GCIH Practice Test 20 — 15 Questions

Question 1

An incident responder notices a spike in outbound traffic on port 443 originating from a server that normally only communicates with a local database. Which tool is most effective for identifying the specific process responsible for this anomalous network activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -ano. Identifying the link between network sockets and the system process is critical during incident handling. Netstat or ss utilities, specifically when used with process identification flags, allow responders to map external traffic to local binaries. This visibility is essential for distinguishing between legitimate service communication and unauthorized exfiltration or command-and-control beacons, enabling the responder to terminate malicious processes and isolate affected infrastructure quickly.

Answer

tcpdump -i eth0

Answer

nmap -sV target

Answer

ifconfig -a

Question 2

An incident responder investigates a RESTful API where users can access sensitive records simply by incrementing an integer ID in the endpoint URL, such as changing /api/v1/users/104/profile to /api/v1/users/105/profile without providing additional authorization checks. Which vulnerability class does this scenario represent?

Accepted Answer

Broken Object Level Authorization. This scenario clearly demonstrates Broken Object Level Authorization, where authorization validation is missing in the object identifier tier. Attackers exploit this design flaw to harvest unauthorized records horizontally or vertically. Incident handlers must recognize API1:2023 risks during web application forensics to properly scope data exfiltration incidents and remediate flawed access control logic across microservices.

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Answer

Mass Assignment

Question 3

An incident handler is analyzing a Windows endpoint where an adversary successfully executed a living-off-the-land binary (LotLB) to establish an unauthorized tunnel and pivot deeper into the internal network. Which TWO forensic artifacts should the analyst examine to reconstruct the command-line arguments and parent-child process creation chain associated with this execution? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4688 with advanced command-line auditing enabled. Reconstructing process execution lineages requires capturing volatile process trees and detailed argument strings. Windows Security Event Log ID 4688, when command-line auditing is enabled, records the exact parameters passed to binaries. Additionally, memory analysis tools inspect unswapped physical RAM to recover remnants of terminated process execution blocks, making these two sources vital for handling advanced adversary tradecraft.

Answer

Windows System Event Log ID 7045 tracking installed services

Answer

Dynamic Host Configuration Protocol (DHCP) operational logs

Answer

Internet Information Services (IIS) W3C web server access logs

Question 4

An incident handler is reviewing compromised Active Directory domain credentials and notices that an attacker successfully recovered the cleartext password of a service account using an offline cracking tool. Which specific technique did the attacker most likely leverage to target this non-user domain object?

Accepted Answer

Kerberoasting by requesting a service ticket for an SPN and cracking it offline.. Kerberoasting allows any authenticated domain user to request a Service Principal Name ticket, extract the service ticket encrypted with the target service account's NTLM hash, and crack it offline without generating account lockout events. This represents a primary threat for enterprise service accounts utilizing weak passwords.

Answer

AS-REP Roasting targeting user accounts with Kerberos pre-authentication disabled.

Answer

NTLM relaying against local SMB signing configurations.

Answer

Pass-the-Hash utilizing harvested NTLM password hashes from memory.

Question 5

An incident responder is analyzing an API access log and notices a user with ID 104 is able to modify account settings for user ID 105 by simply changing the integer value in the URI endpoint from /api/v1/users/104/settings to /api/v1/users/105/settings without any additional token validation or role checks. Which specific OWASP API Security Top 10 vulnerability class does this scenario represent?

Accepted Answer

Broken Object Level Authorization resulting from missing access control validation checks on resource identifiers embedded directly within API request paths.. This scenario describes Broken Object Level Authorization, where an API endpoint fails to verify whether the authenticated user possesses the appropriate permissions to access or modify a specific object identifier within the URI. Attackers exploit this design flaw to systematically harvest or alter sensitive data across multiple accounts. Recognizing this architectural failure is vital for incident handlers performing root-cause analysis during data breach investigations involving web applications and modern API microservices.

