GCIH Practice Exam 4 — 20 Questions

Question 1

Which of the following is an advantage of using a Key Derivation Function (KDF) like Argon2 over a simple hash like SHA-256?

Accepted Answer

KDFs are memory-hard and resist GPU cracking. Standard cryptographic hashes like SHA-256 are designed for speed, which is a disadvantage when storing passwords because it allows attackers to test millions of guesses per second. KDFs like Argon2 are specifically designed to be slow and resource-intensive (memory-hard). By forcing the hardware to consume significant memory and time for every single hash calculation, KDFs make large-scale brute-force and dictionary attacks computationally expensive, providing much better security for sensitive credentials.

Answer

KDFs are faster and improve login performance

Answer

KDFs allow for reversible password recovery

Answer

KDFs require less storage space in the database

Question 2

An incident handler is reviewing SMB traffic and notices a large number of SMB2 CREATE requests for files with extensions like .docx, .xlsx, and .pdf, followed by SMB2 WRITE requests that overwrite the same files with encrypted content. The traffic originates from a single workstation and targets a file server. Which type of attack is most likely occurring?

Accepted Answer

Ransomware encrypting files on the file server via SMB.. The correct answer is ransomware encrypting files via SMB. The sequence of opening document files and overwriting them with encrypted data is a hallmark of ransomware. The other options do not match the observed traffic: exfiltration would read files, brute-force would show failed logons, and worm propagation would target multiple hosts.

Answer

SMB worm propagation, where the attacker is scanning for vulnerable hosts.

Answer

Data exfiltration through SMB, where files are being copied to an external location.

Answer

SMB brute-force attack, where the attacker is attempting to guess passwords.

Question 3

During an incident response engagement, you capture SMB authentication traffic on a subnet where an attacker has positioned a rogue device. The traffic shows NTLMv2 challenge/response pairs being relayed to a file server that does not enforce SMB signing. Which of the following best describes the security control that would have most directly prevented the relayed authentication from succeeding?

Accepted Answer

Enforcing SMB signing on the target file server. SMB signing is the specific control that prevents NTLM relay to SMB file servers because it requires the client and server to sign every message with a session key. A relayed authentication cannot satisfy signing because the attacker does not possess the negotiated session key. Other controls like disabling NetBIOS or requiring Kerberos do not address the fundamental relay path over SMB.

Answer

Enabling Extended Protection for Authentication on the domain controller

Answer

Disabling NetBIOS over TCP/IP on all workstations

Answer

Requiring Kerberos authentication for all domain logons

Question 4

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

Accepted Answer

Principle of Least Privilege.. The 'AdministratorAccess' policy provides full, unrestricted access to all services. Assigning this to daily tasks violates the Principle of Least Privilege, which dictates that users should only have the minimum permissions necessary to perform their jobs. Over-privileged accounts are a significant liability, as they allow an attacker who compromises the account to perform any action, including deleting logs or resources, which massively increases the potential impact of an incident.

Answer

Separation of Duties.

Answer

Defense in Depth.

Answer

Security through Obscurity.

Question 5

A red team operator is building an LLM-assisted phishing campaign tool that generates personalized pretexts for targets. The tool queries an external LLM API with target names and job titles scraped from LinkedIn. A security architect warns that this workflow may expose sensitive engagement data and violate client scoping agreements. Which control best mitigates this risk while preserving the tool's functionality?

Accepted Answer

Deploy a locally hosted open-weight LLM within the engagement infrastructure and route all prompts to it instead of the external API.. The core risk is that target PII and engagement specifics leave the trusted environment when prompts are sent to a third-party API. A locally hosted open-weight model keeps all inference and data inside the engagement infrastructure, removing the third-party exposure entirely while still generating the required pretexts. Encoding, prompt instructions, and key rotation do not prevent the data itself from reaching the vendor, so they fail to address the actual scoping and confidentiality issue.

Answer

Rotate the API keys used for the external LLM service every 24 hours during the engagement.

Answer

Add a system prompt instructing the external LLM to forget all data after each response and never store it.

Answer

Base64-encode the target names and titles before sending them to the external API to obscure the data in transit.

Question 6

During an investigation, you observe an attacker using 'PsExec' to move laterally. What is the primary artifact created by PsExec that can be used to track its execution across the network?

Accepted Answer

The installation of a service named 'PSEXESVC'.. PsExec functions by creating a remote service named 'PSEXESVC' on the target machine. This service executes the payload and is then cleaned up. Identifying the creation and deletion of this specific service name in the Windows System event logs (Event ID 7045) is the most reliable way to track PsExec activity, provided that the logs have not been cleared by the attacker.

Answer

The creation of a temporary file named 'psexec.exe' in the root directory.

Answer

An entry in the 'Run' registry key for persistence.

Answer

A specific user-mode process named 'psexec_agent'.

Question 7

An incident responder is using an LLM to automate the parsing of obfuscated PowerShell scripts found during a breach. What is the primary operational risk when feeding these scripts into a cloud-based LLM API?

