GCIH Practice Exam 3 — 20 Questions

Question 1

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Accepted Answer

A malicious user triggers a service to use its privileges against a resource.. The Confused Deputy problem occurs when a privileged service is coerced into performing an action on behalf of a user who lacks the permissions to perform that action directly. By utilizing 'External IDs' or 'Condition keys' like 'aws:SourceArn', developers can prevent this by ensuring that the service only assumes the role when the request originates from an authorized context, preventing unauthorized cross-account access and privilege escalation.

Answer

A user is assigned two different roles with conflicting permissions.

Answer

Two cloud administrators inadvertently delete each other's work.

Answer

A service fails to refresh its temporary tokens, causing a lockout.

Question 2

An attacker uses living-off-the-land binaries (LotLbins) to execute a malicious PowerShell script. Which detection strategy best identifies this activity while minimizing false positives from administrative scripts?

Accepted Answer

Monitor process lineage for common utilities launching suspicious child processes.. Detecting LotLbins requires focusing on process lineage and behavioral context rather than just the binary name. By correlating parent-child process relationships—specifically looking for common utilities like certutil.exe or mshta.exe spawning suspicious network connections or child shells—defenders can distinguish malicious intent from standard management tasks. This approach is critical in modern environments where native tools are frequently abused to bypass static signature-based detection mechanisms used by legacy EDR solutions.

Answer

Block all PowerShell execution via Group Policy Objects.

Answer

Flag any process execution involving native Windows binaries.

Answer

Implement static file hash signatures for all known LotLbins.

Question 3

Why are GPUs highly effective at cracking password hashes compared to traditional CPUs?

Accepted Answer

GPUs perform massively parallel operations. GPUs excel at parallel processing, containing thousands of small cores designed to perform simple mathematical operations simultaneously. Password hashing, particularly MD5 or SHA-1, involves repetitive, independent calculations, which is the perfect workload for a GPU. While a CPU might handle a few operations at once, a GPU can calculate millions of hashes per second. This speed advantage drastically reduces the time required for brute-force attacks against databases using weak, unsalted, or fast hashing algorithms.

Answer

GPUs have higher clock speeds than CPUs

Answer

GPUs access system RAM faster than CPUs

Answer

GPUs use a different instruction set than CPUs

Question 4

Which of the following is the primary risk associated with using unvetted AI models for malware signature generation?

Accepted Answer

The model may produce signatures that trigger on benign system binaries.. Using unvetted AI models for signature generation risks creating false signatures that could lead to widespread system instability or denial of service if deployed to endpoint protection platforms. In the context of malware investigation, these tools must be calibrated against known-good and known-bad datasets. Failing to vet the model results in a high false-positive rate, which ultimately undermines the efficacy of the incident response team and wastes valuable time during critical security incidents.

Answer

The model will always generate signatures that are too complex to implement.

Answer

The model will consume excessive processing power on the endpoint.

Answer

The model will force the malware to evolve into a polymorphic variant.

Question 5

A GCIH incident responder is investigating a suspected API attack where an attacker manipulated a JSON Web Token (JWT) to gain unauthorized access. The responder needs to identify which two conditions would allow a JWT 'kid' (Key ID) header injection attack to succeed. (Choose two.)

Accepted Answer

The application allows the 'kid' header to specify an absolute path or URL that the server will fetch to obtain the key.. JWT 'kid' injection succeeds when the application uses the 'kid' header to determine the verification key without validating its content. If the 'kid' is used to build a file path or fetch a remote key, an attacker can manipulate it to use a key they control, forging valid tokens. The other conditions describe different JWT weaknesses.

Answer

The application uses a symmetric signing algorithm and the secret is weak or guessable.

Answer

The JWT is transmitted over an unencrypted HTTP connection, allowing token interception.

Answer

The application supports the 'none' algorithm and accepts unsigned tokens.

Question 6

A security analyst is investigating a suspected local file inclusion (LFI) attack against a PHP web application. The web server logs show the following request: `GET /download.php?file=php://filter/convert.base64-encode/resource=index.php`. The analyst needs to determine the attacker's objective and the potential impact. (Choose two.)

Accepted Answer

The attacker is attempting to read the source code of `index.php` by encoding it in Base64 to bypass PHP execution.. The payload uses the `php://filter` wrapper with Base64 encoding to read the source code of `index.php`. This technique bypasses PHP execution, allowing the attacker to view the raw code, which may contain sensitive information like database credentials. The other options misidentify the objective, such as command execution or CSRF, which are not supported by the specific payload.

