GCIH Practice Exam 1 — 20 Questions

Question 1

An analyst uses an LLM to generate a C++ exploit. The model provides code that uses an deprecated memory copy function. What is the most appropriate action for the analyst to take?

Accepted Answer

Modify the code to use modern alternatives and perform rigorous security testing.. The analyst must manually review and test all code generated by an LLM. Relying on AI-generated code without verification is dangerous, as LLMs often suggest outdated or insecure practices. The analyst should modernize the code, verify its functionality in a controlled sandbox environment, and ensure it complies with secure coding practices before attempting to deploy it in any real-world offensive operation or security test.

Answer

Execute the code immediately in the production environment to verify functionality.

Answer

Re-run the prompt with a higher temperature to get a different code version.

Answer

Accept the code as is, as the LLM has already accounted for the system requirements.

Question 2

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

Accepted Answer

To detect anomalies in process lineage and execution context.. PPID analysis reveals the execution chain, which is often a major red flag for malicious activity. For example, a web server process spawning a shell is highly suspicious. Understanding these relationships allows incident handlers to detect process hollowing and injection attacks. This context is essential because it distinguishes between legitimate system operations and adversarial techniques designed to blend into the system's normal process hierarchy.

Answer

To identify which user account initiated the malicious activity.

Answer

To determine the file creation date on the disk.

Answer

To ensure the process is running with administrative privileges.

Question 3

What is the primary risk associated with using 'aggressive' scan timing templates (like T4 or T5) in an environment with high network latency?

Accepted Answer

The scan will yield inaccurate results due to premature timeouts.. Aggressive timing templates rely on short timeouts, expecting quick responses from targets. In high-latency networks, these short timeouts lead to false negatives, where Nmap incorrectly labels a port as 'filtered' simply because the response did not arrive before the aggressive timer expired. This leads to inaccurate mapping and missed vulnerabilities, directly undermining the goals of the incident investigation.

Answer

The scan will consume excessive bandwidth.

Answer

The scan will trigger an automated shutdown of the network.

Answer

The scan will crash the Nmap engine.

Question 4

Which TWO of the following are primary security risks associated with the SMBv1 protocol in a modern Windows environment?

Accepted Answer

Susceptibility to remote code execution via EternalBlue. SMBv1 is an archaic protocol that lacks modern security features, making it a critical target for attackers. Its primary risks include vulnerability to well-known remote code execution exploits like EternalBlue and its susceptibility to man-in-the-middle attacks due to weak or absent integrity checks. Understanding these risks is vital for incident handlers to prioritize the deprecation of legacy protocols, which are often the primary entry points for ransomware and lateral movement.

Answer

Inability to support Kerberos authentication

Answer

Lack of support for SMB message signing

Answer

Incompatibility with NTFS permissions

Question 5

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

Accepted Answer

Continuous ingestion of high-quality, normalized telemetry data.. Effective malware hunting requires a combination of strong data hygiene, human intuition, and robust analytical loops. AI provides the speed and pattern recognition necessary to handle large volumes of data, but it requires carefully curated inputs and human oversight to remain effective. These components are essential because they ensure that hunting efforts are scalable, reproducible, and aligned with the actual behavioral patterns observed during the adversary's lifecycle within the enterprise environment.

Answer

Eliminating all manual review to maximize the hunting speed.

Answer

Focusing exclusively on known malware signatures for speed.

Question 6

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.

Question 7

An analyst is investigating a suspected Pass-the-Hash attack within an Active Directory environment. Which TWO Windows Security Event Log IDs should the analyst examine to detect the use of stolen NTLM credential material for lateral movement? (Choose TWO)

Accepted Answer

Event ID 4624 (An account was successfully logged on). Event ID 4624 records successful logons, and specifying Logon Type 3 (Network) combined with NTLM authentication indicates a potential Pass-the-Hash event when originating from an unusual source. Event ID 4672 details special privileges assigned to new logins, helping verify if the compromised security context obtained administrative privileges across the domain.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4720 (A user account was created)

Answer

Event ID 1102 (The audit log was cleared)

Question 8

An application uses a Base64 encoded string as a parameter for object references. An attacker decodes the string, modifies the ID, re-encodes it, and successfully accesses unauthorized data. Why did the security control fail?

