GCIH Practice Test 21 — 15 Questions

Question 1

An incident responder reviews a packet capture from a compromised Windows workstation and notices periodic outbound DNS queries for random-looking subdomains such as 'a8f3c9e1.badguy.example'. Each query is followed by a TXT record response containing a short Base64 string. What technique is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS tunneling for command and control. The correct answer is DNS tunneling for command and control. Random subdomains combined with TXT records carrying Base64 data indicate that the attacker is using DNS as a covert channel to send commands or exfiltrate data. Legitimate DNS traffic rarely exhibits such encoded payloads, making this a strong indicator of compromise.

Answer

Fast flux DNS

Answer

DNS cache poisoning

Answer

Domain generation algorithm (DGA) beaconing

Question 2

A junior analyst is using an AI-powered malware analysis tool to examine a suspicious executable. The tool provides a summary indicating that the file is 'likely malicious' with a confidence score of 65%. The analyst is unsure how to proceed. According to incident response best practices, what should the analyst do NEXT?

Accepted Answer

Perform additional manual analysis, such as static and dynamic examination, to confirm the tool's findings.. When an AI tool provides a low-confidence result, the analyst should validate it through manual analysis. This involves static and dynamic techniques to confirm maliciousness. Deleting files or ignoring alerts without verification can lead to errors. Escalation without initial investigation may delay response.

Answer

Escalate to a senior analyst and wait for further instructions.

Answer

Treat the file as malicious and immediately delete it from all systems.

Answer

Ignore the alert because the confidence score is below 90%.

Question 3

During a penetration test of a GraphQL API, an incident handler finds that the introspection system is enabled and can be queried without authentication. The handler retrieves the full schema, including hidden fields and mutations. What is the most significant security impact of this finding?

Accepted Answer

Attackers can map the entire API surface, identify sensitive fields and mutations, and craft targeted queries to abuse them.. Exposed GraphQL introspection lets attackers retrieve the full schema, including hidden fields and mutations. This information disclosure enables them to craft precise queries and mutations that target sensitive operations, significantly lowering the effort required for further exploitation. The other options either misstate the technical effect or focus on less likely outcomes. Therefore, schema mapping and targeted abuse is the most significant impact.

Answer

Attackers can directly execute arbitrary code on the GraphQL server through introspection queries.

Answer

Attackers can bypass authentication by sending a specially crafted introspection query that returns valid session tokens.

Answer

Attackers can cause a denial of service by sending an introspection query that recursively expands the schema indefinitely.

Question 4

An incident responder is preparing to acquire a forensic image of a compromised Windows server. The server is still running, and the responder needs to capture volatile data first. Which of the following should be collected FIRST according to the order of volatility?

Accepted Answer

Contents of physical memory (RAM).. According to the order of volatility, physical memory is the most volatile and should be captured first. It contains running processes, network connections, and potentially malicious code that exists only in RAM. Temporary files, network configuration, and event logs are less volatile and can be collected afterward. Capturing memory first ensures that critical evidence is preserved before it is lost.

Answer

Network configuration and ARP cache.

Answer

Windows Event Logs.

Answer

Temporary files on the system drive.

Question 5

What is the primary function of a salt in password storage?

Accepted Answer

To prevent precomputed rainbow table attacks. A salt is a random value added to a password before hashing. Its purpose is to ensure that identical passwords produce unique hash results. This prevents attackers from using precomputed tables (rainbow tables) to reverse hashes. By forcing attackers to crack each hash individually, the salt effectively renders bulk cracking attacks against a database computationally infeasible, significantly increasing the time and resources required for a successful offline attack after an initial breach.

Answer

To increase the length of the password string

Answer

To encrypt the password in the database

Answer

To hide the algorithm type from attackers

Question 6

Refer to the exhibit. An attacker changes the 'final_price' to 0.00. What is the most likely vulnerability?

Accepted Answer

Mass Assignment. The exhibit shows a Mass Assignment vulnerability. The API accepts the client-provided 'final_price' instead of calculating it server-side. By exposing internal fields that should be read-only or calculated internally, the API allows the client to influence business logic. In this case, the attacker successfully manipulated the payment amount, demonstrating why sensitive fields must be protected from external modification during request binding processes in the API backend.

Answer

Broken Object Level Authorization

Answer

Command Injection

Answer

Cross-Site Scripting

Question 7

What is the primary indicator of a 'Skeleton Key' attack in an Active Directory environment?

Accepted Answer

Successful authentication using a custom password for multiple users.. A Skeleton Key attack injects a patch into the LSASS process on a domain controller, allowing the attacker to authenticate as any user using a single, 'master' password. This is a devastating post-exploitation technique because it grants the attacker domain-wide access without needing to crack individual user hashes. Detecting this requires monitoring for memory anomalies in LSASS on DCs and auditing for suspicious modifications to critical system processes.

Answer

All user passwords in the domain are suddenly reset.

Answer

The domain controller crashes during authentication.

Answer

Increased replication traffic between domain controllers.

Question 8

An attacker has compromised a Windows host and established a reverse shell using a malicious DLL loaded by a legitimate signed executable via DLL search order hijacking. The incident responder wants to identify the specific DLL that was hijacked and the process that loaded it. Which of the following data sources would provide the MOST direct evidence of the DLL load event and the loading process?

Accepted Answer

Sysmon Event ID 7 (Image loaded). Sysmon Event ID 7 specifically captures module load events, including the loading process image and the loaded DLL path, along with hashes. This makes it the most direct source to identify the hijacked DLL and the process that loaded it. Other sources either lack DLL load detail or are not guaranteed to log the event.