Answer

Broken Authentication due to weak session token generation algorithms allowing session hijacking across user accounts.

Answer

Mass Assignment vulnerability caused by automatically binding incoming HTTP request parameters to internal backend database object properties.

Answer

Improper Assets Management stemming from exposed documentation and forgotten non-production API endpoints lacking proper security controls.

Question 6

A security analyst is examining a Linux system that uses shadow password files. The analyst notices that the password hashes are stored in /etc/shadow and are prefixed with $6$. Which of the following best describes the hashing algorithm used for these passwords?

Accepted Answer

SHA-512. The $6$ prefix in /etc/shadow explicitly indicates the use of SHA-512 for password hashing. This is part of the crypt(3) library format. While SHA-512 is a cryptographic hash function, it is not inherently slow, so it is often used with a salt to prevent rainbow table attacks. Understanding these prefixes helps incident handlers quickly identify the hashing algorithm in use.

Answer

MD5

Answer

SHA-256

Answer

bcrypt

Question 7

A security analyst is reviewing password policies for a Windows Active Directory environment. The current policy requires a minimum length of 8 characters and complexity. However, the organization wants to improve resistance against brute-force attacks. Which of the following changes would most effectively increase the time required for an offline brute-force attack against NTLM hashes?

Accepted Answer

Increase the minimum password length to 14 characters.. For offline brute-force attacks against NTLM hashes, password length is the most critical factor because it exponentially increases the search space. Other policies like history, age, and lockout are useful for online attacks but do not significantly hinder offline cracking. Thus, increasing the minimum length to 14 characters is the most effective change.

Answer

Enable account lockout after 5 failed attempts.

Answer

Set the maximum password age to 30 days.

Answer

Enforce password history of 24 passwords.

Question 8

During an incident, you capture a suspicious binary that evades static detection. You submit it to an AI-based malware analysis platform, which returns a confidence score of 0.55 and flags 'possible packer.' The binary has not yet been detonated. What should you do next?

Accepted Answer

Submit the binary to a dynamic sandbox and correlate its behavior with network and endpoint telemetry.. An AI confidence score of 0.55 with a packer flag is inconclusive, so the responder must validate the hypothesis with behavioral evidence. Dynamic sandbox detonation exposes the malware's actual actions, which can then be correlated with network and endpoint telemetry to confirm malicious intent. Only after corroboration should containment or escalation occur, avoiding both premature blocking and premature dismissal.

Answer

Close the case as a false positive because the confidence score is below 0.75.

Answer

Immediately block the file hash across all endpoints based on the AI flag.

Answer

Extract the binary's strings and import table, then make a final determination based on those static artifacts.

Question 9

An attacker has compromised a Linux host and is pivoting using a SOCKS proxy. Which tool is most commonly utilized for this purpose in a cross-platform environment?

Accepted Answer

Chisel. Chisel is a fast, TCP/UDP tunnel over HTTP, secured via SSH, that is widely used for creating SOCKS proxies. Its ease of use and ability to bypass firewalls make it a favorite for attackers. Incident responders must understand how to detect Chisel traffic, which often mimics standard HTTPS traffic, by inspecting packet sizes and connection duration patterns.

Answer

Netcat

Answer

Tcpdump

Answer

Wget

Question 10

An incident handler investigates a web application breach where an authenticated user modified a hidden form parameter containing an integer account ID, successfully viewing financial records belonging to other customers. Which underlying vulnerability class allowed this unauthorized data access?

Accepted Answer

Insecure Direct Object References resulting from missing authorization checks on object identifiers. Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input without verifying authorization. Attackers manipulate parameter values to access unauthorized resources, bypassing access controls entirely. Identifying this root cause is critical during incident response to properly scope data exposure, remediate broken access controls across the application architecture, and implement centralized authorization checks.

