GCIH Practice Test 16 — 15 Questions

Question 1

During incident response at a financial firm, an analyst discovers that a web application's login form is vulnerable to SQL injection. The backend is Microsoft SQL Server, and the application account has sysadmin rights. The attacker's payloads include ; EXEC xp_cmdshell 'whoami' -- and responses show the web server's service account name. Which immediate containment action best limits further damage while preserving evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the xp_cmdshell extended stored procedure and revoke sysadmin from the application's database login, after capturing relevant logs and database state.. The attacker leveraged sysadmin rights to run xp_cmdshell, achieving OS command execution through SQL injection. The most effective containment is to remove that capability by disabling xp_cmdshell and revoking sysadmin from the application login, while first preserving logs and database state. This stops the specific attack path without destroying evidence, unlike a full shutdown or restore.

Answer

Immediately shut down the database server and restore it from the most recent backup.

Answer

Enable full SQL query logging and wait for the next attack to gather more indicators before taking action.

Answer

Block the attacker's source IP address at the perimeter firewall and continue monitoring.

Question 2

During an authorized discovery scan of a DMZ, an incident responder needs Nmap to report the reason each port is classified as open, closed, or filtered so the team can distinguish a firewall drop from a host reset. Which Nmap option should the responder add to the command line?

Accepted Answer

--reason. Adding --reason to an Nmap scan causes each port entry to include the reason Nmap assigned the state, such as syn-ack for open, reset for closed, or no-response for filtered. This distinction is critical in a DMZ where a drop and a reset imply very different firewall or host behaviors, and it gives the responder defensible evidence for the report.

Answer

-d

Answer

-v

Answer

--packet-trace

Question 3

An incident handler is investigating a web application that allows users to upload profile pictures. The application stores uploaded files in a directory accessible via the web and uses the original filename without sanitization. An attacker uploads a file named `shell.php.jpg` containing PHP code. The server executes the file when accessed via its URL. Which vulnerability has been exploited?

Accepted Answer

Unrestricted File Upload. The application allows an attacker to upload a file with a double extension and then executes it, resulting in remote code execution. This is an Unrestricted File Upload vulnerability. Mitigations include validating file types by content, not just extension, storing uploads outside the web root, and disabling script execution in upload directories. Incident responders should inspect upload logs and file system for malicious files.

Answer

Directory Traversal

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Question 4

A penetration testing team is integrating a locally hosted LLM into its post-exploitation tooling to help draft PowerShell and Bash commands from natural-language objectives. Before deployment, the team lead must identify controls that limit the blast radius if the model is manipulated through crafted input. (Choose two.)

Accepted Answer

Execute all model-generated commands inside a disposable, network-isolated sandbox until they are reviewed and approved.. Limiting blast radius requires containment and human control over what actually executes. Running generated commands in a disposable, network-isolated sandbox ensures any manipulated output is harmless, and requiring explicit human approval before execution against targets prevents harmful commands from ever running. Attention-weight logging offers no containment, standing admin credentials amplify impact, and fine-tuning improves quality without creating any security boundary.

Answer

Fine-tune the model on the team's historical engagement reports to improve command accuracy and reduce manipulation risk.

Answer

Enable verbose logging of the model's internal attention weights so operators can detect manipulated prompts.

Answer

Grant the LLM service account standing administrative credentials on the engagement jump host to avoid execution failures.

Question 5

A security analyst is reviewing password hashes extracted from an older Linux system. The hashes are stored in /etc/shadow and begin with the prefix $1$. The analyst wants to determine the hashing algorithm used so they can choose the correct cracking mode. Which algorithm is indicated by the $1$ prefix?

Accepted Answer

MD5 crypt. Linux shadow file prefixes identify the hashing algorithm: $1$ is MD5 crypt, $5$ is SHA-256 crypt, $6$ is SHA-512 crypt, and $2a$/$2b$/$2y$ is bcrypt. MD5 crypt is a legacy scheme that is fast to compute and therefore easily cracked with modern hardware. Analysts should recognize these prefixes to select the correct cracking mode and to advise upgrading to stronger algorithms.