Answer

The attacker is attempting to retrieve the contents of a sensitive file, such as `/etc/passwd`, by including it directly.

Answer

The attacker is attempting to perform a cross-site request forgery (CSRF) attack against the web application.

Answer

The attacker is attempting to execute arbitrary commands on the server via the `file` parameter.

Question 7

An incident responder investigates a web application breach where an attacker successfully extracted sensitive user data by appending UNION SELECT statements to a numeric product ID parameter. Which backend remediation approach directly eliminates this vulnerability class while preserving application functionality?

Accepted Answer

Refactor database queries to use prepared statements with bound parameters via the application data access layer.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine treats input exclusively as data rather than executable code. Implementing parameterized queries globally stops SQL injection by neutralizing untrusted input regardless of characters appended by attackers, making it the definitive defense for database interaction security in incident response hardening.

Answer

Implement client-side JavaScript regex validation to strip SQL keywords from input parameters before transmission.

Answer

Wrap all user inputs inside custom string-escaping functions designed to neutralize single quotes and semicolons.

Answer

Deploy a traditional network firewall configured with signature rules to block incoming HTTP GET requests containing UNION.

Question 8

An incident responder is analyzing a compromised Linux server. The responder notices that the file /etc/ld.so.preload contains the path /lib/libprocess.so, which is not a standard library. The responder suspects an attacker is using this for persistence and privilege escalation. Which post-exploitation technique is being employed?

Accepted Answer

Dynamic linker preloading via /etc/ld.so.preload. The /etc/ld.so.preload file is used by the dynamic linker to load specified shared libraries before any others for all dynamically linked executables. An attacker can place a malicious library there to intercept function calls, escalate privileges, or maintain persistence. This technique is stealthy because it affects all programs and is not easily detected by process monitoring.

Answer

Cron job persistence

Answer

Kernel module rootkit insertion

Answer

LD_PRELOAD environment variable hijacking

Question 9

A security analyst is reviewing logs from a Linux web server and notices that the 'last' command output shows a login by user 'root' from an IP address that is not part of the company's network. The login occurred at 03:00 AM, and the analyst also finds that the file /root/.ssh/authorized_keys was modified at the same time. Which post-exploitation technique has the attacker most likely used?

Accepted Answer

SSH key persistence. The modification of /root/.ssh/authorized_keys to include an attacker's public key is a classic SSH key persistence technique. The suspicious root login from an external IP at an odd hour corroborates this. Attackers use this to maintain access without needing a password, even if credentials are changed.

Answer

LD_PRELOAD hijacking

Answer

Cron job persistence

Answer

Kernel module rootkit

Question 10

Refer to the exhibit. Given the provided log entry, which attack is likely occurring, and what does the sub-status code indicate?

Accepted Answer

Brute-force/Dictionary attack; 0xC000006A means bad password. Event ID 4625 with sub-status 0xC000006A indicates a failed logon due to a bad password. When this appears repeatedly from a single source for an administrative account, it strongly suggests a brute-force or dictionary attack. The NTLM authentication process indicates that the attacker is attempting to authenticate using the legacy NTLM protocol, which is a common indicator of targeted attacks against Windows environments.

Answer

Pass-the-Hash; 0xC000006A means the hash is expired

Answer

Account lockout; 0xC000006A means account is disabled

Answer

Kerberoasting; 0xC000006A means SPN not found

Question 11

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics

Question 12

During a forensic analysis of a compromised developer workstation, an incident handler discovers scripts showing an attacker utilized an LLM to automate reconnaissance tasks. Which TWO capabilities are typically enhanced when integrating LLMs into modern offensive enumeration workflows? (Choose two)

Accepted Answer

Synthesizing unstructured banner-grabbing outputs into structured asset inventories. Integrating Large Language Models into offensive reconnaissance enhances operations by parsing unstructured network data and generating complex scripting logic on the fly. Incident responders must recognize these patterns during host artifact analysis to map out how attackers accelerated their initial target discovery phases.

Answer

Direct physical manipulation of smart-city IoT gateway switches via radio frequency

Answer

Autonomously generating custom multi-threaded port scanner binaries in compiled C

Answer

Bypassing hardware-enforced memory encryption mechanisms on remote hypervisors

Question 13

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Accepted Answer

Using pre-commit hooks to scan code for patterns.. Pre-commit hooks are local scripts that run before a commit is finalized, scanning for patterns like API keys or passwords. They allow developers to catch mistakes immediately on their local machines before sensitive data is pushed to a remote repository. This prevents the secret from ever entering the version history, which is the most effective way to maintain the security of credentials in a distributed development workflow.

