GCIH Practice Exam 2 — 20 Questions

Question 1

During an incident response engagement on a Linux server, you discover an outbound covert channel using ICMP echo request packets that contain encoded payload data within the payload field. Which specific command-line utility should you look for in the process execution history to identify the tool responsible for generating this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

hping3. Hping3 is a popular packet generator and analyzer for TCP/IP that supports crafting arbitrary ICMP packets with custom payload data. Attackers frequently leverage hping3 or similar custom scripting tools to exfiltrate data through covert channels when standard protocols are blocked by perimeter firewalls, making process history analysis critical for detection.

Answer

ping

Answer

traceroute

Answer

tcpdump

Question 2

An incident responder investigating a compromised Windows workstation discovers that an attacker established persistent command and control using a malicious DLL. The DLL was placed in a system directory and loaded by a legitimate, signed Microsoft binary through DLL search order hijacking. Which response action effectively remediates the persistence while preserving the legitimate binary and minimizing host downtime?

Accepted Answer

Locate and securely delete the rogue malicious DLL file from the search path while preserving the legitimate signed binary and auditing registry permissions.. Identifying and removing the malicious payload while keeping the legitimate application intact is critical for operational continuity during incident response. DLL search order hijacking exploits how Windows searches for dependent libraries. Replacing or removing the unauthorized payload neutralizes the execution vector without requiring a full OS reinstallation, allowing investigators to focus on lateral movement and containment.

Answer

Reimage the compromised workstation immediately to ensure all hidden artifacts and registry hooks are completely removed from the operating system.

Answer

Delete the legitimate signed Microsoft binary that loaded the malicious payload to prevent any further execution attempts by the operating system.

Answer

Modify the Windows Registry to disable the DLL loading subsystem entirely across the domain to prevent all future instances of search order hijacking.

Question 3

An incident responder notices an unusual outbound connection from a workstation to an external IP address on TCP port 443. Packet capture analysis shows that the SSL/TLS handshake completes, but the subsequent application-layer data payload is fully encrypted and does not match standard HTTPS browser traffic patterns. Which log investigation method provides the most reliable approach to determine if this traffic represents malicious command and control activity?

Accepted Answer

Correlate the network connection timestamp with endpoint process execution logs to identify the exact binary that initiated the socket.. Correlating endpoint process execution logs with network connection data via Sysmon Event ID 3 and Event ID 1 reveals the parent process responsible for establishing the socket. Relying solely on destination port 443 or external reputation feeds is insufficient because modern adversaries frequently tunnel malicious traffic over standard ports and encrypted channels to blend in with legitimate enterprise web traffic.

Answer

Perform a reverse DNS lookup on the destination IP address to verify if the domain belongs to a known content delivery network.

Answer

Inspect the certificate issuer authority within the TLS handshake to confirm if it matches internal corporate enterprise signing policies.

Answer

Analyze the TCP window size scaling factors during the initial three-way handshake to detect anomalies indicative of tunneling tools.

Question 4

When auditing an application for Insecure Direct Object References, why is it recommended to perform tests using two distinct user accounts?

Accepted Answer

To confirm that the application does not validate object ownership. Testing with two accounts allows the auditor to verify if User A can access User B's resources using the same identifiers. This 'cross-account' test is the gold standard for confirming an IDOR vulnerability. It isolates the logic flaw by demonstrating that the application fails to validate ownership, proving that access control is tied only to authentication rather than granular authorization, which is a critical finding for secure development.

Answer

To verify if the server is load balanced

Answer

To ensure that session cookies are not reused

Answer

To test the strength of the password hashing

Question 5

An incident responder is investigating a RESTful API breach where an authenticated low-privileged user accessed administrative records by modifying an integer identifier in the resource path from /api/v1/users/104 to /api/v1/users/1. Which type of vulnerability has been exploited?

Accepted Answer

Insecure Direct Object Reference. This scenario describes an Insecure Direct Object Reference vulnerability, commonly classified under Broken Object Level Authorization in modern API security taxonomies. The application fails to validate whether the requesting user possesses authorization to access the specific resource identifier requested in the URL path. Attackers systematically enumerate these predictable identifiers to harvest unauthorized sensitive data across multi-tenant API endpoints during security assessments and active breaches.

Answer

Broken Function Level Authorization

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 6

An analyst uses an AI assistant to summarize a malware report and generate response steps. Before executing any recommended commands on production systems, what is the most important action?

Accepted Answer

Verify the commands against authoritative documentation and test them in a non-production environment.. AI-generated response steps must be treated as suggestions, not instructions. Verifying commands against authoritative documentation and testing them in a non-production environment prevents accidental outages and data loss. This practice preserves production stability and evidence integrity while still allowing the analyst to benefit from AI-assisted summarization and drafting.