Accepted Answer

The input data may be retained and used for future model training, potentially leaking incident indicators.. Sharing obfuscated code with cloud-based LLMs risks leaking proprietary infrastructure details or sensitive credentials embedded within scripts into the vendor's training corpus. This data exposure violates confidentiality policies and undermines incident containment efforts. Security professionals must utilize local models or sanitized code snippets to prevent inadvertent data exfiltration while leveraging AI-assisted analysis for complex malware triage during active incident response workflows.

Answer

The LLM will automatically execute the PowerShell commands in the cloud environment.

Answer

The LLM will refuse to analyze the script because it contains malicious syntax.

Answer

The LLM will inject backdoors into the code during the deobfuscation process.

Question 8

An analyst discovers that an attacker is using AI to dynamically change the command-and-control (C2) infrastructure based on defensive responses. Which IR strategy is best suited to disrupt this behavior?

Accepted Answer

Implement proactive deception techniques to feed the attacker's AI false data.. The most effective way to counter dynamic, AI-driven infrastructure is to implement 'proactive deception' and 'automated environment hardening.' By creating a moving target environment, the responder forces the attacker's AI to constantly adjust to false or unstable indicators. This disrupts the adversary's ability to maintain a persistent connection, effectively neutralizing the advantage gained by their automated infrastructure adjustments during the incident containment phase.

Answer

Maintain the current defense and wait for the C2 to remain static.

Answer

Block all outbound traffic at the perimeter to stop the communication.

Answer

Perform a full system wipe of all endpoints involved in the C2 network.

Question 9

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

Accepted Answer

Implement IAM roles that grant temporary security credentials via STS.. Utilizing IAM roles with temporary security credentials is the best practice for cloud security. By assuming roles, you eliminate the risks associated with static access keys, which are frequently leaked or stolen. This approach aligns with the principle of least privilege, as temporary tokens expire automatically, reducing the window of opportunity for an attacker to exploit compromised credentials, thereby enhancing the overall security posture of the cloud environment.

Answer

Generate unique access keys for every developer stored in an encrypted S3 bucket.

Answer

Rotate IAM user access keys every 90 days via an automated script.

Answer

Use an IAM group policy to enforce Multi-Factor Authentication on all API requests.

Question 10

An incident handler is reviewing SMB traffic and notices multiple 'Tree Connect' requests to the IPC$ share. What does this activity typically signify in an attack scenario?

Accepted Answer

An attacker is likely performing reconnaissance or lateral movement.. The IPC$ (Inter-Process Communication) share is a special share used by Windows for communication between network devices, often for administrative functions. Attackers frequently connect to IPC$ to perform null sessions or to interact with the service control manager to remotely execute code. Identifying frequent, unauthorized connections to IPC$ is a strong indicator of reconnaissance or lateral movement, as it is a common starting point for an attacker to enumerate the system.

Answer

A standard user is accessing their home directory.

Answer

The workstation is simply performing routine backups.

Answer

The SMB server is correctly enforcing message signing.

Question 11

When performing a password audit, you identify the use of 'PBKDF2-HMAC-SHA256' for credential storage. What makes this a strong choice compared to basic salted hashes, and how does it specifically hinder offline attacks?

Accepted Answer

It stretches the password, making individual guesses slow. PBKDF2 (Password-Based Key Derivation Function 2) is a key stretching algorithm that applies a pseudorandom function repeatedly to the input password and salt. This 'stretching' makes the process intentionally slow. By increasing the iteration count, defenders force the attacker to expend significantly more CPU time for each guess, making brute-force or dictionary attacks prohibitively slow compared to standard hashing methods.

Answer

It uses hardware-specific instructions to prevent GPU cracking

Answer

It encrypts the hash so it cannot be decrypted

Answer

It requires a secret key that is stored on a HSM

Question 12

An organization detects a web-based attack and wants to perform a thorough investigation. Which THREE artifacts should the team collect to analyze the adversary's entry point and activity?

Accepted Answer

HTTP access and error logs from the web server.. Analyzing a web-based attack requires a multi-layered approach. By correlating web server logs, application-level logs, and firewall traffic, investigators can reconstruct the full attack chain from the initial exploit attempt to post-exploitation activity. This holistic view is necessary to verify the entry point, understand the impact, and ensure all malicious persistence mechanisms are identified and removed during the remediation process, preventing the attacker from regaining unauthorized access to the environment.

Answer

System event logs for all workstations in the local network.

Answer

Email gateway logs showing internal-to-external communication patterns.

Question 13

Which TWO steps are critical during the 'Preparation' phase of the incident response lifecycle to ensure effective forensic investigation during a future security breach?

Accepted Answer

Establishing a centralized logging architecture with immutable storage.. Preparation is the foundation of incident response. By establishing logging infrastructure and legal protocols in advance, an organization ensures that forensic evidence is available and admissible when an incident occurs. Failing to prepare these elements often results in fragmented logs or delayed response actions, which hinders the team's ability to reconstruct the attack timeline accurately and perform root cause analysis after the threat is contained.

