GCIH Practice Test 3 — 25 Questions

Question 1

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics

Question 2

During a forensic analysis of a compromised developer workstation, an incident handler discovers scripts showing an attacker utilized an LLM to automate reconnaissance tasks. Which TWO capabilities are typically enhanced when integrating LLMs into modern offensive enumeration workflows? (Choose two)

Accepted Answer

Synthesizing unstructured banner-grabbing outputs into structured asset inventories. Integrating Large Language Models into offensive reconnaissance enhances operations by parsing unstructured network data and generating complex scripting logic on the fly. Incident responders must recognize these patterns during host artifact analysis to map out how attackers accelerated their initial target discovery phases.

Answer

Direct physical manipulation of smart-city IoT gateway switches via radio frequency

Answer

Autonomously generating custom multi-threaded port scanner binaries in compiled C

Answer

Bypassing hardware-enforced memory encryption mechanisms on remote hypervisors

Question 3

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Accepted Answer

Using pre-commit hooks to scan code for patterns.. Pre-commit hooks are local scripts that run before a commit is finalized, scanning for patterns like API keys or passwords. They allow developers to catch mistakes immediately on their local machines before sensitive data is pushed to a remote repository. This prevents the secret from ever entering the version history, which is the most effective way to maintain the security of credentials in a distributed development workflow.

Answer

Implementing a post-push webhook to scan the repository.

Answer

Enabling public repository visibility scanning.

Answer

Enforcing HTTPS for all Git operations.

Question 4

During a web application incident investigation, the SOC analyst discovers that an attacker sent a modified JSON payload containing an unexpected administrative attribute "is_admin": true during user registration, which successfully elevated the user's privileges. What vulnerability enabled this exploitation?

Accepted Answer

Mass Assignment. Mass assignment occurs when frameworks automatically bind user input parameters directly to backend data models without proper filtering. This allows attackers to inject privileged fields that were never intended to be exposed during client-side registration forms. GCIH handlers must trace data binding configurations and ensure explicit allowlisting of updatable attributes to prevent privilege escalation incidents via API request tampering.

Answer

Broken User Authentication

Answer

Server-Side Request Forgery

Answer

Cross-Site Scripting

Question 5

An incident responder investigates a Windows endpoint and discovers an unexpected service running with administrative privileges, executing a binary from an anomalous temporary directory. Reviewing the registry, the responder notices that the service binary path uses a space-separated executable path without surrounding double quotes, and the folder name contains a space. Which post-exploitation persistence and privilege escalation technique has the attacker deployed?

Accepted Answer

Unquoted service path exploitation leveraging Windows path parsing behavior.. Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

Answer

DLL search order hijacking involving system directory redirection.

Answer

Scheduled task modification using legitimate administrator task IDs.

Answer

Windows Management Instrumentation event subscription persistence.

Question 6

Which of the following describes the primary danger of an Insecure Deserialization vulnerability in a web application?

Accepted Answer

It facilitates the execution of arbitrary code via gadget chains.. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a DoS, or execute arbitrary code. By manipulating the serialized object, an attacker can modify application state, bypass authentication, or leverage existing application code (gadget chains) to gain remote code execution. This is critical because modern frameworks often automatically deserialize objects from user-provided data without sufficient verification or integrity checks on the source.

Answer

The vulnerability enables unauthorized database password decryption.

Answer

It allows attackers to inject malicious code into the database.

Answer

It causes the application to leak internal memory structures.

Question 7

Which of the following describes an 'LLM Hallucination' in the context of analyzing an unknown binary?

Accepted Answer

The model generates a convincing but false explanation of a function's purpose.. An LLM hallucination occurs when the model generates confident but factually incorrect information. When analyzing binaries, this manifests as the model identifying non-existent vulnerabilities or describing functions that do not actually exist in the provided code. This is dangerous because it can lead an analyst to waste time chasing false positives or implementing incorrect remediations based on the AI's plausible-sounding but erroneous technical assessment of the binary.

Answer

The model successfully deobfuscates the binary and identifies a buffer overflow.

Answer

The model refuses to analyze the binary due to safety policy violations.

Answer

The model correctly identifies the compiler used to build the binary.

Question 8

During an investigation, you observe an attacker using 'living-off-the-land' (LotL) techniques. Why is it difficult to detect this activity using traditional signature-based antivirus?

Accepted Answer

The tools are trusted binaries and the malicious intent is in the parameters.. Living-off-the-land attacks use legitimate, signed system binaries (like PowerShell, wmic, or certutil) to perform malicious actions. Since the tools themselves are trusted components of the operating system, antivirus software rarely flags them as malicious. Detecting LotL requires behavioral analysis, command-line logging, and monitoring for anomalous execution patterns rather than relying on file signatures, which are ineffective against tools that are inherently part of the system's baseline.