Accepted Answer

Base64 encoding is inherently reversible. The failure occurred because the application relied on encoding (Base64) as a security control instead of proper authorization logic. Encoding is a data representation technique, not a security mechanism. Because the server failed to perform access control checks on the decoded identifier, it allowed the attacker to bypass the intended security model. This highlights the importance of never confusing data format obfuscation with actual authorization or identity management.

Answer

The server failed to enforce HTTPS

Answer

The session token was not included in the payload

Answer

The application used an insecure hashing algorithm

Question 9

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 10

Which THREE items are essential components of an API security documentation strategy for incident responders?

Accepted Answer

Up-to-date OpenAPI/Swagger specifications. Effective incident response for APIs requires comprehensive documentation. API specifications (like OpenAPI/Swagger) provide the baseline for expected behavior and valid endpoints. Inventory documentation ensures all endpoints are known and monitored. Finally, security headers and rate-limiting policies document the defense-in-depth posture. Without these, responders cannot differentiate between legitimate traffic patterns and malicious exploitation attempts during an active security event or during post-incident forensic analysis.

Answer

Hardcoded database credentials for internal services

Answer

Customer personal identifiable information (PII) logs

Question 11

An incident responder analyzes a web application log and discovers that an attacker successfully extracted database schema names by manipulating a parameter where the application dynamically constructs SQL statements. The database error messages returned verbose structural details. Which remediation strategy provides the most robust defense against this injection vector while maintaining application functionality?

Accepted Answer

Refactor the data access layer to utilize parameterized queries and prepared statements exclusively.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine interprets data strictly as parameters rather than executable code. This eliminates SQL injection vulnerabilities at the architectural level, regardless of input complexity or encoding techniques, protecting the underlying database management system from unauthorized data access and structural enumeration.

Answer

Implement client-side JavaScript validation checks to strip dangerous SQL characters before submission.

Answer

Configure the web application firewall to block requests containing common SQL keywords like UNION and SELECT.

Answer

Disable verbose database error messages globally to prevent attackers from viewing schema details.

Question 12

Which TWO of the following are common indicators that a password database has been compromised?

Accepted Answer

A high volume of account takeover reports. Detecting a password database compromise often involves monitoring for unusual database activity or indicators of downstream misuse. A sudden spike in failed login attempts across many accounts (credential stuffing) or an influx of reports from users about account takeovers on unrelated services are classic red flags. These events suggest that the attacker is leveraging stolen hashes to gain unauthorized access elsewhere, making these observations critical for triggering incident response procedures for a potential database breach.

Answer

Increased server CPU usage during off-hours

Answer

A change in the local system time on the server

Answer

An increase in valid user password reset requests

Question 13

Which of the following best describes the purpose of 'flow data' (like NetFlow) during an incident investigation?

Accepted Answer

To analyze the volume, source, and destination of network traffic.. Flow data provides a high-level summary of network communications, including source, destination, ports, and duration. Unlike full packet capture, which is resource-intensive, flow data is lightweight and allows for long-term retention. It is invaluable for reconstructing an attacker's movement across the network and identifying patterns of communication, such as beaconing to C2 servers, even when specific payload contents are not available.

Answer

To capture the full payload content of every packet.

Answer

To provide a record of who accessed which specific file.

Answer

To perform real-time decryption of SSL/TLS traffic.

Question 14

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 15

A GCIH analyst is reviewing web server logs and sees repeated requests to /search?q=... where the q parameter contains strings like ../../../etc/passwd and ....//....//etc/shadow. The responses include root:x:0:0 entries. The application is a Java servlet that concatenates a user-supplied filename onto a base directory before calling new File(baseDir + userInput). Which vulnerability class best describes this incident?

Accepted Answer

Path Traversal. The attacker manipulates a filename parameter to escape the intended directory using ../ sequences and reads /etc/passwd, which is the defining behavior of Path Traversal. The vulnerable Java code concatenates user input onto a base path without canonicalization or validation, allowing the traversal. SSRF, LFI, and XXE each involve different mechanisms and would not produce this specific log pattern.