Answer

Cross-Site Scripting via unsanitized parameter reflection in hidden inputs

Answer

Broken Authentication due to predictable session identifier generation

Answer

SQL Injection allowing arbitrary query execution via unsanitized numerical inputs

Question 11

Refer to the exhibit. Given the hashcat output provided, which type of hash is currently being targeted by the attacker, and what is the primary risk associated with this specific attack mode?

Accepted Answer

NTLM; risk of credential theft and lateral movement. The exhibit identifies the use of mode 1000, which corresponds to NTLM hashes. The command uses attack mode 0 (straight dictionary attack). This combination is highly effective against Windows networks where NTLM is utilized. The risk is that if the NTLM hash is cracked, the attacker gains the user's secret, allowing for lateral movement or privilege escalation across the entire Windows domain environment using pass-the-hash or direct authentication.

Answer

SHA-256; risk of collision attacks

Answer

bcrypt; risk of slow brute-force degradation

Answer

Kerberos TGT; risk of Golden Ticket generation

Question 12

Why are 'Pass-the-Hash' (PtH) attacks effective for pivoting in a Windows environment?

Accepted Answer

Because NTLM authentication does not require the password itself.. PtH attacks leverage the NTLM hash directly to authenticate, bypassing the need for the plaintext password. Because Windows stores these hashes in LSASS for single-sign-on capabilities, an attacker who gains administrative rights can extract them and reuse them to access other systems in the domain. This is a fundamental risk in environments where users have local admin rights on their workstations.

Answer

Because they force a password reset on the target.

Answer

Because they only work on Linux-based domain controllers.

Answer

Because the hash is always encrypted with AES-256.

Question 13

During a digital investigation, an incident responder is asked to preserve memory from a compromised Linux server. Which tool is most appropriate for a forensically sound memory acquisition?

Accepted Answer

LiME (Linux Memory Extractor) to generate an image file for offline analysis.. Forensic acquisition requires tools that do not alter the target system's state or metadata significantly. In Linux, LiME (Linux Memory Extractor) is the standard for generating a memory image while minimizing interference. Understanding tool limitations is critical, as improper collection can destroy volatile data, overwrite evidence, or lead to kernel panics, which would invalidate the integrity of the collected memory dump for subsequent analysis and courtroom admissibility.

Answer

The 'dd' command to copy /dev/mem directly to a remote storage server.

Answer

The 'cat' command to pipe the contents of /proc/kcore into a file.

Answer

Installing a commercial agent to automate the imaging process via a GUI.

Question 14

Which of the following describes the purpose of the 'SMB Null Session' vulnerability?

Accepted Answer

To allow unauthenticated users to enumerate system information.. A null session occurs when a client connects to an SMB share without providing valid credentials. In older or misconfigured Windows systems, this allows anonymous users to query the server for sensitive information like user lists, group memberships, and share names. This information is vital for attackers during the reconnaissance phase, as it helps them map the environment and identify potential high-value targets for further exploitation.

Answer

To encrypt traffic between a client and a file server.

Answer

To bypass local firewall restrictions on port 445.

Answer

To prevent unauthorized access to sensitive file shares.

Question 15

During a purple team exercise, an operator uses an LLM to draft a YARA rule that detects a specific C2 beacon observed in network traffic. The model produces a rule with a wide wildcard pattern and a condition matching on a common HTTP header string. Before deploying the rule to production sensors, what should the operator do first?

Accepted Answer

Run the rule against a corpus of benign traffic and known-good files to measure false positive rate and tune the pattern.. Generated detection content must be empirically validated before it reaches production sensors. A rule that matches common HTTP headers with wide wildcards will almost certainly generate excessive false positives, so testing against benign traffic and known-good files is the only way to quantify and tune specificity. Immediate deployment, self-review, or format conversion do not establish ground truth about the rule's behavior in the target environment.

Answer

Convert the YARA rule into a Sigma rule so that it works across more SIEM platforms before testing.

Answer

Deploy the rule immediately to production sensors to collect live telemetry, then refine it based on observed alerts.

Answer

Ask the same LLM to review its own rule and confirm whether the pattern is sufficiently specific.