GCIH Practice Test 24 — 15 Questions

Question 1

A junior incident handler is reviewing an alert from an AI-powered email security gateway that flagged a message as a likely AI-generated phishing attempt. The gateway's model outputs a confidence score but no explanation. The handler wants to gather corroborating evidence from the message headers and body to support the classification before escalating. Which artifact would best help the handler verify that the message was generated or augmented by an AI tool?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The message body's writing style and any embedded AI watermark or metadata.. To corroborate an AI-generation classification, the handler should look at the content itself, since AI-written text often shows distinctive stylistic uniformity and may carry watermarks or metadata. Header-based artifacts like SPF, DKIM, and Received chains address origin and authentication, not authorship. Focusing on the body's style and embedded markers directly supports or refutes the gateway's model output before escalation.

Answer

The sender's display name and the reply-to address mismatch.

Answer

The SPF and DKIM authentication results in the headers.

Answer

The Received header chain showing the message's relay path.

Question 2

An incident handler is investigating a web application that uses a NoSQL database (MongoDB). The attacker sent a request with the parameter 'username[$ne]=admin&password[$ne]=wrong' and successfully authenticated as an administrator. Which of the following BEST describes the attack technique used?

Accepted Answer

NoSQL injection via operator injection in MongoDB query selectors. The attacker exploited the application's failure to sanitize user input before incorporating it into a MongoDB query. By injecting the $ne operator, the attacker changed the query to return a user record where the username and password are not equal to the supplied values, bypassing authentication. This is a classic NoSQL injection attack.

Answer

SQL injection using MongoDB's SQL compatibility layer

Answer

Cross-Site Scripting (XSS) through unsanitized input in the login form

Answer

LDAP injection exploiting the authentication backend

Question 3

You are performing a live response and encounter a suspicious process. Which action should you take FIRST to gather the most intelligence without alerting the adversary or crashing the system?

Accepted Answer

Capture volatile data, including process listings, open handles, and network connections.. In live response, the principle of 'least intrusive first' is paramount. Collecting volatile data (like process lists and network connections) should always precede disk-based forensic imaging. By capturing the state of the system first, you ensure that you obtain the memory-resident artifacts that would be lost upon a reboot or power-down, providing the best foundation for a successful analysis.

Answer

Take a forensic image of the hard drive using a hardware write-blocker.

Answer

Power down the system immediately to preserve the current state.

Answer

Run an antivirus scan to identify and delete the malicious process.

Question 4

An incident responder is analyzing a potential compromise of an AWS environment. The attacker gained access to an EC2 instance and then used the instance's IAM role to call the AWS Security Token Service (STS) AssumeRole API to obtain credentials for a role in another account. The attacker then used those credentials to access sensitive data. Which AWS service or feature would provide the most detailed log of the AssumeRole API call, including the identity of the caller and the target role?

Accepted Answer

AWS CloudTrail management events. CloudTrail management events capture all API calls, including STS AssumeRole, with details such as the caller's identity, the target role, the session name, and the source IP. This makes it the most detailed log for tracing cross-account role assumption. VPC Flow Logs, AWS Config, and GuardDuty findings either lack API-level detail or are not designed for forensic auditing of individual API calls.

Answer

AWS Config configuration history

Answer

Amazon VPC Flow Logs

Answer

Amazon GuardDuty findings

Question 5

Which tool is best suited for identifying potentially misconfigured SMB services that could be leveraged for lateral movement within a compromised Windows environment?

Accepted Answer

Nmap with NSE scripts. Nmap's scripting engine (NSE) provides dedicated scripts like 'smb-vuln*' that can scan for specific vulnerabilities such as MS17-010. By integrating these scripts directly into the scanning workflow, responders can quickly map the attack surface and identify high-value targets for lateral movement without switching tools, ensuring a cohesive and efficient assessment of the environment's configuration security.

Answer

Wireshark

Answer

Netcat

Answer

Tcpdump

Question 6

Which of the following is a sign of 'Domain Fronting' in network traffic logs?

Accepted Answer

A mismatch between the SNI and the internal HTTP Host header.. Domain fronting uses high-reputation domains (like CDNs) to hide the true destination of malicious traffic. The initial request looks like it is going to a trusted domain, but the HTTP Host header inside the encrypted tunnel points to the attacker's server. Detecting this requires deep packet inspection or analysis of SSL/TLS metadata, which is critical for identifying covert C2 channels that masquerade as legitimate web traffic.

Answer

Large volumes of traffic to a single domain over port 443.

Answer

Unusually slow download speeds for legitimate files.

Answer

Repeated failed authentication attempts to the CDN.

Question 7

An AI-assisted investigation tool summarizes a week of EDR telemetry and reports that a workstation 'likely performed credential dumping.' The summary cites no specific process, command line, or timestamp. What should the incident handler do first?

Accepted Answer

Query the underlying EDR data for LSASS access events and suspicious process lineage to validate the AI claim.. AI-generated summaries are inferences that must be validated against source telemetry before action. The handler should query EDR for LSASS access, known credential dumping tool indicators, and suspicious process ancestry to confirm or refute the claim. This produces concrete evidence for escalation and avoids both unnecessary containment and missed detection. Validation is the foundational step in any AI-assisted investigation.

Answer

Escalate to management and legal teams because credential dumping implies a reportable breach.

Answer

Retrain or tune the AI model because its summary lacks supporting detail.

Answer

Isolate the workstation immediately to prevent lateral movement.