Answer

These binaries are encrypted on the disk, preventing antivirus from scanning them.

Answer

The tools operate entirely in volatile memory and never touch the disk.

Answer

Antivirus software is only capable of detecting malware written in assembly language.

Question 9

An incident handler is reviewing password storage mechanisms after a breach. The attacker exfiltrated a file containing password hashes. Which of the following TWO characteristics would make the hashes more resistant to offline cracking? (Choose two.)

Accepted Answer

Each hash includes a unique, random salt value.. The two characteristics that make hashes more resistant to offline cracking are the use of a slow key derivation function (like bcrypt) and the inclusion of a unique random salt per hash. A slow KDF increases the time required to compute each hash, while salting prevents the use of precomputed tables and ensures that identical passwords yield different hashes. Together, they significantly raise the cost for an attacker.

Answer

The password policy requires a minimum length of 8 characters with complexity.

Answer

The hashes are generated using SHA-256 without any salt.

Answer

The hashes are stored in a compressed archive to save space.

Question 10

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.

Question 11

Which of the following is an advantage of using a Key Derivation Function (KDF) like Argon2 over a simple hash like SHA-256?

Accepted Answer

KDFs are memory-hard and resist GPU cracking. Standard cryptographic hashes like SHA-256 are designed for speed, which is a disadvantage when storing passwords because it allows attackers to test millions of guesses per second. KDFs like Argon2 are specifically designed to be slow and resource-intensive (memory-hard). By forcing the hardware to consume significant memory and time for every single hash calculation, KDFs make large-scale brute-force and dictionary attacks computationally expensive, providing much better security for sensitive credentials.

Answer

KDFs are faster and improve login performance

Answer

KDFs allow for reversible password recovery

Answer

KDFs require less storage space in the database

Question 12

An incident handler is reviewing SMB traffic and notices a large number of SMB2 CREATE requests for files with extensions like .docx, .xlsx, and .pdf, followed by SMB2 WRITE requests that overwrite the same files with encrypted content. The traffic originates from a single workstation and targets a file server. Which type of attack is most likely occurring?

Accepted Answer

Ransomware encrypting files on the file server via SMB.. The correct answer is ransomware encrypting files via SMB. The sequence of opening document files and overwriting them with encrypted data is a hallmark of ransomware. The other options do not match the observed traffic: exfiltration would read files, brute-force would show failed logons, and worm propagation would target multiple hosts.

Answer

SMB worm propagation, where the attacker is scanning for vulnerable hosts.

Answer

Data exfiltration through SMB, where files are being copied to an external location.

Answer

SMB brute-force attack, where the attacker is attempting to guess passwords.

Question 13

During an incident response engagement, you capture SMB authentication traffic on a subnet where an attacker has positioned a rogue device. The traffic shows NTLMv2 challenge/response pairs being relayed to a file server that does not enforce SMB signing. Which of the following best describes the security control that would have most directly prevented the relayed authentication from succeeding?

Accepted Answer

Enforcing SMB signing on the target file server. SMB signing is the specific control that prevents NTLM relay to SMB file servers because it requires the client and server to sign every message with a session key. A relayed authentication cannot satisfy signing because the attacker does not possess the negotiated session key. Other controls like disabling NetBIOS or requiring Kerberos do not address the fundamental relay path over SMB.

Answer

Enabling Extended Protection for Authentication on the domain controller

Answer

Disabling NetBIOS over TCP/IP on all workstations

Answer

Requiring Kerberos authentication for all domain logons

Question 14

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

Accepted Answer

Principle of Least Privilege.. The 'AdministratorAccess' policy provides full, unrestricted access to all services. Assigning this to daily tasks violates the Principle of Least Privilege, which dictates that users should only have the minimum permissions necessary to perform their jobs. Over-privileged accounts are a significant liability, as they allow an attacker who compromises the account to perform any action, including deleting logs or resources, which massively increases the potential impact of an incident.

Answer

Separation of Duties.

Answer

Defense in Depth.

Answer

Security through Obscurity.

Question 15

A red team operator is building an LLM-assisted phishing campaign tool that generates personalized pretexts for targets. The tool queries an external LLM API with target names and job titles scraped from LinkedIn. A security architect warns that this workflow may expose sensitive engagement data and violate client scoping agreements. Which control best mitigates this risk while preserving the tool's functionality?

