generate obfuscated payload variants for a phishing simulation. The team notices that after several iterations, the model's outputs become repetitive and less varied, degrading the simulation's realism. Which technique best restores output diversity while keeping the payloads within the agreed scope?

Accepted Answer

Adjust the sampling parameters by increasing temperature and top-p to broaden token selection during generation.. Output repetition usually stems from sampling settings that concentrate probability mass on a few tokens. Increasing temperature and top-p broadens the distribution, yielding more varied phrasing and structure while the prompt and review process still enforce scope. Repeating prompts, using smaller models, or lowering temperature with a repetition penalty do not address the sampling cause and can worsen the lack of diversity.

Answer

Repeat the exact same prompt multiple times and select the longest output as the final payload.

Answer

Switch to a smaller model with fewer parameters to force more creative generation.

Answer

Add a penalty for repeated tokens and lower the temperature to stabilize the output format.

Question 13

A GCIH analyst is called after a SaaS provider reports that an integration partner's API traffic began returning other tenants' records. The partner's client was calling /api/v3/documents/{documentId} and had recently started sending a second header, X-Tenant-Id, that the gateway trusts to route requests. The analyst confirms the partner is authenticated with a valid OAuth 2.0 bearer token scoped to its own tenant. Which weakness allowed the cross-tenant exposure?

Accepted Answer

The API trusted a client-supplied header for tenant routing instead of deriving tenant scope from the authenticated token claims. The gateway trusted an attacker-controllable header to decide which tenant's data to return while authorization relied solely on the caller's own bearer token. Because tenant selection and authorization were decoupled, any authenticated caller could request another tenant's documents by naming that tenant in the header. The fix is to derive tenant scope from verified token claims or server-side state and ignore client-supplied routing headers for authorization decisions.

Answer

The document IDs were sequential integers, allowing enumeration of other tenants' records by incrementing the identifier

Answer

The OAuth 2.0 bearer token was forged because the partner guessed the signing key used by the authorization server

Answer

The integration partner exploited a race condition in the API's caching layer to retrieve stale responses belonging to other tenants

Question 14

An application generates invoice PDFs on demand and caches them under `/var/app/cache//.pdf`. The download handler builds the path with `Paths.get(cacheRoot, userId, invoiceId + ".pdf")` and calls `Files.exists` before streaming. During an incident review, a crafted `invoiceId` value of `../../../../etc/hosts%00` produced a successful read. Which factor best explains why the containment check failed?

Accepted Answer

The null byte was decoded before filesystem access, and the traversal segments were never canonicalized and compared against the cache root.. Path containment fails when the code concatenates user input, decodes it, and then checks the filesystem without canonicalizing the result. The traversal segments escape the cache root, and the trailing null byte can truncate the appended extension on affected platforms. The reliable pattern is to decode exactly once, reject null bytes and separators, canonicalize the resolved path, and confirm it still begins with the canonical cache root before any file operation.

Answer

The application checks `Files.exists` before authentication completes, so unauthenticated users can probe arbitrary paths on the server.

Answer

The `Files.exists` call follows symbolic links by default, so an attacker can point the invoice path at a symlink outside the cache root.

Answer

The per-user cache directory is writable by the application, so an attacker can overwrite the invoice file with the contents of the target file.

Question 15

During an incident response engagement, you discover that a web application constructs LDAP search filters by concatenating user input directly into the filter string. An attacker submits the username `*)(uid=*))(|(uid=*` into the login form and successfully authenticates as the first user in the directory. Which vulnerability class does this behavior represent?

Accepted Answer

LDAP injection. The attacker's payload uses LDAP filter metacharacters to change the logic of the directory search, resulting in authentication bypass. This is LDAP injection. Incident handlers must distinguish it from SQL injection and XSS by examining the payload syntax and the affected component. Recognizing the specific injection context guides containment and remediation, such as parameterizing LDAP queries and validating input.

Answer

Server-Side Request Forgery (SSRF)

Answer

XML External Entity (XXE) injection

Answer

Cross-Site Scripting (XSS)