GCIH Practice Test 22 — 15 Questions

Question 1

A security analyst is reviewing an incident where an attacker submitted a specially crafted XML document to a SOAP API endpoint. The XML included a DOCTYPE declaration with an ENTITY that referenced file:///etc/passwd. The server's response contained the contents of that file. Which vulnerability was exploited?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XML External Entity (XXE) injection. The attacker exploited an XML parser that resolved external entities, using a file:// URI to read /etc/passwd. This is XML External Entity injection. The SOAP endpoint failed to disable DOCTYPE processing or external entity resolution, allowing the server to disclose local files. The other options describe different attack classes that do not match the XML entity mechanism.

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 2

A SOC analyst receives a report that a workstation is beaconing to an unknown external IP every 60 seconds. The analyst runs netstat -anob and identifies the process responsible. The process is svchost.exe, but the parent process is not services.exe. Which of the following should the analyst do FIRST to determine if this is a malicious injection?

Accepted Answer

Capture a memory dump of the svchost.exe process and examine its loaded modules.. The correct first step is to capture a memory dump of the suspicious svchost.exe process. This preserves volatile evidence like injected code and network connections, allowing the analyst to confirm malicious activity before taking disruptive actions. Terminating the process or running an AV scan may destroy evidence or miss fileless malware, while event logs alone may not show the injection.

Answer

Terminate the svchost.exe process immediately to stop the beaconing.

Answer

Run a full antivirus scan on the workstation to detect and remove the malware.

Answer

Check the Windows Event Log for service creation events around the same time.

Question 3

Which of the following is the most significant security risk associated with the use of 'API Keys' for authentication in modern cloud-native environments?

Accepted Answer

They are static secrets prone to leakage. API keys are often static and long-lived, making them highly susceptible to theft through code repository leaks, log exposure, or interception. Once stolen, they are difficult to rotate and often grant broad access. Unlike short-lived tokens like OAuth access tokens, static keys lack expiration, context, and granular scope, creating a significant security burden for organizations that fail to implement strict rotation and revocation procedures for their distributed keys.

Answer

They are easily cracked using brute-force tools

Answer

They cannot be used over HTTPS connections

Answer

They are incompatible with RESTful architecture

Question 4

An incident handler is examining a web application that stores user profiles in a MySQL database. A recent breach exposed data through a query that the application builds as: SELECT * FROM profiles WHERE username = '" + userInput + "'. The handler wants to recommend a code-level fix that eliminates this class of vulnerability. Which approach should be recommended?

Accepted Answer

Use prepared statements with parameterized queries for all database interactions.. The application concatenates user input directly into SQL, creating an injection flaw. Prepared statements with parameterized queries ensure that input is treated strictly as data, never as SQL syntax, which eliminates the vulnerability class. WAF rules, quote escaping, and error suppression are compensating or hardening measures but do not remove the root cause.

Answer

Implement a web application firewall (WAF) rule that blocks common SQL injection patterns.

Answer

Limit database error messages returned to the user to prevent information leakage.

Answer

Escape single quotes and double quotes in user input before concatenation.

Question 5

Which TWO methods are effective for mitigating Mass Assignment vulnerabilities in RESTful APIs?

Accepted Answer

Implement strict input allow-lists for model binding. Mass Assignment occurs when an API endpoint automatically binds client-provided input to internal data models or database fields without explicit filtering. By using Data Transfer Objects (DTOs) or explicit allow-lists, developers ensure only intended fields are updated. This prevents attackers from overwriting sensitive fields like 'is_admin' or 'account_balance' that should not be exposed to user modification during standard API update operations.

Answer

Always sanitize input for SQL injection patterns

Answer

Increase the complexity of the API authentication token

Answer

Disable all write operations on public API endpoints

Question 6

An incident handler is reviewing WAF logs and notices repeated HTTP requests to a web application where the 'Host' header contains an attacker-controlled domain, while the request line targets the legitimate application server. The application uses the Host header to construct password-reset links emailed to users. Which web application injection attack class BEST describes this activity?

Accepted Answer

HTTP Host header injection leading to password reset poisoning. The attacker exploits the application's trust in the Host header to generate password-reset links. By setting the Host header to an attacker-controlled domain, the reset email contains a link pointing to that domain, allowing token theft. This is a classic Host header injection attack, distinct from CSRF, SSRF, and response splitting.

Answer

HTTP response splitting through CRLF injection in the Host header

Answer

Cross-Site Request Forgery (CSRF) against the password reset endpoint

Answer

Server-Side Request Forgery (SSRF) via the password reset functionality

Question 7

A penetration tester is attempting to crack NTLM hashes captured from a Windows environment. The hashes were obtained from a memory dump of a workstation. The tester decides to use Hashcat with the mode 1000. Which of the following best describes the type of hashes being cracked and the primary reason this mode is chosen?

Accepted Answer

NTLM hashes, because mode 1000 is optimized for fast brute-force attacks against unsalted MD4-based hashes.. Hashcat mode 1000 is designated for NTLM hashes, which are MD4-based and unsalted. This makes them vulnerable to rapid brute-force and dictionary attacks. The other options misidentify the hash types and their corresponding Hashcat modes. Therefore, the correct answer is the one that correctly pairs NTLM with mode 1000 and explains the speed advantage.

Answer

Kerberos 5 TGS-REP hashes, because mode 1000 extracts service account credentials from ticket-granting tickets.

Answer

NetNTLMv2 hashes, because mode 1000 captures challenge-response pairs for network authentication.

Answer

LM hashes, because mode 1000 is designed to crack the older LAN Manager hash format.

