GCIH Practice Test 3 — 10 Questions

Question 1

During an incident response engagement on a Linux server, you discover an outbound covert channel using ICMP echo request packets that contain encoded payload data within the payload field. Which specific command-line utility should you look for in the process execution history to identify the tool responsible for generating this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

hping3. Hping3 is a popular packet generator and analyzer for TCP/IP that supports crafting arbitrary ICMP packets with custom payload data. Attackers frequently leverage hping3 or similar custom scripting tools to exfiltrate data through covert channels when standard protocols are blocked by perimeter firewalls, making process history analysis critical for detection.

Answer

ping

Answer

traceroute

Answer

tcpdump

Question 2

An incident responder investigating a compromised Windows workstation discovers that an attacker established persistent command and control using a malicious DLL. The DLL was placed in a system directory and loaded by a legitimate, signed Microsoft binary through DLL search order hijacking. Which response action effectively remediates the persistence while preserving the legitimate binary and minimizing host downtime?

Accepted Answer

Locate and securely delete the rogue malicious DLL file from the search path while preserving the legitimate signed binary and auditing registry permissions.. Identifying and removing the malicious payload while keeping the legitimate application intact is critical for operational continuity during incident response. DLL search order hijacking exploits how Windows searches for dependent libraries. Replacing or removing the unauthorized payload neutralizes the execution vector without requiring a full OS reinstallation, allowing investigators to focus on lateral movement and containment.

Answer

Reimage the compromised workstation immediately to ensure all hidden artifacts and registry hooks are completely removed from the operating system.

Answer

Delete the legitimate signed Microsoft binary that loaded the malicious payload to prevent any further execution attempts by the operating system.

Answer

Modify the Windows Registry to disable the DLL loading subsystem entirely across the domain to prevent all future instances of search order hijacking.

Question 3

An incident responder notices an unusual outbound connection from a workstation to an external IP address on TCP port 443. Packet capture analysis shows that the SSL/TLS handshake completes, but the subsequent application-layer data payload is fully encrypted and does not match standard HTTPS browser traffic patterns. Which log investigation method provides the most reliable approach to determine if this traffic represents malicious command and control activity?

Accepted Answer

Correlate the network connection timestamp with endpoint process execution logs to identify the exact binary that initiated the socket.. Correlating endpoint process execution logs with network connection data via Sysmon Event ID 3 and Event ID 1 reveals the parent process responsible for establishing the socket. Relying solely on destination port 443 or external reputation feeds is insufficient because modern adversaries frequently tunnel malicious traffic over standard ports and encrypted channels to blend in with legitimate enterprise web traffic.

Answer

Perform a reverse DNS lookup on the destination IP address to verify if the domain belongs to a known content delivery network.

Answer

Inspect the certificate issuer authority within the TLS handshake to confirm if it matches internal corporate enterprise signing policies.

Answer

Analyze the TCP window size scaling factors during the initial three-way handshake to detect anomalies indicative of tunneling tools.

Question 4

When auditing an application for Insecure Direct Object References, why is it recommended to perform tests using two distinct user accounts?

Accepted Answer

To confirm that the application does not validate object ownership. Testing with two accounts allows the auditor to verify if User A can access User B's resources using the same identifiers. This 'cross-account' test is the gold standard for confirming an IDOR vulnerability. It isolates the logic flaw by demonstrating that the application fails to validate ownership, proving that access control is tied only to authentication rather than granular authorization, which is a critical finding for secure development.

Answer

To verify if the server is load balanced

Answer

To ensure that session cookies are not reused

Answer

To test the strength of the password hashing

Question 5

An incident responder is investigating a RESTful API breach where an authenticated low-privileged user accessed administrative records by modifying an integer identifier in the resource path from /api/v1/users/104 to /api/v1/users/1. Which type of vulnerability has been exploited?

Accepted Answer

Insecure Direct Object Reference. This scenario describes an Insecure Direct Object Reference vulnerability, commonly classified under Broken Object Level Authorization in modern API security taxonomies. The application fails to validate whether the requesting user possesses authorization to access the specific resource identifier requested in the URL path. Attackers systematically enumerate these predictable identifiers to harvest unauthorized sensitive data across multi-tenant API endpoints during security assessments and active breaches.

Answer

Broken Function Level Authorization

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 6

An analyst uses an AI assistant to summarize a malware report and generate response steps. Before executing any recommended commands on production systems, what is the most important action?

Accepted Answer

Verify the commands against authoritative documentation and test them in a non-production environment.. AI-generated response steps must be treated as suggestions, not instructions. Verifying commands against authoritative documentation and testing them in a non-production environment prevents accidental outages and data loss. This practice preserves production stability and evidence integrity while still allowing the analyst to benefit from AI-assisted summarization and drafting.

Answer

Ask the AI to confirm that its own recommendations are correct.

Answer

Execute the commands immediately to contain the threat before it spreads.

Answer

Save the AI output as the official incident record without modification.

Question 7

Which of the following is a classic example of an 'adversarial' attack against an AI-powered detection engine?

Accepted Answer

Applying minimal, non-functional perturbations to code to cause misclassification.. Adversarial attacks aim to manipulate the input to an AI model to cause a misclassification. By adding carefully crafted, minimal noise—sometimes called an 'adversarial perturbation'—an attacker can make malicious code appear benign to the model. Recognizing these attacks is vital for incident handlers because it explains why an otherwise robust system might miss a clearly malicious payload that an analyst can easily see with the naked eye.

Answer

A distributed denial-of-service attack against the AI server.

Answer

Adding 'dead' code blocks to hide the malicious payload's intent.

Answer

Using stolen credentials to access the AI administration console.

Question 8

An analyst is investigating potential data exfiltration via DNS tunneling. Which TWO of the following indicators would most strongly suggest this activity is occurring?

Accepted Answer

A sudden increase in DNS TXT record requests. DNS tunneling uses DNS queries to encapsulate non-DNS traffic, bypassing standard firewalls. Detecting this requires looking for abnormal patterns in traffic volume and request frequency. By identifying unusually long subdomains or high volumes of TXT/NULL record types, analysts can pinpoint covert channels. This is critical for detecting C2 traffic that hides in plain sight within common, often permitted, network protocols.

Answer

High volumes of HTTP GET requests to internal IPs

Answer

Frequent ICMP echo requests from the perimeter

Answer

TCP SYN floods targeting the local gateway

Question 9

What is the primary function of the 'Token Manipulation' technique in Windows pivoting?

Accepted Answer

To impersonate another user's security context.. Token manipulation involves stealing an access token from a process running as a different user (e.g., SYSTEM or an Administrator) and using it to spawn a new process. This allows the attacker to elevate their privileges or move laterally as a different user. Understanding this technique is vital for incident handlers because it explains how attackers maintain high-level access without knowing user passwords.

Answer

To hide files in a hidden directory.

Answer

To bypass user authentication prompts.

Answer

To encrypt the memory of a running process.

Question 10

An attacker discovers an API endpoint /api/v1/user/details?id=123 that returns JSON data. They modify the parameter to /api/v1/user/details?id=124. This vulnerability indicates a failure in which security control?

Accepted Answer

Insecure Direct Object Reference. This scenario describes Insecure Direct Object Reference (IDOR). The application fails to verify if the authenticated user has authorization to access the object associated with the ID parameter. In API security, this is a critical flaw because APIs often expose backend database keys directly. Proper mitigation requires server-side access control checks on every request, ensuring the requester owns the resource before returning sensitive data.

Answer

Broken Authentication

Answer

Cross-Site Scripting

Answer

Insufficient Logging and Monitoring