GCIH Practice Test 19 — 15 Questions

Question 1

An attacker manipulates a URL parameter `?file=invoice_123.pdf` to `?file=../../etc/passwd` on a web server. The application successfully returns the sensitive system file content. Which vulnerability is being exploited?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Path Traversal. This scenario describes a Path Traversal attack, where an application fails to validate user input used to construct file system paths. By using dot-dot-slash notation, the attacker escapes the intended directory to access unauthorized files. This represents a critical failure in input validation and access control, commonly leading to full system compromise or sensitive data exposure, necessitating robust file path normalization and strictly defined allow-lists.

Answer

Cross-Site Request Forgery

Answer

SQL Injection

Answer

Server-Side Request Forgery

Question 2

An organization experiences a rapid spread of ransomware across the internal network. Analysts determine that the ransomware is exploiting SMB to move laterally. Which configuration effectively limits this spread by preventing SMB communication between workstations?

Accepted Answer

Implementing Windows Firewall rules to block port 445 between workstations. Disabling SMB traffic between workstations, often referred to as intra-subnet or host-to-host SMB blocking, is a highly effective mitigation strategy against ransomware. By enforcing this via Windows Firewall or Group Policy, you prevent lateral movement, as ransomware frequently uses SMB to copy its own payload to other machines. This strategy adheres to the principle of least privilege, ensuring workstations only talk to servers, not to each other.

Answer

Disabling the Workstation service on all servers

Answer

Increasing the SMB session timeout duration

Answer

Enabling the Print Spooler service on all workstations

Question 3

A security team is configuring encryption for data at rest in an Amazon S3 bucket that stores regulated financial records. They need to ensure that the encryption keys are managed by the organization and can be rotated on demand, while also providing an audit trail of key usage. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS with customer managed keys provides the necessary control over encryption keys, including the ability to rotate them on demand and define key policies. It integrates with CloudTrail to log key usage, which is essential for auditing access to sensitive financial records. Other S3 encryption options either do not allow customer management of keys or lack the audit trail required for compliance.

Answer

S3 server-side encryption with Amazon S3 managed keys (SSE-S3)

Answer

S3 server-side encryption with customer-provided keys (SSE-C)

Answer

Amazon S3 default encryption with AES-256

Question 4

Why is it important to randomize the target IP addresses when performing a large-scale network scan?

Accepted Answer

To avoid triggering threshold-based IDS alerts on specific subnets.. Randomizing scan targets is a defensive measure against triggering automated threshold-based IDS/IPS alerts. By jumping between different subnets, the scanner avoids concentrating traffic on a single point in the network, which effectively prevents the security system from correlating multiple hits on a single host or subnet, thereby keeping the responder's reconnaissance activity below the typical detection thresholds of the organization.

Answer

To reduce the scan duration by optimizing packet routing.

Answer

To bypass the target operating system's rate limiting.

Answer

To ensure the scanner utilizes all available network interfaces.

Question 5

An incident handler observes that an internal server is leaking sensitive file system structure via SMB. Which configuration change most effectively prevents SMB null session enumeration?

Accepted Answer

Set RestrictAnonymous to 2. Disabling anonymous access and restricting null sessions is critical for hardening SMB. By configuring the RestrictAnonymous registry key to 2, the operating system denies all anonymous users from enumerating shares, usernames, and groups. This prevents attackers from performing reconnaissance against the server, significantly reducing the attack surface by ensuring that only authenticated users can query sensitive SMB metadata during the initial stages of a lateral movement attempt.

Answer

Set RestrictAnonymous to 0

Answer

Enable SMBv1 protocol support

Answer

Disable the LanmanServer service

Question 6

Which Nmap argument should be used to display the reason why a port is reported as 'open', 'closed', or 'filtered' in the scan results?

Accepted Answer

--reason. The --reason flag provides deep visibility into why Nmap labeled a port in a specific way by reporting the exact packet or ICMP message that caused the determination. This is incredibly useful for incident responders, as it allows them to identify exactly which network devices (like a firewall or a specific host OS behavior) are causing traffic to be filtered or dropped during an assessment.

Answer

--verbose

Answer

--packet-trace

Answer

-d

Question 7

An incident responder notices that a local user account is performing Kerberoasting. Which event log ID should the responder examine to verify this activity?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting service tickets for service accounts from the Key Distribution Center (KDC) to crack service account passwords offline. In Windows event logs, this activity generates a specific event when a service ticket is requested. Detecting this is essential because it is a common post-exploitation technique for lateral movement and privilege escalation, allowing attackers to compromise highly privileged service accounts without interacting with the domain controller directly.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 4688

Question 8

Which behavior is indicative of a 'Golden Ticket' attack occurring in a Windows environment?

Accepted Answer

Unusually long ticket lifetimes or requests without an initial AS-REQ.. A Golden Ticket attack involves an adversary gaining access to the Krbtgt account hash, which allows them to forge TGTs (Ticket Granting Tickets) for any account. Because the ticket is forged offline and holds virtually infinite lifetime, it bypasses password changes and enables persistent, stealthy domain-wide access. Detecting this requires monitoring for abnormal TGT requests that do not correlate with legitimate authentication events, which is vital for preventing long-term domain compromise.

Answer

The user password is changed without authorization.