Answer

XML External Entity (XXE) injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 16

During an incident response engagement on a Linux server, you discover an attacker has established covert command and control using a custom backdoor communicating over raw ICMP sockets. Which network analysis method provides the most reliable detection mechanism for this specific covert channel regardless of packet payload obfuscation?

Accepted Answer

Analyzing ICMP packet frequency, inter-arrival timing anomalies, and payload size distributions across network flows.. Monitoring packet frequency and timing anomalies identifies ICMP tunneling because legitimate diagnostic tools like ping operate at steady, predictable intervals. Attackers forcing high-volume data transmissions create irregular burst patterns and anomalous payload sizes that standard baseline monitoring quickly highlights as suspicious behavior.

Effective incident handlers must look beyond simple signature detection when analyzing sophisticated tunneling techniques. Understanding foundational network protocols allows analysts to spot statistical deviations even when cryptographic encryption completely obscures the underlying application layer payload contents.

Answer

Scanning all active network interfaces for unauthorized listening TCP ports bound to high-numbered ports.

Answer

Reviewing traditional stateful firewall drop logs for blocked SYN packets originating from internal server zones.

Answer

Inspecting standard application layer web server access logs for anomalous HTTP POST request parameter values.

Question 17

Which technique describes an attacker using a legitimate process to hide malicious code, commonly used to bypass security products that monitor only the primary process?

Accepted Answer

Process Hollowing. Process hollowing is a sophisticated technique where an attacker starts a legitimate process in a suspended state, replaces its memory content with a malicious payload, and then resumes the process. This is effective because security tools often trust the initial process launch and fail to inspect the subsequent memory modification. Understanding this is vital for incident handlers because it explains why legitimate-looking processes may suddenly exhibit malicious behavior during an investigation.

Answer

DLL Side-Loading

Answer

AppInit_DLLs

Answer

Token Impersonation

Question 18

Why is it dangerous to leave port 445 open to the public internet on a Windows server?

Accepted Answer

It increases the attack surface for remote exploitation and credential brute-forcing.. Exposing port 445 to the internet allows any attacker globally to attempt to connect to the server's SMB service. SMB was never designed for internet exposure and contains numerous vulnerabilities that can be exploited remotely. Attackers use this access to perform reconnaissance, brute-force weak credentials, and deploy ransomware by exploiting unpatched vulnerabilities, making it one of the most critical firewall misconfigurations for any organization to avoid.

Answer

It enables legitimate remote file access for all employees.

Answer

It forces the server to use SMBv1, which is faster for internet traffic.

Answer

It prevents the server from using internal authentication protocols.

Question 19

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Accepted Answer

It retrieves cleartext credentials from LSASS memory. The 'sekurlsa::logonpasswords' command extracts cleartext passwords and NTLM hashes for all users who have recently logged into the system, directly from the LSASS memory process. This is a 'game over' scenario because the attacker gains valid, active credentials, allowing them to impersonate the user across the entire network, often without needing to perform further brute-force or cracking attacks.

Answer

It cracks the SAM database file offline

Answer

It resets the local Administrator password

Answer

It clears the event logs to hide the attack

Question 20

An incident responder is investigating a Windows domain controller and discovers that an attacker has successfully dumped the NTDS.dit database. During offline analysis, the responder needs to prioritize cracking accounts with weak passwords using Hashcat. Which hash mode should be explicitly specified for cracking standard Windows NT LAN Manager (NTLM) password hashes extracted from this database?

Accepted Answer

Mode 1000, which corresponds directly to standard NTLM password hashes.. Hashcat mode 1000 specifically targets NTLM password hashes, which are stored within the NTDS.dit database. Modern Windows environments heavily rely on NTLM for authentication fallback and pass-the-hash attacks, making these hashes critical targets for offline cracking during incident response engagements. Accurately identifying and utilizing the correct hash algorithm identifier ensures that computing resources are focused efficiently without wasting time on incompatible parsing formats.

Answer

Mode 3000, which is designated for legacy LAN Manager hashes.

Answer

Mode 5600, which targets NetNTLMv2 network authentication captures.

Answer

Mode 13100, which is utilized for Kerberos 5 TGS-REP etype 23 tickets.