Answer

Drafting an incident communication plan for notifying public regulatory bodies.

Answer

Conducting a comprehensive risk assessment of all internal business applications.

Answer

Purchasing cybersecurity insurance to cover potential ransomware payout costs.

Question 14

Refer to the exhibit. An analyst identifies these entries on a critical server. What should the analyst conclude regarding the process associated with PID 4?

Accepted Answer

The process is a legitimate Windows kernel operation for SMB file sharing.. In Windows environments, PID 4 is reserved for the System process. In the context of port 445 (SMB), this is standard behavior for the Server service and kernel-level file sharing. Recognizing legitimate OS behavior is critical to avoid false positives. If the source IPs were unknown or the connection volume was anomalous, further investigation into kernel-mode drivers or rootkits would be required, but this output represents standard file sharing functionality.

Answer

The server is likely compromised by a kernel-mode rootkit acting as a listener.

Answer

A remote adversary is using the SMB protocol to exfiltrate data from the system.

Answer

The system is currently scanning the network for vulnerabilities using SMB exploits.

Question 15

An organization is responding to an Advanced Persistent Threat (APT). During the 'Eradication' phase, why is it critical to go beyond just removing identified malware?

Accepted Answer

Because malware is often just a dropper for a secondary, more complex backdoor.. APT actors are methodical and typically establish multiple persistence mechanisms and backdoors to ensure continued access. If a responder only removes the single piece of malware they found, the attacker can easily pivot back into the network. Eradication must involve comprehensive cleaning, including resetting compromised credentials, closing open vulnerabilities, and auditing the environment to ensure no hidden persistence points remain.

Answer

Because antivirus signatures are always outdated and will miss the actual threat.

Answer

Because the attacker will likely sue the organization if any artifacts remain.

Answer

Because the cleanup process must generate new forensic evidence for police.

Question 16

Which Nmap scan flag allows a responder to bypass simple packet filters by using specific source ports, such as port 53, to appear as legitimate DNS traffic?

Accepted Answer

--source-port 53. The --source-port flag allows for the manipulation of the packet's source port, which is a common technique for bypassing firewall rules configured to permit traffic from trusted services like DNS. This is useful for responders trying to map networks where basic ingress/egress filtering is in place, as it mimics expected protocol behavior to slip through simple security controls.

Answer

--spoof-mac

Answer

-f

Answer

--data-length

Question 17

What is the primary function of SMB (Server Message Block) in a Windows network environment?

Accepted Answer

To enable file, printer, and resource sharing across a network. SMB is the primary network file sharing protocol used in Windows environments, facilitating access to files, printers, and serial ports on remote systems. It acts as a client-server communication protocol, allowing users to interact with shared resources as if they were local. Because it is so widely used for infrastructure services, its security configuration is a primary concern for protecting enterprise data and maintaining system integrity against unauthorized access.

Answer

To provide a secure method for remote desktop management

Answer

To manage directory services and user authentication

Answer

To provide encrypted terminal access to server consoles

Question 18

Which TWO of the following steps are considered effective for hardening the SMB service against modern threats?

Accepted Answer

Require SMB signing for all connections. Hardening SMB involves a combination of removing legacy protocols and enforcing strong authentication and integrity controls. Disabling SMBv1 is the most critical step to prevent known exploits, while enforcing SMB signing provides the necessary protection against man-in-the-middle and relay attacks. Together, these measures significantly reduce the risk of lateral movement and unauthorized access, creating a much more resilient file-sharing environment that aligns with current security standards for enterprise networks.

Answer

Enable Guest Auth for compatibility

Answer

Use the LanmanServer for internet access

Answer

Disable all firewall logging on port 445

Question 19

Which of the following scenarios best demonstrates why multi-factor authentication (MFA) is superior to password-only authentication?

Accepted Answer

It prevents unauthorized access despite password theft. MFA introduces a secondary requirement that is independent of the password. Even if an attacker obtains the password through phishing, credential stuffing, or a database breach, they cannot gain access without the second factor (like a physical security key or a time-based token). This breaks the single point of failure that exists with password-only systems, rendering stolen credentials useless for unauthorized account access, which is the ultimate goal of the adversary.

Answer

It makes passwords faster to type for users

Answer

It eliminates the need for complex passwords

Answer

It ensures that the password never expires

Question 20

Refer to the exhibit. If an attacker successfully injects into a page, what happens?

Accepted Answer

The browser blocks the script and logs a violation.. The CSP policy explicitly permits only scripts from the application's own origin ('self') and from the trusted CDN. Because the injected inline script does not match these sources, the browser will block its execution. This is a crucial security control because it forces the developer to rely on external files, rendering traditional inline XSS payloads useless. It effectively mitigates the risk by ensuring only scripts from trusted, verified locations can run.

Answer

The script executes successfully.

Answer

The browser executes the script only if the user is an admin.

Answer

The browser automatically strips the script tags.