Answer

Windows Security event ID 4688 with command line auditing

Answer

Windows Defender Application Control (WDAC) event logs

Answer

Sysmon Event ID 1 (Process creation)

Question 9

When analyzing a JSON Web Token (JWT) for potential security weaknesses in an API, which scenario indicates a 'None' algorithm attack is possible?

Accepted Answer

The header contains 'alg': 'none'. A 'None' algorithm attack occurs when the JWT header specifies 'alg': 'none'. If the API backend fails to strictly validate the algorithm field and accepts this header, it treats the token as unsigned. An attacker can then modify the payload (e.g., changing 'user_id' to 'admin') and submit the token without a valid cryptographic signature, effectively bypassing authentication controls because the backend skips signature verification for 'none' algorithms.

Answer

The token expires in less than 60 seconds

Answer

The token uses RS256 instead of HS256

Answer

The secret key is stored in an environment variable

Question 10

Refer to the exhibit. Why might an investigator use the output of 'vssadmin' during a cyber investigation?

Accepted Answer

To recover previous versions of system files and registry hives for analysis.. Volume Shadow Copies are an essential artifact in Windows forensics. They allow an investigator to access older versions of files, including logs, registry hives, and malware binaries that the attacker might have modified or deleted to cover their tracks. By mounting these shadows, an investigator can perform 'time-travel' analysis, recovering evidence that is otherwise invisible on the live file system.

Answer

To identify hidden partitions created by rootkits for persistence.

Answer

To check for unauthorized changes to the system's BIOS/UEFI firmware.

Answer

To list all currently active network sockets on the host.

Question 11

During a web application penetration test, you notice that a request to `/download?doc=8841` returns a PDF belonging to a different department. You change the value to `8842` and receive another department's document. The session cookie remains unchanged for both requests. Which conclusion best fits these observations?

Accepted Answer

The endpoint lacks object-level authorization, allowing any authenticated user to retrieve documents by changing the direct reference.. Changing a numeric parameter returned a document belonging to another department under the same authenticated session. That demonstrates the server resolves the requested object and returns it without verifying the caller's entitlement. The remedy is object-level authorization: resolve the document, confirm the session principal may access it, and deny the request when that relationship is absent.

Answer

The numeric document identifiers are sequential and therefore guessable, which is the root cause of the cross-department access.

Answer

The session cookie is not bound to the document owner, so the application must regenerate it on every download to prevent cross-department access.

Answer

The download endpoint is missing a CSRF token, allowing an attacker to force the victim's browser to fetch arbitrary documents.

Question 12

An incident handler needs to quickly identify all live hosts on a large corporate network without performing port scans. Which Nmap command should be used?

Accepted Answer

nmap -sn 10.0.0.0/16. To quickly identify live hosts without port scanning, the -sn option is used. It performs host discovery using a combination of ICMP, TCP, and UDP probes, but does not scan ports. This is the standard Nmap command for ping sweeps, making it the correct answer for this scenario.

Answer

nmap -sU 10.0.0.0/16

Answer

nmap -sV 10.0.0.0/16

Answer

nmap -sS 10.0.0.0/16

Question 13

During an authorized red team engagement, an operator uses an LLM to generate a spear-phishing pretext that references internal project codenames discovered during reconnaissance. Before the emails are sent, the engagement manager asks how to verify the model did not invent any of the referenced codenames. Which method provides the strongest verification?

Accepted Answer

Cross-reference every codename in the generated pretext against the reconnaissance dataset and remove any that cannot be matched.. The only reliable way to confirm that referenced codenames exist is to compare them against the reconnaissance data actually collected during the engagement. This makes verification a deterministic matching problem rather than a judgment call by any model. Regeneration consistency, self-reported confidence, and second-model confirmation all rely on the models' internal patterns and cannot establish that a codename genuinely appeared in the collected intelligence.

Answer

Ask the model to regenerate the pretext several times and keep only codenames that appear in every version.

Answer

Prompt the model to state its confidence for each codename and accept any value above eighty percent.

Answer

Run the pretext through a second LLM and use it only if the second model confirms the codenames exist.

Question 14

You are leading an incident response effort against a sophisticated adversary who uses AI-generated polymorphic malware that changes its code signature on each execution. Your team employs AI-assisted tools for detection and analysis. Which TWO of the following techniques are MOST effective for identifying and tracking this malware across multiple hosts? (Choose two.)

Accepted Answer

Monitor for anomalous process behavior, such as unexpected parent-child relationships or network connections.. Behavioral monitoring and YARA rules based on persistent code patterns are effective because they do not rely on static signatures. Behavioral analysis detects malicious actions regardless of code changes, while YARA rules can target invariant parts of the malware. Hash-based IOCs, reputation scores, and traditional antivirus are easily evaded by polymorphic malware.

Answer

Perform regular full-disk antivirus scans on all endpoints to detect known signatures.

Answer

Use file hash-based indicators of compromise (IOCs) to search for the malware across the enterprise.

Answer

Rely on the AI-assisted EDR's automatic quarantine of files with low reputation scores.

Question 15

An incident responder is reviewing an IDS alert and needs to determine whether a suspicious executable that ran on a Windows workstation has been seen in other attacks. Which framework should the responder consult to map the observed adversary behavior to known tactics, techniques, and procedures?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is designed specifically to catalog adversary tactics, techniques, and procedures from real-world observations. Mapping the suspicious executable to ATT&CK techniques allows the responder to understand what the binary is doing in terms of known behaviors and which threat actors employ those methods. This supports faster triage, prioritization, and detection engineering.

Answer

NIST SP 800-61

Answer

The Diamond Model of Intrusion Analysis

Answer

The Cyber Kill Chain