GCIH Practice Test 17 — 15 Questions

Question 1

An incident handler is analyzing a PCAP and observes a series of TCP packets with the SYN flag set, followed by a single RST/ACK packet from the destination. What is the most likely explanation for this pattern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The source is performing a TCP SYN scan against the destination.. The sequence of SYN packets followed by RST/ACK responses is indicative of a TCP SYN scan. The scanner sends SYN packets to various ports; if a port is closed, the target replies with RST/ACK. This is a common reconnaissance technique used to discover open ports without completing the TCP handshake. A SYN flood would not elicit RST/ACK responses, and a firewall reset would typically involve different packet flows. The direction of packets confirms that the source is scanning the destination.

Answer

A TCP SYN flood attack is in progress.

Answer

The destination host is performing a port scan on the source.

Answer

A firewall is resetting connections from the source.

Question 2

During an authorized incident response engagement, you need to determine whether a specific suspicious host at 10.20.30.40 is alive before launching a full port scan. You want a lightweight check that does not complete a TCP three-way handshake and works even when ICMP is blocked. Which Nmap command best accomplishes this initial liveness check?

Accepted Answer

nmap -sn 10.20.30.40. The -sn ping scan performs host discovery without port scanning and uses multiple probe types, including TCP SYN to port 443 and TCP ACK to port 80, so it can identify live hosts even when ICMP is blocked. This makes it the correct lightweight liveness check before committing to a full port scan. The other options either skip discovery, perform a port scan, or perform OS fingerprinting, all of which are heavier or not designed for simple liveness detection.

Answer

nmap -sS 10.20.30.40

Answer

nmap -Pn 10.20.30.40

Answer

nmap -O 10.20.30.40

Question 3

A SOC analyst triages an alert showing that a mobile banking API responded to a request for /api/accounts/8842/transactions with HTTP 200 and another customer's transaction list. The requesting user was authenticated normally with a valid session token, but the account number in the URL belonged to a different customer. The API returned data without checking whether the authenticated user owned that account. Which vulnerability does this represent?

Accepted Answer

Broken object level authorization on the account resource. The caller was properly authenticated, but the API failed to confirm that the authenticated identity owned the account referenced in the URL. Authorization must be evaluated per object on every request, comparing the resource's owner against the caller's identity. Relying on a valid session alone creates exactly this exposure, where changing an identifier yields another customer's data.

Answer

Cross-site request forgery against the transactions endpoint

Answer

Server-side request forgery through the account identifier parameter

Answer

Insecure direct object reference in the session token generation

Question 4

An incident responder is reviewing logs from a Windows environment and finds that an attacker obtained the NT hash of a domain administrator through a credential dumping technique. The attacker then used that hash to authenticate to multiple servers without ever knowing the cleartext password. Which condition allowed this Pass-the-Hash authentication to succeed?

Accepted Answer

The target servers accepted NTLM authentication and the attacker supplied the NT hash directly as the response to the server challenge.. Pass-the-Hash succeeds because NTLM authentication relies on the NT hash to compute the challenge/response and never requires the cleartext password. Once an attacker extracts the NT hash, they can authenticate to any NTLM-accepting service as that user. Defenses include disabling NTLM, enforcing Kerberos, implementing credential Guard, and restricting privileged account logons to specific hardened hosts.

Answer

Kerberos was enforced across the domain, allowing the attacker to request a service ticket using the NT hash as the long-term key.

Answer

The attacker had previously obtained the cleartext password and used it to derive the NT hash on each target server.

Answer

The servers were configured to cache credentials in LSASS, which allowed the attacker to reuse the cached hash for authentication.

Question 5

An attacker has obtained a set of NTLM hashes from a compromised workstation and now wants to use them to authenticate to other systems in the domain without cracking them. Which two of the following conditions are necessary for a successful Pass-the-Hash attack? (Choose two.)

