GCIH Practice Test 4 — 25 Questions

Question 1

Which Nmap scan flag allows a responder to bypass simple packet filters by using specific source ports, such as port 53, to appear as legitimate DNS traffic?

Accepted Answer

--source-port 53. The --source-port flag allows for the manipulation of the packet's source port, which is a common technique for bypassing firewall rules configured to permit traffic from trusted services like DNS. This is useful for responders trying to map networks where basic ingress/egress filtering is in place, as it mimics expected protocol behavior to slip through simple security controls.

Answer

--spoof-mac

Answer

-f

Answer

--data-length

Question 2

What is the primary function of SMB (Server Message Block) in a Windows network environment?

Accepted Answer

To enable file, printer, and resource sharing across a network. SMB is the primary network file sharing protocol used in Windows environments, facilitating access to files, printers, and serial ports on remote systems. It acts as a client-server communication protocol, allowing users to interact with shared resources as if they were local. Because it is so widely used for infrastructure services, its security configuration is a primary concern for protecting enterprise data and maintaining system integrity against unauthorized access.

Answer

To provide a secure method for remote desktop management

Answer

To manage directory services and user authentication

Answer

To provide encrypted terminal access to server consoles

Question 3

Which TWO of the following steps are considered effective for hardening the SMB service against modern threats?

Accepted Answer

Require SMB signing for all connections. Hardening SMB involves a combination of removing legacy protocols and enforcing strong authentication and integrity controls. Disabling SMBv1 is the most critical step to prevent known exploits, while enforcing SMB signing provides the necessary protection against man-in-the-middle and relay attacks. Together, these measures significantly reduce the risk of lateral movement and unauthorized access, creating a much more resilient file-sharing environment that aligns with current security standards for enterprise networks.

Answer

Enable Guest Auth for compatibility

Answer

Use the LanmanServer for internet access

Answer

Disable all firewall logging on port 445

Question 4

Which of the following scenarios best demonstrates why multi-factor authentication (MFA) is superior to password-only authentication?

Accepted Answer

It prevents unauthorized access despite password theft. MFA introduces a secondary requirement that is independent of the password. Even if an attacker obtains the password through phishing, credential stuffing, or a database breach, they cannot gain access without the second factor (like a physical security key or a time-based token). This breaks the single point of failure that exists with password-only systems, rendering stolen credentials useless for unauthorized account access, which is the ultimate goal of the adversary.

Answer

It makes passwords faster to type for users

Answer

It eliminates the need for complex passwords

Answer

It ensures that the password never expires

Question 5

Refer to the exhibit. If an attacker successfully injects into a page, what happens?

Accepted Answer

The browser blocks the script and logs a violation.. The CSP policy explicitly permits only scripts from the application's own origin ('self') and from the trusted CDN. Because the injected inline script does not match these sources, the browser will block its execution. This is a crucial security control because it forces the developer to rely on external files, rendering traditional inline XSS payloads useless. It effectively mitigates the risk by ensuring only scripts from trusted, verified locations can run.

Answer

The script executes successfully.

Answer

The browser executes the script only if the user is an admin.

Answer

The browser automatically strips the script tags.

Question 6

An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?

Accepted Answer

Revoke active sessions using IAM boundary conditions and rotate or restrict the attached IAM instance profile role permissions.. Revoking existing session tokens and updating the IAM role trust and permission policies immediately restricts the attacker from leveraging active temporary security credentials. Incident handlers must remember that compromising an instance profile yields immediate access to STS tokens which persist even if the application vulnerability is patched or the instance is stopped without credential invalidation.

Answer

Terminate the compromised EC2 instance immediately to destroy any running malicious processes and volatile memory artifacts.

Answer

Attach a restrictive Network ACL to the subnet to block all inbound and outbound traffic originating from the compromised instance's private IP address.

Answer

Modify the VPC route table to remove the internet gateway route, isolating the entire virtual private cloud from external communication.

Question 7

Refer to the exhibit. An analyst observes this command output on a compromised server. What is the most likely intent of the attacker?

Accepted Answer

Preparing for ransomware deployment by removing backups.. Attackers use `vssadmin` to delete shadow copies, effectively disabling the system's ability to recover files after encryption by ransomware. Detecting this command is a high-fidelity signal of an active ransomware attack or a data destruction event. Incident responders must act immediately upon seeing this, as it indicates the adversary is cleaning up recovery options before deploying their final payload or after exfiltration is complete.

