GCIH Practice Test 18 — 15 Questions

Question 1

A GCIH incident responder is conducting a forensic investigation of a compromised Windows system. The responder needs to determine which user accounts were used to log on to the system and whether any unauthorized access occurred. Which Windows event log should the responder examine to find successful and failed logon attempts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security log. The Security log is the authoritative source for authentication events on Windows. It records successful logons (event ID 4624) and failed logons (event ID 4625), along with details such as the user account, logon type, and source workstation. By analyzing this log, the responder can determine which accounts were used and identify any unauthorized access attempts, fulfilling the investigation requirement.

Answer

Application log

Answer

Setup log

Answer

System log

Question 2

During an incident response investigation, you need to identify all hosts on a subnet that are responding to ARP requests. You have administrative access to a Linux workstation on the same subnet and want to use Nmap to perform this discovery without sending any IP packets. Which Nmap option should you use?

Accepted Answer

-PR. The -PR option performs ARP ping, which sends ARP requests to discover hosts on the local subnet. ARP operates at layer 2 and does not use IP packets, satisfying the requirement. It is also the most reliable method on a local Ethernet segment because hosts must respond to ARP to communicate. The other options all send IP packets (ICMP, TCP SYN, or TCP ACK) and are not ARP-based.

Answer

-PS

Answer

-PE

Answer

-PA

Question 3

An analyst is training a machine learning model to classify malware families. Which data preparation technique is most critical to prevent bias in the classification results?

Accepted Answer

Ensuring a balanced distribution of samples across all malware classes.. Data balance is the foundation of effective machine learning. If a training set is heavily skewed toward one malware family, the model will develop a prediction bias that favors that family, leading to poor classification performance for novel variants. This matters because biased models provide a false sense of security, causing investigators to overlook emerging threats that do not fit the over-represented patterns learned during the training phase.

Answer

Including only the most recent malware samples in the dataset.

Answer

Manually labeling only a small subset of the total available samples.

Answer

Removing all features that contain obfuscated code or strings.

Question 4

Which THREE actions are effective at identifying hidden 'living-off-the-land' (LotL) binary usage in a compromised system?

Accepted Answer

Reviewing command-line argument logs for suspicious flags.. LotL attacks use legitimate tools like WMI, PowerShell, and certutil to perform malicious actions, making them difficult to detect. Since the binaries are trusted, defenders must look for suspicious execution contexts, unusual parameters, or non-standard parent processes. This is critical because attackers use these techniques to bypass signature-based endpoint protection, requiring behavioral analysis to uncover the unauthorized activity within the noise of standard system management tasks.

Answer

Scanning the disk for all instances of binary files.

Answer

Restricting all user permissions to local system accounts.

Question 5

You are investigating an alert regarding a 'Beaconing' pattern. Which aspect of the network connection is most indicative of automated C2 communication versus human browsing activity?

Accepted Answer

The consistency of the time interval between connections.. Beaconing refers to periodic, consistent communication patterns between a compromised host and a C2 server. While human browsing is stochastic and unpredictable, automated beacons often exhibit high regularity in interval and small, consistent packet sizes. Identifying these 'heartbeat' patterns in network traffic analysis is critical for detecting persistent threats that avoid large, noticeable data bursts but maintain constant connectivity for command receipt.

Answer

The total volume of data transferred.

Answer

The destination port used for the traffic.

Answer

The protocol used by the connection.

Question 6

An analyst notices that an AI-powered detection tool is flagging legitimate administrative PowerShell scripts as malicious. Which approach should the analyst take to improve model precision?

Accepted Answer

Update the training set to include these scripts as 'benign' examples.. Model precision is improved by incorporating false positives into the training loop. By labeling these administrative scripts correctly, the analyst provides the model with the necessary 'negative' examples to learn the nuances between legitimate management tasks and malicious activity. This reduces future noise, allowing the incident response team to focus on actual threats rather than spending time triaging recurring, known-good administrative actions that currently trigger alerts.

Answer

Disable the detection rule entirely until the AI update is released.

Answer

Increase the sensitivity threshold of the AI model to ignore all PowerShell activity.

Answer

Replace the AI model with a static signature-based detection system.

Question 7

An analyst notices an increase in SMB authentication failures from a workstation. What is the most likely cause if the workstation has a stored credential that is being used for SMB connections?

Accepted Answer

The stored credential is out of sync with the current domain password.. Stored credentials in Windows Credential Manager can cause authentication failures if the password for the account has been changed in Active Directory but not updated in the local cache. When the system attempts to connect to an SMB share, it automatically uses the stale stored credential, leading to repeated failed attempts. This can lock out the user's account, making it a critical issue to address for operational continuity and security.

Answer

The SMB server is blocking all incoming traffic.

Answer

The SMBv1 protocol is disabled on the workstation.

Answer

The firewall is blocking port 445 on the workstation.

Question 8

An incident responder is investigating a breach where attackers gained initial access via a phishing email. The email contained a malicious macro that executed a PowerShell script. The script attempted to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. Which of the following techniques is the attacker most likely using, and what is the primary goal?

Accepted Answer

Credential dumping, to obtain plaintext passwords or hashes from memory for further attacks.. The attacker is performing credential dumping from LSASS to harvest credentials. This is a common step after initial access, enabling further attacks like lateral movement or privilege escalation. The other options describe different techniques that either occur after credential dumping or target different components. Therefore, credential dumping is the correct identification.