Answer

Implementing a post-push webhook to scan the repository.

Answer

Enabling public repository visibility scanning.

Answer

Enforcing HTTPS for all Git operations.

Question 14

During a web application incident investigation, the SOC analyst discovers that an attacker sent a modified JSON payload containing an unexpected administrative attribute "is_admin": true during user registration, which successfully elevated the user's privileges. What vulnerability enabled this exploitation?

Accepted Answer

Mass Assignment. Mass assignment occurs when frameworks automatically bind user input parameters directly to backend data models without proper filtering. This allows attackers to inject privileged fields that were never intended to be exposed during client-side registration forms. GCIH handlers must trace data binding configurations and ensure explicit allowlisting of updatable attributes to prevent privilege escalation incidents via API request tampering.

Answer

Broken User Authentication

Answer

Server-Side Request Forgery

Answer

Cross-Site Scripting

Question 15

An incident responder investigates a Windows endpoint and discovers an unexpected service running with administrative privileges, executing a binary from an anomalous temporary directory. Reviewing the registry, the responder notices that the service binary path uses a space-separated executable path without surrounding double quotes, and the folder name contains a space. Which post-exploitation persistence and privilege escalation technique has the attacker deployed?

Accepted Answer

Unquoted service path exploitation leveraging Windows path parsing behavior.. Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

Answer

DLL search order hijacking involving system directory redirection.

Answer

Scheduled task modification using legitimate administrator task IDs.

Answer

Windows Management Instrumentation event subscription persistence.

Question 16

Which of the following describes the primary danger of an Insecure Deserialization vulnerability in a web application?

Accepted Answer

It facilitates the execution of arbitrary code via gadget chains.. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a DoS, or execute arbitrary code. By manipulating the serialized object, an attacker can modify application state, bypass authentication, or leverage existing application code (gadget chains) to gain remote code execution. This is critical because modern frameworks often automatically deserialize objects from user-provided data without sufficient verification or integrity checks on the source.

Answer

The vulnerability enables unauthorized database password decryption.

Answer

It allows attackers to inject malicious code into the database.

Answer

It causes the application to leak internal memory structures.

Question 17

Which of the following describes an 'LLM Hallucination' in the context of analyzing an unknown binary?

Accepted Answer

The model generates a convincing but false explanation of a function's purpose.. An LLM hallucination occurs when the model generates confident but factually incorrect information. When analyzing binaries, this manifests as the model identifying non-existent vulnerabilities or describing functions that do not actually exist in the provided code. This is dangerous because it can lead an analyst to waste time chasing false positives or implementing incorrect remediations based on the AI's plausible-sounding but erroneous technical assessment of the binary.

Answer

The model successfully deobfuscates the binary and identifies a buffer overflow.

Answer

The model refuses to analyze the binary due to safety policy violations.

Answer

The model correctly identifies the compiler used to build the binary.

Question 18

During an investigation, you observe an attacker using 'living-off-the-land' (LotL) techniques. Why is it difficult to detect this activity using traditional signature-based antivirus?

Accepted Answer

The tools are trusted binaries and the malicious intent is in the parameters.. Living-off-the-land attacks use legitimate, signed system binaries (like PowerShell, wmic, or certutil) to perform malicious actions. Since the tools themselves are trusted components of the operating system, antivirus software rarely flags them as malicious. Detecting LotL requires behavioral analysis, command-line logging, and monitoring for anomalous execution patterns rather than relying on file signatures, which are ineffective against tools that are inherently part of the system's baseline.

Answer

These binaries are encrypted on the disk, preventing antivirus from scanning them.

Answer

The tools operate entirely in volatile memory and never touch the disk.

Answer

Antivirus software is only capable of detecting malware written in assembly language.

Question 19

An incident handler is reviewing password storage mechanisms after a breach. The attacker exfiltrated a file containing password hashes. Which of the following TWO characteristics would make the hashes more resistant to offline cracking? (Choose two.)

Accepted Answer

Each hash includes a unique, random salt value.. The two characteristics that make hashes more resistant to offline cracking are the use of a slow key derivation function (like bcrypt) and the inclusion of a unique random salt per hash. A slow KDF increases the time required to compute each hash, while salting prevents the use of precomputed tables and ensures that identical passwords yield different hashes. Together, they significantly raise the cost for an attacker.

Answer

The password policy requires a minimum length of 8 characters with complexity.

Answer

The hashes are generated using SHA-256 without any salt.

Answer

The hashes are stored in a compressed archive to save space.

Question 20

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.