Answer

Listing available files for exfiltration.

Answer

Escalating privileges to the SYSTEM account.

Answer

Cleaning up evidence of previous tool execution.

Question 8

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 9

Which of the following best describes the risk of using 'credential stuffing' against a web application, and how does it differ from a standard dictionary attack?

Accepted Answer

Stuffing tests leaked credentials; dictionary attacks guess passwords. Credential stuffing uses previously leaked username/password pairs from one service to gain unauthorized access to another. It differs from a dictionary attack because it utilizes valid, known credentials rather than guessing passwords. This is highly effective because users often reuse passwords across multiple sites, making it a critical threat to organizations that do not enforce multifactor authentication (MFA) or monitor for logins from unusual locations.

Answer

Dictionary attacks use compromised lists; stuffing uses random passwords

Answer

Dictionary attacks are faster than credential stuffing

Answer

Stuffing targets the database; dictionary attacks target the login

Question 10

Which of the following is a reliable method to detect an adversary using 'WMI Event Subscription' for persistence?

Accepted Answer

Auditing WMI event filters and consumers for anomalies.. WMI event subscriptions allow attackers to trigger malicious code execution upon specific system events, such as system startup or a timer. Because WMI is a legitimate administrative interface, malicious subscriptions are often overlooked. Detection requires auditing WMI repositories for suspicious 'ActiveScriptEventConsumer' or 'CommandLineEventConsumer' entries, which are the primary mechanisms used to run code through the WMI system for long-term persistence.

Answer

Monitoring for new files in the Startup folder.

Answer

Blocking all PowerShell execution at the kernel level.

Answer

Scanning the Windows Registry for Run keys.

Question 11

Which of the following best explains why 'Rainbow Tables' are less effective against modern systems that implement salted hashes?

Accepted Answer

Salts negate the precomputed nature of rainbow tables. Rainbow tables are precomputed tables of hashes for all possible plaintext passwords within a specific character set. By adding a random, per-user salt before hashing, the final hash becomes dependent on both the password and the salt. This means an attacker would need to build a new rainbow table for every unique salt, rendering precomputed tables computationally useless.

Answer

Salting increases the length of the hash, causing buffer overflows

Answer

Salts make the total hash space too large to compute

Answer

Salts slow down the hashing algorithm significantly

Question 12

An analyst detects an outbound connection using a non-standard port that exhibits high-frequency 'jitter'. Which technique best characterizes the nature of this communication?

Accepted Answer

Command and control beaconing with evasion techniques.. Jitter is the deliberate randomization of time intervals between network beacons to evade detection by algorithms looking for fixed-cadence heartbeats. By introducing this variability, attackers make their C2 traffic appear more 'human' or natural. Recognizing this technique is vital for incident handlers because it highlights the sophistication of the C2 infrastructure, requiring advanced statistical analysis beyond simple threshold-based alerts to identify the underlying automated pattern.

Answer

Data exfiltration using high-speed burst transfers.

Answer

Standard web browsing activity during lunch hours.

Answer

Network congestion caused by heavy application traffic.

Question 13

An analyst is reviewing logs and finds multiple failed logins followed by a single successful login from a different IP address, which then executes 'whoami' and 'net user'. What is the most likely scenario?

Accepted Answer

Credential stuffing followed by automated reconnaissance.. This sequence is a classic indicator of credential stuffing or password spraying followed by immediate reconnaissance. The shift from multiple failures (guessing) to a successful login (success) and then immediate discovery commands (post-exploitation) strongly suggests a compromised account being used by an adversary. This pattern is vital to detect early in the kill chain before the attacker moves laterally or achieves persistence within the network environment.

Answer

A user struggling to remember their password.

Answer

A network administrator performing routine maintenance.

Answer

An automated script updating software versions.

Question 14

Which TWO of the following practices are the most effective at mitigating Insecure Direct Object Reference (IDOR) vulnerabilities?

Accepted Answer

Implementing server-side authorization checks for every object access. Mitigating IDOR requires shifting from user-controlled identifiers to server-side access control checks. Relying on unpredictable identifiers makes guessing harder, but verifying identity and authorization for every requested object is the primary defense. These practices ensure that even if an attacker discovers a valid ID, they lack the authorization to perform operations on the underlying data, thereby closing the logical gap that allows unauthorized object access.