Answer

Ask the AI to confirm that its own recommendations are correct.

Answer

Execute the commands immediately to contain the threat before it spreads.

Answer

Save the AI output as the official incident record without modification.

Question 7

Which of the following is a classic example of an 'adversarial' attack against an AI-powered detection engine?

Accepted Answer

Applying minimal, non-functional perturbations to code to cause misclassification.. Adversarial attacks aim to manipulate the input to an AI model to cause a misclassification. By adding carefully crafted, minimal noise—sometimes called an 'adversarial perturbation'—an attacker can make malicious code appear benign to the model. Recognizing these attacks is vital for incident handlers because it explains why an otherwise robust system might miss a clearly malicious payload that an analyst can easily see with the naked eye.

Answer

A distributed denial-of-service attack against the AI server.

Answer

Adding 'dead' code blocks to hide the malicious payload's intent.

Answer

Using stolen credentials to access the AI administration console.

Question 8

An analyst is investigating potential data exfiltration via DNS tunneling. Which TWO of the following indicators would most strongly suggest this activity is occurring?

Accepted Answer

A sudden increase in DNS TXT record requests. DNS tunneling uses DNS queries to encapsulate non-DNS traffic, bypassing standard firewalls. Detecting this requires looking for abnormal patterns in traffic volume and request frequency. By identifying unusually long subdomains or high volumes of TXT/NULL record types, analysts can pinpoint covert channels. This is critical for detecting C2 traffic that hides in plain sight within common, often permitted, network protocols.

Answer

High volumes of HTTP GET requests to internal IPs

Answer

Frequent ICMP echo requests from the perimeter

Answer

TCP SYN floods targeting the local gateway

Question 9

What is the primary function of the 'Token Manipulation' technique in Windows pivoting?

Accepted Answer

To impersonate another user's security context.. Token manipulation involves stealing an access token from a process running as a different user (e.g., SYSTEM or an Administrator) and using it to spawn a new process. This allows the attacker to elevate their privileges or move laterally as a different user. Understanding this technique is vital for incident handlers because it explains how attackers maintain high-level access without knowing user passwords.

Answer

To hide files in a hidden directory.

Answer

To bypass user authentication prompts.

Answer

To encrypt the memory of a running process.

Question 10

An attacker discovers an API endpoint /api/v1/user/details?id=123 that returns JSON data. They modify the parameter to /api/v1/user/details?id=124. This vulnerability indicates a failure in which security control?

Accepted Answer

Insecure Direct Object Reference. This scenario describes Insecure Direct Object Reference (IDOR). The application fails to verify if the authenticated user has authorization to access the object associated with the ID parameter. In API security, this is a critical flaw because APIs often expose backend database keys directly. Proper mitigation requires server-side access control checks on every request, ensuring the requester owns the resource before returning sensitive data.

Answer

Broken Authentication

Answer

Cross-Site Scripting

Answer

Insufficient Logging and Monitoring

Question 11

An incident responder is investigating a suspected SMB relay attack on a corporate network. The attacker has compromised a workstation and is attempting to relay authentication to a domain controller. Which TWO of the following conditions are necessary for a successful SMB relay attack? (Choose two.)

Accepted Answer

SMB signing must be disabled or not required on the target server.. The correct answers are that SMB signing must be disabled or not required on the target server, and the victim's NTLM authentication must be relayed to a server that accepts NTLM. These conditions allow the attacker to forward authentication without detection. The other options are not necessary: valid credentials are not needed, physical access is not required, and SMB 1.0 is not a prerequisite.

Answer

The target server must be running SMB 1.0.

Answer

The attacker must have valid domain credentials for the target server.

Answer

The attacker must have physical access to the victim's workstation.

Question 12

Refer to the exhibit. An application reflects user input directly into the HTML value attribute. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The exhibit shows input being reflected back into the HTML attribute without proper sanitization. This is a classic example of Reflected Cross-Site Scripting (XSS). Because the input is rendered inside a tag attribute, an attacker can break out of the context using quotes to execute arbitrary JavaScript. This highlights the danger of rendering untrusted input, requiring rigorous encoding or validation strategies to ensure the browser interprets data as literal text.

Answer

SQL Injection

Answer

Command Injection

Answer

Insecure Direct Object Reference (IDOR)

Question 13

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 14

A GCIH analyst is examining a web application that uses GraphQL. The analyst notices that an attacker sent a deeply nested query that caused the server to consume excessive resources, leading to a denial of service. Which GraphQL-specific vulnerability is being exploited?

Accepted Answer

GraphQL query depth attack. GraphQL's flexible query language allows clients to specify nested fields. Without proper limits, an attacker can send a query with excessive depth, causing the server to recursively resolve many levels and exhaust CPU or memory. This is a query depth attack, a common GraphQL-specific denial-of-service vector.