Answer

An increase in NTLM traffic across the domain.

Answer

The creation of a new, highly privileged domain administrator.

Question 9

During an incident response engagement involving a web application, an analyst uncovers evidence of Command Injection. Which TWO indicators or technical conditions strongly support this specific finding? (Choose TWO)

Accepted Answer

Presence of shell metacharacters like pipes, ampersands, or semicolons within HTTP parameter values. Command injection occurs when untrusted user input is passed directly to operating system shell interpreters via functions like system() or popen(). Analysts look for shell metacharacters such as pipes or semicolons in access logs alongside process creation anomalies indicating spawned subprocesses.

Answer

Database error logs displaying syntax violations from unmatched table column counts

Answer

Application configuration files storing plaintext database connection passwords

Answer

Client-side DOM manipulation errors logged within browser developer console windows

Question 10

During an investigation of a suspected lateral movement attempt within an Active Directory environment, an incident handler needs to isolate authentication events involving Kerberos ticket-granting service (TGS) requests that indicate potential Kerberoasting activity. Which Windows Security Event Log ID should the analyst examine to identify abnormal requests for service principal names (SPNs) using weak encryption algorithms?

Accepted Answer

Security Event ID 4769. Windows Security Event Log ID 4769 is generated whenever a Kerberos service ticket is requested. By filtering for Event ID 4769 and analyzing the encryption type field, analysts can spot requests using older, weaker encryption standards like RC4, which are heavily utilized during offline Kerberoasting password cracking attacks against service accounts.

Answer

Security Event ID 4624

Answer

Security Event ID 4768

Answer

Security Event ID 4771

Question 11

An API uses OAuth 2.0. An attacker sends a request with a modified 'redirect_uri' parameter to an authorization endpoint. If successful, this could lead to which type of vulnerability?

Accepted Answer

Authorization Code Interception. Manipulating the 'redirect_uri' in an OAuth flow is a classic technique to facilitate Authorization Code Interception. By changing the URI to a domain under the attacker's control, the attacker can cause the authorization server to send the sensitive authorization code to them instead of the legitimate client application, enabling them to exchange the code for an access token and impersonate the user.

Answer

Denial of Service

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 12

A responder needs to map an internal network but cannot use standard tools due to strict endpoint protection. Which technique can be used with native command-line tools to perform a basic port check on a remote host?

Accepted Answer

Using a PowerShell Test-NetConnection command.. Using native tools like PowerShell or Netcat allows for basic network verification when dedicated scanning tools are blocked by endpoint security suites. By leveraging built-in functionality such as Test-NetConnection in PowerShell, a responder can verify reachability and port status without introducing unauthorized binaries, thereby maintaining the integrity of the environment while still performing necessary incident response data gathering.

Answer

Running an nmap.exe binary from a USB drive.

Answer

Initiating a telnet session to every port.

Answer

Pinging the broadcast address of the subnet.

Question 13

An attacker has compromised a host and established persistence using a malicious scheduled task that executes an encoded PowerShell command. The command downloads a second-stage payload from a legitimate cloud storage service. Your AI-assisted EDR has flagged the activity but provided only a low-confidence alert. As the incident responder, you need to determine the next investigative step. Which of the following actions is MOST likely to yield actionable intelligence about the second-stage payload?

Accepted Answer

Decode the PowerShell command and extract the URL to retrieve the payload for analysis.. Decoding the PowerShell command and retrieving the payload is the most direct way to gain intelligence. It allows you to analyze the malware, extract IOCs, and understand the attack chain. Other options either destroy evidence, are unlikely to detect the payload, or provide limited context.

Answer

Immediately isolate the host and rebuild it from a known-good image.

Answer

Review the scheduled task's XML definition to identify the author and creation time.

Answer

Run a full antivirus scan on the host to detect and remove the second-stage payload.

Question 14

An analyst discovers a malicious DLL file in a system directory. What is the most effective way to identify which process loaded this DLL into memory?

Accepted Answer

Use memory forensics tools to inspect loaded modules per process.. Identifying the process that loaded a malicious DLL is fundamental for understanding the scope of the compromise. Memory forensic tools can map loaded modules to specific process IDs (PIDs). This is critical because it allows the handler to identify whether the DLL is being used for process injection, persistence, or credential theft, providing the necessary evidence to isolate and remediate the affected processes immediately.

Answer

Search the file system for other files with similar names.

Answer

Examine the Windows Event Logs for file creation events.

Answer

Check the registry for new service installation entries.

Question 15

An adversary uses PowerShell to establish a reverse shell. The command includes the '-EncodedCommand' flag with a long Base64 string. What is the most effective way to detect this activity without relying on static command signatures?

Accepted Answer

Enable PowerShell Script Block Logging to capture de-obfuscated code.. Static signatures fail against randomized Base64 encoding. Behavioral detection, specifically script block logging, captures the de-obfuscated code before execution. This is essential for incident handlers because attackers frequently use obfuscation to bypass simple keyword filters. Script block logging provides the exact command executed in memory, allowing for accurate analysis of the intent regardless of the obfuscation technique employed by the attacker.

Answer

Block all outbound connections originating from PowerShell processes.

Answer

Monitor for any usage of the 'powershell.exe' process in logs.

Answer

Perform string analysis on all files in the system directories.