Question 8

A GCIH incident handler is reviewing web server logs after a suspected API reconnaissance campaign. The logs show numerous requests to endpoints such as /api/v1/users, /api/v2/users, /api/v3/users, and /api/internal/users, all returning HTTP 404 except one. Which attack technique is most consistent with this pattern?

Accepted Answer

API version enumeration. The pattern of requests to multiple API version prefixes and internal-looking paths, with only one returning a non-404 response, indicates deliberate version and endpoint enumeration. Attackers use this to map the API surface and find versions that may be deprecated, unpatched, or less protected, which then become targets for further exploitation.

Answer

Cross-site scripting (XSS) in API responses

Answer

Server-side request forgery (SSRF) via API parameters

Answer

JWT algorithm confusion attack

Question 9

An incident responder is investigating a modern web application and notices that users can modify object identifiers in REST API endpoints to access sensitive records belonging to other tenants. Which primary vulnerability category does this represent?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization occurs when an application fails to properly verify user permissions before granting access to objects based on the provided identifier. Attackers manipulate the ID parameter to view or modify unauthorized data, making this a critical Web App API security flaw requiring strict role-based checks.

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Answer

Mass Assignment Vulnerability

Question 10

Which security measure is most effective against API-based Denial of Service (DoS) attacks targeted at resource-intensive endpoints?

Accepted Answer

Implementing robust rate limiting. Rate limiting is the standard defense against resource exhaustion in APIs. By enforcing limits on the number of requests a client can make within a specific timeframe, the API prevents a single user or bot from monopolizing backend CPU, memory, or database connections. This ensures that the service remains available to other legitimate users, mitigating the risk of intentional or accidental system degradation caused by heavy API consumption patterns.

Answer

Enforcing HTTPS for all traffic

Answer

Using JWTs for authentication

Answer

Disabling CORS headers

Question 11

Which Nmap scan type should be used when the goal is to map the topology of a network and identify active hosts without establishing any TCP or UDP connections?

Accepted Answer

ICMP Echo Request (-sn). ICMP-based discovery, such as a ping sweep, identifies hosts by simply checking for responses to 'echo requests'. Because this avoids the transport layer (TCP/UDP) entirely, it is a low-impact and highly efficient way to map network topology. This is vital when the responder must map a large environment quickly without generating connection-based logs on the target systems or intermediary security devices.

Answer

TCP SYN scan (-sS)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 12

During an incident response engagement at a financial firm, you are reviewing authentication logs on a Windows Server 2019 domain controller. You notice a series of failed logon attempts with Event ID 4625, all originating from a single source IP, using a list of 500 common usernames but only one password attempt per username. The attempts occur over a period of 30 minutes. Which type of password attack is most likely being executed?

Accepted Answer

Password spraying. The pattern of many usernames with a single password attempt each is characteristic of password spraying. This technique avoids lockout by keeping failed attempts per account low while testing a common password across many accounts. Credential stuffing uses breached pairs, brute-force targets one account, and rainbow tables are offline. Thus, password spraying is the correct identification.

Answer

Brute-force attack

Answer

Credential stuffing

Answer

Rainbow table attack

Question 13

A threat hunter is reviewing Sysmon logs from a Windows workstation that is suspected of being compromised. The hunter sees a process named 'svchost.exe' with a parent process of 'services.exe', but its image path is 'C:\Users\Public\svchost.exe' and it has an active network connection to an external IP address on port 443. Which two indicators should the hunter flag as highly suspicious in this scenario? (Choose two.)

Accepted Answer

The process has an active network connection on port 443.. The two suspicious indicators are the non-standard image path and the external network connection. Legitimate svchost.exe runs from System32, so an instance in C:\Users\Public indicates masquerading. The external connection on port 443 suggests command-and-control or data exfiltration. Together, they strongly point to a compromised host, while the parent process and process name are normal.

Answer

The process name is svchost.exe.

Answer

The process is running under the SYSTEM account.

Answer

The parent process is services.exe.

Question 14

An incident responder is investigating a suspected credential dumping incident on a Windows Server 2019 host. The attacker is believed to have used a tool that reads the Local Security Authority Subsystem Service (LSASS) process memory. Which two indicators, when observed together, most strongly suggest that LSASS memory was accessed for credential theft? (Choose two.)

Accepted Answer

Event ID 4656 with handle access rights including 0x1010 or 0x1410 requested against the lsass.exe process object. The two strongest indicators of LSASS memory access for credential theft are Event ID 4656 showing handle access rights of 0x1010 or 0x1410 against lsass.exe, and Event ID 4688 showing process creation with command-line arguments referencing lsass and dump operations. Together they confirm both the access request and the tool used, providing high-fidelity evidence of credential dumping.

Answer

Event ID 1102 indicating the security audit log was cleared

Answer

Event ID 5145 showing access to the \*\IPC$ share from a remote IP address

Answer

Event ID 4624 logon type 3 from the local host to itself using a machine account

Question 15

An incident responder is analyzing a compromised Linux server and discovers that the attacker has added a new user account with a password hash in /etc/shadow. The responder notes that the hash begins with '$6$'. Which of the following best describes the hashing algorithm used for this password?

Accepted Answer

SHA-512 crypt. In /etc/shadow, the '$6$' prefix identifies SHA-512 crypt as the hashing algorithm. This is a strong, salted, and iterated algorithm commonly used on modern Linux systems. The other prefixes correspond to different algorithms: '$1$' for MD5, '$5$' for SHA-256, and '$2a$' for bcrypt. Correctly identifying the algorithm helps assess password cracking difficulty.

Answer

bcrypt

Answer

MD5 crypt

Answer

SHA-256 crypt