Answer

GraphQL alias overloading

Answer

GraphQL batching attack

Answer

GraphQL introspection abuse

Question 15

A penetration tester discovers that a web application uses a predictable numeric parameter `user_id` in the URL to retrieve user profiles. While authenticated as user 1001, the tester changes the parameter to 1002 and successfully views another user's profile. The application does not perform any additional authorization checks beyond verifying the session. Which of the following best describes the vulnerability and its immediate impact?

Accepted Answer

Insecure Direct Object Reference (IDOR) allowing horizontal privilege escalation. The application trusts the client-supplied `user_id` without verifying that the authenticated user is authorized to access that object. By changing the identifier to another user's ID, the attacker accesses data belonging to a peer, which is horizontal privilege escalation. This is a classic IDOR because the reference to the object is direct and predictable, and the application lacks an access control check on the object level.

Answer

Vertical privilege escalation due to missing role-based access control

Answer

SQL injection because the user_id parameter is likely used in a database query

Answer

Cross-Site Request Forgery (CSRF) enabling unauthorized actions

Question 16

During a cloud incident response engagement, an analyst reviews AWS CloudTrail logs and finds that an access key belonging to an IAM user was used from an unfamiliar IP address to call GetSecretValue against AWS Secrets Manager. The key is still active. Which immediate containment action best limits further credential misuse while preserving the ability to investigate who used the key?

Accepted Answer

Deactivate the access key with UpdateAccessKey, then rotate the key and review CloudTrail history associated with that key ID.. The exposed long-term access key is the active threat, so the priority is to make it unusable right away. Deactivating the key with UpdateAccessKey halts all API calls tied to that credential while leaving the IAM user and its policies intact for analysis. CloudTrail retains the access key ID in every event record, so the investigation can continue after containment. Rotating the credential afterward restores access without reintroducing the compromised secret.

Answer

Enable AWS GuardDuty and wait for its findings to confirm the anomaly before taking any action on the credential.

Answer

Delete the IAM user entirely with DeleteUser and recreate it later with the same permissions and a new access key.

Answer

Attach an inline IAM policy to the user that denies all actions with a Condition testing aws:SourceIp against the unfamiliar address.

Question 17

An attacker is using WMI (Windows Management Instrumentation) to move laterally. Which WMI class and method combination is frequently abused for remote process execution?

Accepted Answer

Win32_Process, Create. The Win32_Process class, specifically the Create method, allows for the execution of arbitrary commands on remote systems. Incident responders often look for WMI-based process creation events in logs to detect lateral movement. Because WMI is a legitimate administrative tool, distinguishing between normal management traffic and malicious movement is a key challenge for detection and response teams.

Answer

Win32_Service, StartService

Answer

Win32_StartupCommand, Create

Answer

Win32_ScheduledJob, Create

Question 18

Which TWO of the following are considered best practices for password hashing to mitigate offline cracking?

Accepted Answer

Use a unique, random salt for every user. Modern password storage must prioritize computational cost and uniqueness. Using a per-user salt ensures that even identical passwords result in different hashes, preventing rainbow table attacks. Increasing the computational work factor (e.g., iterations) forces attackers to spend more CPU time per guess, making massive brute-force efforts prohibitively expensive. These controls are foundational to defense-in-depth, protecting user data integrity even when the authentication database is successfully exfiltrated by a threat actor.

Answer

Use a global static pepper appended to all hashes

Answer

Truncate passwords to 8 characters to save space

Answer

Store hashes in plain text for performance

Question 19

An incident handler is analyzing a packet capture and notices a high volume of TCP SYN packets sent to multiple ports on a single target host, with no corresponding SYN-ACK responses. The source IP is spoofed. What type of activity does this indicate?

Accepted Answer

TCP SYN flood. The combination of numerous TCP SYN packets, spoofed source IP, and absence of SYN-ACK responses is a hallmark of a SYN flood attack. This type of denial-of-service attempts to exhaust the target's resources by leaving half-open connections. Recognizing this pattern helps responders mitigate by enabling SYN cookies or rate limiting.

Answer

Port scanning

Answer

ARP spoofing

Answer

UDP fragmentation attack

Question 20

When evaluating potential SQL injection in an application, what is the most significant indicator that an application is vulnerable?

Accepted Answer

User input is directly concatenated into a query string.. The most definitive indicator is the presence of dynamic SQL construction using unsanitized user input. When developers concatenate strings to build queries, the database cannot distinguish between data and command intent. Identifying code patterns where user parameters are directly appended to a SQL string is a critical step in security assessments. This practice allows attackers to manipulate the query structure, leading to unauthorized data exposure, bypasses, or administrative actions within the database management system.

Answer

The application uses a relational database management system.

Answer

The database contains sensitive user data.

Answer

The application is written in an interpreted language.