Answer

Pass-the-Hash, to authenticate to other systems using captured NTLM hashes without knowing the plaintext password.

Answer

Golden Ticket attack, to forge Kerberos ticket-granting tickets using the KRBTGT account hash.

Answer

Kerberoasting, to request service tickets and crack their encryption offline to obtain service account passwords.

Question 9

Which of the following is the most secure method for handling file references in a web application to prevent path traversal?

Accepted Answer

Using indirect references via a database lookup. The most secure method is to use indirect references, such as a database lookup, where the user-supplied input maps to a predefined index or key. This prevents the user from ever providing a raw file path or directory structure to the server. By abstracting the file system, the application maintains complete control over which files are accessible, effectively eliminating the possibility of traversal attacks by design.

Answer

Sanitizing input by removing '..' sequences

Answer

Encrypting the file path in the URL

Answer

Allowing only alphanumeric characters in the filename

Question 10

In the context of API security, what does the 'Broken Object Level Authorization' (BOLA) vulnerability typically involve?

Accepted Answer

Lack of authorization checks on object access. BOLA occurs when an API endpoint uses user-supplied input to access a resource (like a database ID) but fails to check if the requester is authorized to access that specific object. Because APIs often expose internal resource IDs directly, attackers can easily enumerate or modify these IDs to access other users' data, making this one of the most common and damaging vulnerabilities in modern web and mobile API architectures.

Answer

Failure to encrypt sensitive API parameters

Answer

Inability to verify the requester's identity

Answer

Excessive use of third-party API libraries

Question 11

During an incident response, you identify that an attacker is using an SMB relay attack to gain domain-level access. Which mitigation strategy effectively prevents this by forcing authentication through a secure, encrypted channel?

Accepted Answer

Enable SMB message signing. SMB signing is the primary defense against relay attacks. By enforcing SMB signing, the server refuses any connection that does not have a valid cryptographic signature, which prevents attackers from relaying captured authentication tokens. Without this signature, the relay attack fails because the attacker cannot forge the necessary cryptographic proof of identity. This is a fundamental security requirement for all modern domain-joined environments to maintain integrity and thwart lateral movement.

Answer

Enable SMBv1 protocol support

Answer

Disable the Windows Firewall

Answer

Enable guest access on all SMB shares

Question 12

Which of the following describes a 'Password Spraying' attack, and why is it preferred by attackers over traditional brute-force methods against a target domain?

Accepted Answer

Using one common password against many different accounts. Password spraying involves testing a single, common password against a large list of accounts rather than testing many passwords against one account. It is preferred because it avoids triggering account lockout thresholds, which are designed to detect traditional brute-force attacks. By keeping the authentication frequency low per account, attackers can stay under the radar of automated security monitoring systems while significantly increasing the likelihood of compromising at least one account.

Answer

Testing thousands of passwords against a single high-privileged account

Answer

Capturing hashes via packet sniffing and offline cracking

Answer

Injecting malicious code into the authentication form

Question 13

An incident responder is evaluating a compromised web application server where attackers utilized a custom Large Language Model framework to dynamically generate targeted SQL injection payloads based on real-time database error feedback. Which architectural vulnerability in the LLM integration enabled this adaptive offensive capability?

Accepted Answer

Unrestricted execution loops connecting model output directly to database querying modules. Integrating LLMs directly into closed-loop feedback mechanisms without rigorous output filtering allows agents to parse error logs and iteratively refine exploitation strings. Incident handlers must inspect agent memory state and prompt chains to determine how dynamic payload generation bypassed static signature-based Web Application Firewalls.

Answer

Failure to enforce strict context-window limits on the primary transformer model

Answer

Implementation of outdated quantization techniques on the local embedding weights

Answer

Misconfigured vector database permissions allowing unauthorized embedding vector reads

Question 14

What is the primary purpose of 'Time Stomping' during a post-exploitation phase?

Accepted Answer

To blend malicious files into the existing file system timeline.. Time stomping involves modifying the timestamp attributes of files—specifically Created, Accessed, Written, and Mapped (CAWM) times—to match surrounding system files. This technique is designed to hide the presence of malicious files from forensic investigators who look for outliers in file system timelines. By understanding this, defenders know that relying solely on standard file system timestamps during an investigation is insufficient and requires secondary validation methods.

Answer

To crash the file system and hide malicious processes.

Answer

To bypass file integrity monitoring (FIM) signatures.

Answer

To increase the privilege level of the attacker.

Question 15

An incident handler executes the Nmap command shown in the exhibit against a known target server. Based on the output provided, which underlying mechanism enables Nmap to determine that port 80 is open without completing a full three-way TCP handshake?

Accepted Answer

Nmap transmits a TCP RST packet upon receiving a SYN-ACK from the target, preventing the local kernel from establishing a full session.. An Nmap SYN scan (-sS) sends a TCP SYN packet and waits for a response. If the target service is listening, it responds with a SYN-ACK packet. Upon receiving the SYN-ACK, Nmap immediately transmits a RST packet to tear down the connection before the operating system kernel can complete the standard three-way handshake, preserving stealth and speed.

Answer

Nmap sends a TCP FIN packet immediately after receiving the initial SYN-ACK, forcing the remote server to close the socket gracefully.

Answer

Nmap listens for the application-layer banner returned by the service daemon before sending an immediate connection teardown flag.

Answer

Nmap relies on ICMP Source Quench messages generated by the remote kernel to verify that the listener accepted the initial synchronization packet.