Answer

SHA-512 crypt

Answer

SHA-256 crypt

Answer

bcrypt

Question 6

An incident handler is preparing to use a cloud-hosted LLM API to summarize Indicators of Compromise extracted from an active breach, but the engagement contract prohibits sending client data to third-party services. Which action best satisfies the contractual constraint while preserving LLM-assisted summarization?

Accepted Answer

Deploy an open-weight model on infrastructure controlled by the incident response team and run the summarization locally.. When a contract forbids sending client data to third-party services, the summarization must occur within infrastructure the incident response team controls. Running an open-weight model locally keeps Indicators of Compromise inside the permitted boundary while still enabling LLM-assisted analysis. Redacting names, relying on zero-retention settings, or hashing indicators either leaves data exposed, misreads the constraint, or destroys the information needed for summarization.

Answer

Send the raw Indicators of Compromise to the public API but strip the client's company name from the prompt.

Answer

Hash every Indicator of Compromise with SHA-256 before sending it to the public API for summarization.

Answer

Use the public API but enable the provider's zero-retention setting, which contractually removes the need for client consent.

Question 7

An incident responder is validating the perimeter firewall ruleset by scanning from an external vantage point. The team wants to confirm which TCP ports are reachable through the firewall and also determine whether UDP services are exposed. Which TWO Nmap scan techniques should the responder combine to accomplish this? (Choose two.)

Accepted Answer

UDP scan (-sU). Validating a perimeter ruleset for both protocols requires a TCP scan and a UDP scan. The TCP SYN scan is the standard, efficient way to determine which TCP ports the firewall permits, while the UDP scan is the only Nmap technique that probes UDP ports and interprets ICMP unreachable responses or service replies to classify them. Together they cover the TCP and UDP rule sets the team wants to verify.

Answer

FIN scan (-sF)

Answer

TCP connect scan (-sT)

Answer

Idle scan (-sI)

Question 8

A GCIH candidate is reviewing a REST API that accepts XML in an upload endpoint used for importing supplier catalogs. During a purple-team exercise, testers want to demonstrate how XML-specific parser weaknesses could be abused against this endpoint. Which two techniques should the testers attempt to validate the parser's defenses? (Choose two.)

Accepted Answer

Submit an XML document with an entity definition that recursively references itself to test for exponential entity expansion. Both selected techniques exercise the XML parser itself rather than the surrounding application logic. External entity declarations reveal whether the parser resolves references to local files or network resources, while recursive entity definitions reveal whether expansion is bounded. Together they validate the two most impactful XML-specific defenses for an endpoint that must accept documents from untrusted suppliers.

Answer

Upload an oversized multipart file to exhaust disk space on the API host

Answer

Inject a SQL UNION statement into the catalog name field to test database query construction

Answer

Send a JSON body with a million nested arrays to the same endpoint to test depth limits

Question 9

An incident handler is mapping a flat internal subnet and wants Nmap to identify live hosts without performing port scans on every address. The handler also needs the scan to work when ICMP echo requests are blocked by host-based firewalls. Which Nmap option should be used?

Accepted Answer

-sn. The -sn option performs host discovery only and skips port scanning, and Nmap's default discovery probes include TCP SYN to port 443 and TCP ACK to port 80 in addition to ICMP, so hosts that block ping but expose web services are still detected. This satisfies both the discovery-only and ICMP-blocked requirements.

Answer

-Pn

Answer

-sU

Answer

-sS

Question 10

A penetration tester is performing a password attack against an Active Directory environment. The tester has obtained a list of valid domain usernames and wants to identify accounts with weak passwords without locking out accounts. The domain account lockout policy is set to lock accounts after five failed attempts within 30 minutes. Which two of the following techniques would allow the tester to test passwords while minimizing the risk of account lockout? (Choose two.)

Accepted Answer

Using a tool that performs a single authentication attempt per account per lockout window. Password spraying and single-attempt-per-window techniques are both designed to test passwords while staying under lockout thresholds. Spraying uses one password across many accounts, and single-attempt-per-window limits each account to one guess per lockout period. Both avoid triggering the five-failure lockout, unlike brute-forcing or credential stuffing, which can rapidly exceed the threshold.