Accepted Answer

Deploy a locally hosted open-weight LLM within the engagement infrastructure and route all prompts to it instead of the external API.. The core risk is that target PII and engagement specifics leave the trusted environment when prompts are sent to a third-party API. A locally hosted open-weight model keeps all inference and data inside the engagement infrastructure, removing the third-party exposure entirely while still generating the required pretexts. Encoding, prompt instructions, and key rotation do not prevent the data itself from reaching the vendor, so they fail to address the actual scoping and confidentiality issue.

Answer

Rotate the API keys used for the external LLM service every 24 hours during the engagement.

Answer

Add a system prompt instructing the external LLM to forget all data after each response and never store it.

Answer

Base64-encode the target names and titles before sending them to the external API to obscure the data in transit.

Question 16

During an investigation, you observe an attacker using 'PsExec' to move laterally. What is the primary artifact created by PsExec that can be used to track its execution across the network?

Accepted Answer

The installation of a service named 'PSEXESVC'.. PsExec functions by creating a remote service named 'PSEXESVC' on the target machine. This service executes the payload and is then cleaned up. Identifying the creation and deletion of this specific service name in the Windows System event logs (Event ID 7045) is the most reliable way to track PsExec activity, provided that the logs have not been cleared by the attacker.

Answer

The creation of a temporary file named 'psexec.exe' in the root directory.

Answer

An entry in the 'Run' registry key for persistence.

Answer

A specific user-mode process named 'psexec_agent'.

Question 17

An incident responder is using an LLM to automate the parsing of obfuscated PowerShell scripts found during a breach. What is the primary operational risk when feeding these scripts into a cloud-based LLM API?

Accepted Answer

The input data may be retained and used for future model training, potentially leaking incident indicators.. Sharing obfuscated code with cloud-based LLMs risks leaking proprietary infrastructure details or sensitive credentials embedded within scripts into the vendor's training corpus. This data exposure violates confidentiality policies and undermines incident containment efforts. Security professionals must utilize local models or sanitized code snippets to prevent inadvertent data exfiltration while leveraging AI-assisted analysis for complex malware triage during active incident response workflows.

Answer

The LLM will automatically execute the PowerShell commands in the cloud environment.

Answer

The LLM will refuse to analyze the script because it contains malicious syntax.

Answer

The LLM will inject backdoors into the code during the deobfuscation process.

Question 18

An analyst discovers that an attacker is using AI to dynamically change the command-and-control (C2) infrastructure based on defensive responses. Which IR strategy is best suited to disrupt this behavior?

Accepted Answer

Implement proactive deception techniques to feed the attacker's AI false data.. The most effective way to counter dynamic, AI-driven infrastructure is to implement 'proactive deception' and 'automated environment hardening.' By creating a moving target environment, the responder forces the attacker's AI to constantly adjust to false or unstable indicators. This disrupts the adversary's ability to maintain a persistent connection, effectively neutralizing the advantage gained by their automated infrastructure adjustments during the incident containment phase.

Answer

Maintain the current defense and wait for the C2 to remain static.

Answer

Block all outbound traffic at the perimeter to stop the communication.

Answer

Perform a full system wipe of all endpoints involved in the C2 network.

Question 19

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

Accepted Answer

Implement IAM roles that grant temporary security credentials via STS.. Utilizing IAM roles with temporary security credentials is the best practice for cloud security. By assuming roles, you eliminate the risks associated with static access keys, which are frequently leaked or stolen. This approach aligns with the principle of least privilege, as temporary tokens expire automatically, reducing the window of opportunity for an attacker to exploit compromised credentials, thereby enhancing the overall security posture of the cloud environment.

Answer

Generate unique access keys for every developer stored in an encrypted S3 bucket.

Answer

Rotate IAM user access keys every 90 days via an automated script.

Answer

Use an IAM group policy to enforce Multi-Factor Authentication on all API requests.

Question 20

An incident handler is reviewing SMB traffic and notices multiple 'Tree Connect' requests to the IPC$ share. What does this activity typically signify in an attack scenario?

Accepted Answer

An attacker is likely performing reconnaissance or lateral movement.. The IPC$ (Inter-Process Communication) share is a special share used by Windows for communication between network devices, often for administrative functions. Attackers frequently connect to IPC$ to perform null sessions or to interact with the service control manager to remotely execute code. Identifying frequent, unauthorized connections to IPC$ is a strong indicator of reconnaissance or lateral movement, as it is a common starting point for an attacker to enumerate the system.

Answer

A standard user is accessing their home directory.

Answer

The workstation is simply performing routine backups.

Answer

The SMB server is correctly enforcing message signing.