Accepted Answer

The target systems must accept NTLM authentication.. Pass-the-Hash requires that the target systems accept NTLM authentication and that the compromised hash belongs to an account with logon rights on those systems. Without these, the attack cannot proceed. Administrative privileges, plaintext passwords, and domain controller status are not necessary conditions, making them incorrect choices.

Answer

The target systems must be domain controllers.

Answer

The attacker must know the plaintext password associated with the hash.

Answer

The attacker must have administrative privileges on the target systems.

Question 6

An incident responder is analyzing a compromised Linux server. The attacker gained access via SSH and escalated privileges. The responder wants to identify persistence mechanisms. Which TWO of the following locations should the responder examine? (Choose two.)

Accepted Answer

User's ~/.ssh/authorized_keys file. The two most common Linux persistence mechanisms are cron jobs and SSH authorized_keys. Cron jobs allow scheduled execution of malicious code, while authorized_keys enables passwordless SSH access. Both are frequently used by attackers to maintain a foothold. The auth.log, /etc/hosts, and /etc/passwd are not persistence mechanisms; they serve other purposes and may be modified for different attack goals.

Answer

/etc/hosts

Answer

/etc/passwd

Answer

/var/log/auth.log

Question 7

A security analyst notices that a web application reflects user-supplied input directly into an HTML attribute without encoding. An attacker crafts a URL that, when clicked by a victim, causes the victim's browser to execute a script that reads the victim's session cookie and sends it to an attacker-controlled server. Which type of attack is this?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The attack reflects user input into an HTML attribute without encoding, causing script execution in the victim's browser when they click a crafted link. This is reflected XSS. The immediate execution and cookie theft are characteristic. Incident responders should validate input, apply context-aware output encoding, and consider Content Security Policy to mitigate such attacks.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Stored Cross-Site Scripting (XSS)

Answer

Clickjacking

Question 8

An incident handler is analyzing a web application that uses a NoSQL database. The application constructs queries by directly embedding user input into JSON objects. An attacker submits a payload that includes `$ne` and `$gt` operators to bypass authentication. Which TWO of the following statements accurately describe this attack or its mitigation? (Choose two.)

Accepted Answer

The attack is a NoSQL injection that exploits the lack of input sanitization in query operators.. NoSQL injection exploits unsanitized input that is interpreted as query operators, allowing authentication bypass or data manipulation. Effective mitigation includes using parameterized queries or ORMs, and sanitizing input to remove special operators. Incident handlers should review application code for direct concatenation of user input into NoSQL queries and check database logs for unusual operator usage.

Answer

The attack is only possible if the application uses MongoDB; other NoSQL databases are immune.

Answer

The attack can be mitigated by enabling strict mode in the NoSQL database, which blocks all operator usage.

Answer

The attack is a form of SQL injection because NoSQL databases use SQL-like syntax.

Question 9

An incident responder is investigating a suspected compromise on a Windows endpoint and wants to identify evidence of lateral movement. Which TWO artifacts should the responder examine? (Choose two.)

Accepted Answer

Remote Desktop Services operational log entries for successful connections. Lateral movement leaves traces in authentication and remote access logs. Network logon type 3 entries show cross-host authentication, and Remote Desktop Services operational logs show RDP connections. Together they reveal an attacker moving from one system to another. The other artifacts do not record the connection and logon events needed to trace lateral movement.

Answer

The system's pagefile size configuration

Answer

The contents of the Recycle Bin

Answer

The list of installed Windows updates

Question 10

An incident responder is investigating a compromised Linux server and finds that an attacker added a new user account with a password hash in /etc/shadow. The hash begins with $6$ and includes a salt. The attacker later cracked this hash offline. Which property of the hash allowed the attacker to crack it despite the salt?

Accepted Answer

The salt is stored alongside the hash and is not secret, so the attacker could use it to compute candidate hashes for each password guess.. Salts are stored with the hash and are not secret, so they do not prevent offline dictionary or brute-force attacks. They only defeat precomputed rainbow tables and ensure unique hashes for identical passwords. An attacker who obtains the shadow file can read the salt and compute candidate hashes for each guess, eventually recovering weak passwords. Strong, unique passwords and slow hashing algorithms are the real defenses.