Question 8

An incident handler is investigating a suspected compromised Windows workstation. They review Windows Security event logs and notice a large number of Event ID 4625 (An account failed to log on) followed by a single Event ID 4624 (An account was successfully logged on) from the same source IP within a short period. Which of the following best describes the activity?

Accepted Answer

A successful brute-force attack against a user account.. The correct answer is a successful brute-force attack. The pattern of many failed logon attempts (Event ID 4625) followed by a successful logon (Event ID 4624) from the same source IP in a short period is indicative of a brute-force attack. The attacker systematically tried passwords until one worked. This is a common initial access technique, and incident handlers should investigate the source IP and check for further compromise.

Answer

A user mistyped their password several times before logging in successfully.

Answer

A password-spraying attack targeting multiple accounts.

Answer

An account lockout policy being triggered and then reset.

Question 9

Which THREE actions are recommended to secure APIs against Server-Side Request Forgery (SSRF)?

Accepted Answer

Implement a strict allow-list for URLs. SSRF occurs when an API is tricked into making requests to internal or unauthorized external resources. To prevent this, developers must use strict allow-lists for destination domains, disable unused URL schemes (like file://), and enforce network-level segmentation that restricts the API server's ability to reach internal management interfaces or metadata services. These layers of defense ensure that even if an input parameter is compromised, the server remains isolated from critical internal assets.

Answer

Use a public proxy for all outgoing requests

Answer

Store all API secrets in the URL parameters

Question 10

A security analyst is reviewing a web application that uses a parameter `doc_id` to retrieve documents from a database. The application does not validate that the requested document belongs to the authenticated user. During an incident response, the analyst observes multiple requests with sequential `doc_id` values from a single IP address. Which TWO of the following actions should the analyst take to confirm and mitigate the IDOR vulnerability? (Choose two.)

Accepted Answer

Replay the requests with a different user session to verify if unauthorized access is possible.. To confirm IDOR, the analyst should test with a different user session to see if unauthorized access occurs. To mitigate, the application must enforce server-side authorization checks that verify the authenticated user owns the requested document. These two actions address both validation and remediation. Obfuscation, error messages, and rate-limiting do not fix the root cause.

Answer

Rate-limit requests from the suspicious IP address to stop the enumeration.

Answer

Obfuscate the `doc_id` parameter by base64-encoding it to prevent enumeration.

Answer

Enable detailed error messages to help developers debug the issue.

Question 11

An incident handler is reviewing SMB traffic logs from a small business network and notices that a client successfully authenticated to the IPC$ share on a file server using a null session. The handler wants to explain to management why this is a security concern. Which of the following best describes the risk of a successful null session to IPC$?

Accepted Answer

It permits unauthenticated enumeration of users, groups, shares, and other system information.. A null session to IPC$ is an unauthenticated connection that allows limited queries through named pipes and RPC. Attackers use it to enumerate users, groups, shares, and domain information without credentials. This reconnaissance does not grant file access or code execution, but it exposes details that make later attacks easier. Restricting anonymous access and disabling null sessions reduces this information disclosure.

Answer

It causes the server to disable SMB signing for all subsequent authenticated sessions.

Answer

It enables the client to execute arbitrary code on the server with SYSTEM privileges.

Answer

It allows the client to read and write files in all shared folders on the server.

Question 12

Why does the use of pepper provide additional security for password hashes, and where should it ideally be stored?

Accepted Answer

Stored in a separate environment variable; adds an extra layer. A pepper is a secret value added to the password hashing process that is stored separately from the hash, typically in a secure configuration file, environment variable, or Hardware Security Module (HSM). Because the pepper is not stored in the database, an attacker who steals only the database cannot brute-force the hashes, as they lack the pepper. This creates a dual-layer dependency that significantly raises the bar for successful offline cracking attempts.

Answer

Stored in the same database table; prevents rainbow tables

Answer

Stored in the application code; ensures performance

Answer

Stored in the user session; ensures unique hashes

Question 13

Which of the following is a primary benefit of using a centralized log management (CLM) solution during an incident?

Accepted Answer

It provides a unified view for log correlation.. Centralized log management aggregates logs from disparate sources, providing a single point of visibility. This is crucial for correlation, as it allows analysts to link events across different systems—such as matching a firewall block with a specific endpoint execution. Without CLM, responders must manually query every host, which is slow, error-prone, and often impossible if an attacker deletes local logs to cover their tracks.

Answer

It automatically blocks all malicious traffic.

Answer

It encrypts all data on the network.

Answer

It prevents unauthorized local access.

Question 14

Which Nmap flag is essential when you need to perform OS fingerprinting to determine the target operating system version during an incident response assessment?

Accepted Answer

-O. The -O flag instructs Nmap to perform TCP/IP stack fingerprinting, which analyzes specific behaviors of the target's networking stack. This is vital for responders to classify assets, identify potential legacy systems, and determine if the target matches known vulnerable OS versions during the scoping phase of an incident investigation or routine security audit.

Answer

-sV

Answer

-A

Answer

-sS

Question 15

Which TWO of the following techniques are most effective for preventing Cross-Site Scripting (XSS) in a web application?

Accepted Answer

Using contextual output encoding.. Preventing XSS requires a multi-layered defense strategy focused on output handling. Encoding converts potentially dangerous characters into safe representations, preventing the browser from executing them as script code. Content Security Policy provides a powerful browser-side mechanism to restrict script execution sources. These two methods combined address both the immediate rendering risk and the long-term architectural risk of malicious scripts being injected into the DOM or executed from unauthorized domains.

Answer

Enforcing HTTPS for all application traffic.

Answer

Disabling JavaScript in the web browser.

Answer

Using basic regex to filter out script tags.