Answer

Increasing the length of session tokens

Answer

Employing a Web Application Firewall (WAF)

Answer

Moving all sensitive data to a cloud storage bucket

Question 15

Refer to the exhibit. An attacker attempts to establish persistence by creating a new service. Why did the command fail?

Accepted Answer

The command syntax is incorrect for creating a service.. The 'sc query' command is used to inspect existing services, not to register new ones. The attacker attempted to use the query syntax rather than the 'create' command to define the service. Understanding the proper syntax for service manipulation is critical for incident handlers to identify how attackers attempt to achieve persistence via Windows Service Control Manager or other system-level configuration methods.

Answer

The service has already been deleted by the system.

Answer

The 'sc' command does not support the 'binPath' argument.

Answer

The user lacks sufficient privileges to query services.

Question 16

How can an application distinguish between an authorized user requesting their own profile and an unauthorized user attempting to access a different profile via IDOR?

Accepted Answer

By verifying ownership of the requested resource in the backend. The application must correlate the authenticated user's identity (from the session) with the requested resource identifier on the back-end. By checking if the session user owns the requested resource ID before returning data, the application enforces authorization. This moves the logic from 'is this user allowed to access anything?' to 'is this user allowed to access THIS SPECIFIC object?', which is the foundation of secure resource access control.

Answer

By validating that the user has a session cookie

Answer

By checking if the resource ID is a valid integer

Answer

By using a CAPTCHA on every request

Question 17

Refer to the exhibit. An AI-based EDR identifies a suspicious process chain. Based on the provided JSON output, what is the most appropriate next step for an incident handler?

Accepted Answer

Examine process memory and network artifacts to confirm malicious injection.. The exhibit shows a clear anomaly where a parent-child relationship (PowerShell spawning svchost) is highly suspicious, especially when associated with an external connection. While the AI score is high, it is a heuristic indicator. The handler must verify this via manual inspection of the process memory and network artifacts to confirm if this is a legitimate system injection or a malicious beacon, ensuring that response actions are based on verified facts.

Answer

Assume the alert is a false positive due to the common nature of svchost.

Answer

Immediately isolate the host from the network based on the 0.98 AI score.

Answer

Restart the svchost service to terminate the suspicious connection.

Question 18

Which technique is most effective for preventing prompt injection when integrating an LLM into an automated security orchestration tool?

Accepted Answer

Using clear delimiters to differentiate between system instructions and user-supplied data.. Prompt injection occurs when untrusted input is treated as an instruction by the LLM. Implementing structured input validation and separating user input from system instructions is critical. By using delimiters like XML tags or JSON structures to encapsulate user-supplied data, the LLM can clearly distinguish between instructions and data, reducing the likelihood that the model will follow malicious commands embedded within the processed security data or incident reports.

Answer

Retraining the model on internal security documentation.

Answer

Encrypting the prompt before sending it to the LLM API.

Answer

Limiting the LLM context window to 1024 tokens.

Question 19

Which of the following describes the core difference between Path Traversal and IDOR?

Accepted Answer

Path Traversal is an OS-level vulnerability, while IDOR is an application-level flaw. Path Traversal targets the file system by manipulating paths to access arbitrary files, whereas IDOR targets application data by manipulating identifiers to access unauthorized database objects. While both involve parameter tampering, they operate at different layers: Path Traversal interacts with the underlying OS file structure, while IDOR interacts with the application's data model. Understanding this distinction is key to selecting the appropriate remediation strategy for each specific vulnerability.

Answer

IDOR is only applicable to RESTful APIs

Answer

Path Traversal is only possible on Windows systems

Answer

IDOR is a subtype of Path Traversal

Question 20

Which TWO of the following are significant risks associated with using LLMs for automated malware analysis?

Accepted Answer

Inadvertent disclosure of proprietary code or indicators of compromise.. Automated malware analysis with LLMs carries risks related to data leakage and the inherent inaccuracy of AI models. If the model is not properly sandboxed, it may inadvertently leak indicators of compromise (IOCs) or sensitive binary analysis results to the provider. Additionally, the tendency of models to hallucinate or misinterpret complex obfuscation patterns can lead to incorrect analysis reports, which may cause responders to overlook actual threats or pursue useless remediation strategies during an investigation.

Answer

The model will automatically execute the malware and infect the local network.

Answer

The LLM will automatically report the malware to the vendor for analysis.

Answer

The model will increase the time required to complete the analysis.