Answer

The $6$ prefix indicates a weak algorithm that can be reversed mathematically to recover the password.

Answer

The salt was generated using a predictable pattern, allowing the attacker to precompute a rainbow table for that specific salt.

Answer

The hash was generated with a low iteration count, making it trivial to compute but not explaining how the salt was bypassed.

Question 11

You are analyzing a packet capture from a compromised host and notice a series of TCP packets with the SYN flag set, sent to sequential ports on multiple internal hosts. The source IP is the compromised host, and the destination ports range from 1 to 1024. The packets are spaced approximately 0.5 seconds apart. Which Nmap scan type is most consistent with this traffic pattern?

Accepted Answer

TCP SYN scan (-sS). The traffic pattern of TCP SYN packets sent to sequential ports on multiple hosts is the hallmark of a TCP SYN scan, which is the default and most common Nmap scan type. It is stealthy because it never completes the three-way handshake, reducing the chance of being logged by applications. The other scan types either use different flags (FIN), different protocols (UDP), or complete connections (connect scan), making them inconsistent with the observed SYN-only traffic.

Answer

UDP scan (-sU)

Answer

TCP FIN scan (-sF)

Answer

TCP connect scan (-sT)

Question 12

An incident responder is preparing to collect volatile evidence from a compromised Windows server that is still running. Which order of collection best preserves the most perishable data?

Accepted Answer

Memory, then network connections and process state, then disk. The order of volatility dictates that the most transient data be captured first. Memory holds active processes, network connections, and keys that vanish on shutdown. Capturing memory, then live network and process state, and finally the disk preserves the evidence most likely to be lost. This sequence reflects standard incident response practice for live systems.

Answer

Event logs, then memory, then disk

Answer

Registry hives, then disk image, then memory

Answer

Disk image first, then memory, then network connections

Question 13

An incident responder is examining a GraphQL API after a breach report. Query logs show a single POST to /graphql containing a query that requests a user's profile, that user's friends, each friend's friends, and so on through deeply chained relationship fields, all in one request. The response was several megabytes and the database showed a spike in joins. No authentication bypass occurred. Which attack does this describe?

Accepted Answer

A resource-exhaustion query exploiting unbounded nesting of relationship fields. The request abused GraphQL's ability to traverse arbitrarily deep relationships in a single query, forcing the server to resolve a huge graph of related records and return a multi-megabyte response. Because the caller was authenticated, the weakness is missing query cost controls rather than an authentication flaw. Defenders should enforce depth limits, complexity scoring, pagination caps, and timeouts on the GraphQL layer.

Answer

A batched query attack using aliases to replay the same mutation many times

Answer

A server-side request forgery via a GraphQL resolver that fetches remote URLs

Answer

GraphQL introspection abuse to map the schema

Question 14

An incident handler is using Nmap to scan a target behind a firewall that blocks ICMP echo requests. The handler wants to increase the chances of host discovery. Which Nmap option should be used to send TCP SYN packets to a specific port for host discovery?

Accepted Answer

-PS. When ICMP is blocked, using TCP-based host discovery can improve results. The -PS option sends TCP SYN packets to specified ports, and a response (SYN/ACK or RST) indicates the host is up. This method is more likely to succeed through firewalls that allow TCP traffic, making it the correct answer.

Answer

-PP

Answer

-PE

Answer

-PA

Question 15

A responder is scanning a target host and wants to determine which IP protocols (e.g., ICMP, IGMP, TCP) are supported by the target. Which Nmap scan type should be used?

Accepted Answer

IP protocol scan (-sO). The IP protocol scan (-sO) is specifically designed to determine which IP protocols are supported by a target. It sends IP packets with different protocol numbers and analyzes the responses (or lack thereof) to identify supported protocols. This makes it the correct choice for the scenario.

Answer

Ping scan (-sn)

Answer

TCP SYN scan (-sS)

Answer

UDP scan (-sU)