Answer

Using a pass-the-hash attack with captured NTLM hashes

Answer

Brute-forcing each account with a large dictionary until a valid password is found

Answer

Performing a credential stuffing attack using passwords from previous breaches

Question 11

An incident handler is investigating a web application that uses a templating engine. The application allows users to submit their name, which is later rendered in a greeting page. An attacker submits the payload `{{7*7}}` and the page displays `49`. The application also exposes an endpoint that accepts a template name as a parameter. Which vulnerability is most likely present?

Accepted Answer

Server-Side Template Injection (SSTI). The evaluation of `{{7*7}}` to `49` demonstrates that the application processes user input as a template expression. This is Server-Side Template Injection, which can lead to remote code execution depending on the engine. The secondary endpoint that accepts a template name further increases risk. Incident responders should isolate the application, review template engine logs, and check for any uploaded or modified templates.

Answer

Insecure deserialization

Answer

SQL injection

Answer

Reflected Cross-Site Scripting (XSS)

Question 12

During an investigation of a compromised Linux web server, an incident responder needs to identify which user account was used to establish an outbound SSH session to an external IP address. Which artifact should the responder examine first?

Accepted Answer

The system authentication log, such as /var/log/auth.log or /var/log/secure. SSH session events are logged by the sshd daemon to the system authentication log, which includes the account name and connection endpoints. Examining /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems gives the responder the user attribution and timing needed. Other artifacts lack the necessary account-to-connection correlation.

Answer

The system's cron job definitions under /etc/cron.d

Answer

The bash command history file for each user under /home

Answer

The kernel ring buffer output from the dmesg command

Question 13

An incident response team wants its LLM assistant to triage endpoint telemetry and recommend containment actions, but leadership is concerned that a manipulated model could recommend disabling critical production services. Which design choice best mitigates that concern?

Accepted Answer

Configure the model to output recommendations only, with all containment actions requiring explicit analyst authorization through the existing ticketing workflow.. The strongest mitigation is to keep the model in an advisory role, where every containment action requires explicit analyst authorization through an established workflow. This removes the model's ability to disable production services regardless of manipulation, and the ticketing process preserves human judgment and accountability. Direct execution with tag limits, post-hoc logging, or fine-tuning all leave an execution path or rely on controls that cannot guarantee protection of critical services.

Answer

Grant the model direct containment authority but require it to log every action to the SIEM after execution.

Answer

Fine-tune the model on historical containment decisions so it learns to avoid disabling services that are critical.

Answer

Allow the model to invoke containment APIs directly but limit it to disabling services that are not tagged as critical.

Question 14

During an incident response engagement, the team suspects that an attacker is using DNS tunneling to exfiltrate data. The team captures network traffic and wants to confirm the exfiltration. Which of the following DNS traffic characteristics would MOST strongly indicate DNS tunneling?

Accepted Answer

A high volume of DNS queries for a single domain with long, random-looking subdomains.. The strongest indicator of DNS tunneling is a high volume of DNS queries to a single domain with long, random-looking subdomains. This pattern suggests data is being encoded in the subdomain labels and sent to an attacker-controlled authoritative DNS server. Other options, such as queries to legitimate domains or TCP usage, are not specific to tunneling and can occur in normal traffic.

Answer

DNS queries that use TCP instead of UDP on port 53.

Answer

DNS responses that contain only A records and have a short TTL.

Answer

Frequent DNS queries to multiple known legitimate domains like google.com and microsoft.com.

Question 15

An incident responder is analyzing a Windows memory image and wants to identify a malicious process that has no corresponding file on disk. Which memory analysis artifact is most useful for this purpose?

Accepted Answer

The process list with associated memory sections. Memory section analysis maps each process's virtual memory regions and flags those without a corresponding file on disk. Injected or reflective-loading code appears as executable pages with no file path, which is the hallmark of a fileless process. This is the most direct way to identify a running process that never touched disk.

Answer

The registry hives extracted from the memory image

Answer

The Windows event log for process creation, such as Event ID 4688

Answer

The list of loaded kernel drivers