GCIH Practice Test 2 — 10 Questions

Question 1

An incident responder analyzes a web application log and discovers that an attacker successfully extracted database schema names by manipulating a parameter where the application dynamically constructs SQL statements. The database error messages returned verbose structural details. Which remediation strategy provides the most robust defense against this injection vector while maintaining application functionality?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Refactor the data access layer to utilize parameterized queries and prepared statements exclusively.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine interprets data strictly as parameters rather than executable code. This eliminates SQL injection vulnerabilities at the architectural level, regardless of input complexity or encoding techniques, protecting the underlying database management system from unauthorized data access and structural enumeration.

Answer

Implement client-side JavaScript validation checks to strip dangerous SQL characters before submission.

Answer

Configure the web application firewall to block requests containing common SQL keywords like UNION and SELECT.

Answer

Disable verbose database error messages globally to prevent attackers from viewing schema details.

Question 2

Which TWO of the following are common indicators that a password database has been compromised?

Accepted Answer

A high volume of account takeover reports. Detecting a password database compromise often involves monitoring for unusual database activity or indicators of downstream misuse. A sudden spike in failed login attempts across many accounts (credential stuffing) or an influx of reports from users about account takeovers on unrelated services are classic red flags. These events suggest that the attacker is leveraging stolen hashes to gain unauthorized access elsewhere, making these observations critical for triggering incident response procedures for a potential database breach.

Answer

Increased server CPU usage during off-hours

Answer

A change in the local system time on the server

Answer

An increase in valid user password reset requests

Question 3

Which of the following best describes the purpose of 'flow data' (like NetFlow) during an incident investigation?

Accepted Answer

To analyze the volume, source, and destination of network traffic.. Flow data provides a high-level summary of network communications, including source, destination, ports, and duration. Unlike full packet capture, which is resource-intensive, flow data is lightweight and allows for long-term retention. It is invaluable for reconstructing an attacker's movement across the network and identifying patterns of communication, such as beaconing to C2 servers, even when specific payload contents are not available.

Answer

To capture the full payload content of every packet.

Answer

To provide a record of who accessed which specific file.

Answer

To perform real-time decryption of SSL/TLS traffic.

Question 4

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 5

A GCIH analyst is reviewing web server logs and sees repeated requests to /search?q=... where the q parameter contains strings like ../../../etc/passwd and ....//....//etc/shadow. The responses include root:x:0:0 entries. The application is a Java servlet that concatenates a user-supplied filename onto a base directory before calling new File(baseDir + userInput). Which vulnerability class best describes this incident?

Accepted Answer

Path Traversal. The attacker manipulates a filename parameter to escape the intended directory using ../ sequences and reads /etc/passwd, which is the defining behavior of Path Traversal. The vulnerable Java code concatenates user input onto a base path without canonicalization or validation, allowing the traversal. SSRF, LFI, and XXE each involve different mechanisms and would not produce this specific log pattern.

Answer

XML External Entity (XXE) injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 6

During an incident response engagement on a Linux server, you discover an attacker has established covert command and control using a custom backdoor communicating over raw ICMP sockets. Which network analysis method provides the most reliable detection mechanism for this specific covert channel regardless of packet payload obfuscation?

Accepted Answer

Analyzing ICMP packet frequency, inter-arrival timing anomalies, and payload size distributions across network flows.. Monitoring packet frequency and timing anomalies identifies ICMP tunneling because legitimate diagnostic tools like ping operate at steady, predictable intervals. Attackers forcing high-volume data transmissions create irregular burst patterns and anomalous payload sizes that standard baseline monitoring quickly highlights as suspicious behavior.

Effective incident handlers must look beyond simple signature detection when analyzing sophisticated tunneling techniques. Understanding foundational network protocols allows analysts to spot statistical deviations even when cryptographic encryption completely obscures the underlying application layer payload contents.

Answer

Scanning all active network interfaces for unauthorized listening TCP ports bound to high-numbered ports.

Answer

Reviewing traditional stateful firewall drop logs for blocked SYN packets originating from internal server zones.

Answer

Inspecting standard application layer web server access logs for anomalous HTTP POST request parameter values.

Question 7

Which technique describes an attacker using a legitimate process to hide malicious code, commonly used to bypass security products that monitor only the primary process?

Accepted Answer

Process Hollowing. Process hollowing is a sophisticated technique where an attacker starts a legitimate process in a suspended state, replaces its memory content with a malicious payload, and then resumes the process. This is effective because security tools often trust the initial process launch and fail to inspect the subsequent memory modification. Understanding this is vital for incident handlers because it explains why legitimate-looking processes may suddenly exhibit malicious behavior during an investigation.

Answer

DLL Side-Loading

Answer

AppInit_DLLs

Answer

Token Impersonation

Question 8

Why is it dangerous to leave port 445 open to the public internet on a Windows server?

Accepted Answer

It increases the attack surface for remote exploitation and credential brute-forcing.. Exposing port 445 to the internet allows any attacker globally to attempt to connect to the server's SMB service. SMB was never designed for internet exposure and contains numerous vulnerabilities that can be exploited remotely. Attackers use this access to perform reconnaissance, brute-force weak credentials, and deploy ransomware by exploiting unpatched vulnerabilities, making it one of the most critical firewall misconfigurations for any organization to avoid.

Answer

It enables legitimate remote file access for all employees.

Answer

It forces the server to use SMBv1, which is faster for internet traffic.

Answer

It prevents the server from using internal authentication protocols.

Question 9

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Accepted Answer

It retrieves cleartext credentials from LSASS memory. The 'sekurlsa::logonpasswords' command extracts cleartext passwords and NTLM hashes for all users who have recently logged into the system, directly from the LSASS memory process. This is a 'game over' scenario because the attacker gains valid, active credentials, allowing them to impersonate the user across the entire network, often without needing to perform further brute-force or cracking attacks.

Answer

It cracks the SAM database file offline

Answer

It resets the local Administrator password

Answer

It clears the event logs to hide the attack

Question 10

An incident responder is investigating a Windows domain controller and discovers that an attacker has successfully dumped the NTDS.dit database. During offline analysis, the responder needs to prioritize cracking accounts with weak passwords using Hashcat. Which hash mode should be explicitly specified for cracking standard Windows NT LAN Manager (NTLM) password hashes extracted from this database?

Accepted Answer

Mode 1000, which corresponds directly to standard NTLM password hashes.. Hashcat mode 1000 specifically targets NTLM password hashes, which are stored within the NTDS.dit database. Modern Windows environments heavily rely on NTLM for authentication fallback and pass-the-hash attacks, making these hashes critical targets for offline cracking during incident response engagements. Accurately identifying and utilizing the correct hash algorithm identifier ensures that computing resources are focused efficiently without wasting time on incompatible parsing formats.

Answer

Mode 3000, which is designated for legacy LAN Manager hashes.

Answer

Mode 5600, which targets NetNTLMv2 network authentication captures.

Answer

Mode 13100, which is utilized for Kerberos 5 TGS-REP etype 23 tickets.