GCIH Practice Test 2 — 30 Questions

Question 1

An incident responder is investigating a suspected SMB relay attack on a corporate network. The attacker has compromised a workstation and is attempting to relay authentication to a domain controller. Which TWO of the following conditions are necessary for a successful SMB relay attack? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SMB signing must be disabled or not required on the target server.. The correct answers are that SMB signing must be disabled or not required on the target server, and the victim's NTLM authentication must be relayed to a server that accepts NTLM. These conditions allow the attacker to forward authentication without detection. The other options are not necessary: valid credentials are not needed, physical access is not required, and SMB 1.0 is not a prerequisite.

Answer

The target server must be running SMB 1.0.

Answer

The attacker must have valid domain credentials for the target server.

Answer

The attacker must have physical access to the victim's workstation.

Question 2

Refer to the exhibit. An application reflects user input directly into the HTML value attribute. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The exhibit shows input being reflected back into the HTML attribute without proper sanitization. This is a classic example of Reflected Cross-Site Scripting (XSS). Because the input is rendered inside a tag attribute, an attacker can break out of the context using quotes to execute arbitrary JavaScript. This highlights the danger of rendering untrusted input, requiring rigorous encoding or validation strategies to ensure the browser interprets data as literal text.

Answer

SQL Injection

Answer

Command Injection

Answer

Insecure Direct Object Reference (IDOR)

Question 3

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 4

A GCIH analyst is examining a web application that uses GraphQL. The analyst notices that an attacker sent a deeply nested query that caused the server to consume excessive resources, leading to a denial of service. Which GraphQL-specific vulnerability is being exploited?

Accepted Answer

GraphQL query depth attack. GraphQL's flexible query language allows clients to specify nested fields. Without proper limits, an attacker can send a query with excessive depth, causing the server to recursively resolve many levels and exhaust CPU or memory. This is a query depth attack, a common GraphQL-specific denial-of-service vector.

Answer

GraphQL alias overloading

Answer

GraphQL batching attack

Answer

GraphQL introspection abuse

Question 5

A penetration tester discovers that a web application uses a predictable numeric parameter `user_id` in the URL to retrieve user profiles. While authenticated as user 1001, the tester changes the parameter to 1002 and successfully views another user's profile. The application does not perform any additional authorization checks beyond verifying the session. Which of the following best describes the vulnerability and its immediate impact?

Accepted Answer

Insecure Direct Object Reference (IDOR) allowing horizontal privilege escalation. The application trusts the client-supplied `user_id` without verifying that the authenticated user is authorized to access that object. By changing the identifier to another user's ID, the attacker accesses data belonging to a peer, which is horizontal privilege escalation. This is a classic IDOR because the reference to the object is direct and predictable, and the application lacks an access control check on the object level.

Answer

Vertical privilege escalation due to missing role-based access control

Answer

SQL injection because the user_id parameter is likely used in a database query

Answer

Cross-Site Request Forgery (CSRF) enabling unauthorized actions

Question 6

During a cloud incident response engagement, an analyst reviews AWS CloudTrail logs and finds that an access key belonging to an IAM user was used from an unfamiliar IP address to call GetSecretValue against AWS Secrets Manager. The key is still active. Which immediate containment action best limits further credential misuse while preserving the ability to investigate who used the key?

Accepted Answer

Deactivate the access key with UpdateAccessKey, then rotate the key and review CloudTrail history associated with that key ID.. The exposed long-term access key is the active threat, so the priority is to make it unusable right away. Deactivating the key with UpdateAccessKey halts all API calls tied to that credential while leaving the IAM user and its policies intact for analysis. CloudTrail retains the access key ID in every event record, so the investigation can continue after containment. Rotating the credential afterward restores access without reintroducing the compromised secret.

Answer

Enable AWS GuardDuty and wait for its findings to confirm the anomaly before taking any action on the credential.

Answer

Delete the IAM user entirely with DeleteUser and recreate it later with the same permissions and a new access key.

Answer

Attach an inline IAM policy to the user that denies all actions with a Condition testing aws:SourceIp against the unfamiliar address.

Question 7

An attacker is using WMI (Windows Management Instrumentation) to move laterally. Which WMI class and method combination is frequently abused for remote process execution?

Accepted Answer

Win32_Process, Create. The Win32_Process class, specifically the Create method, allows for the execution of arbitrary commands on remote systems. Incident responders often look for WMI-based process creation events in logs to detect lateral movement. Because WMI is a legitimate administrative tool, distinguishing between normal management traffic and malicious movement is a key challenge for detection and response teams.

Answer

Win32_Service, StartService

Answer

Win32_StartupCommand, Create

Answer

Win32_ScheduledJob, Create

Question 8

Which TWO of the following are considered best practices for password hashing to mitigate offline cracking?

Accepted Answer

Use a unique, random salt for every user. Modern password storage must prioritize computational cost and uniqueness. Using a per-user salt ensures that even identical passwords result in different hashes, preventing rainbow table attacks. Increasing the computational work factor (e.g., iterations) forces attackers to spend more CPU time per guess, making massive brute-force efforts prohibitively expensive. These controls are foundational to defense-in-depth, protecting user data integrity even when the authentication database is successfully exfiltrated by a threat actor.

Answer

Use a global static pepper appended to all hashes

Answer

Truncate passwords to 8 characters to save space

Answer

Store hashes in plain text for performance

Question 9

An incident handler is analyzing a packet capture and notices a high volume of TCP SYN packets sent to multiple ports on a single target host, with no corresponding SYN-ACK responses. The source IP is spoofed. What type of activity does this indicate?

Accepted Answer

TCP SYN flood. The combination of numerous TCP SYN packets, spoofed source IP, and absence of SYN-ACK responses is a hallmark of a SYN flood attack. This type of denial-of-service attempts to exhaust the target's resources by leaving half-open connections. Recognizing this pattern helps responders mitigate by enabling SYN cookies or rate limiting.

Answer

Port scanning

Answer

ARP spoofing

Answer

UDP fragmentation attack

Question 10

When evaluating potential SQL injection in an application, what is the most significant indicator that an application is vulnerable?

Accepted Answer

User input is directly concatenated into a query string.. The most definitive indicator is the presence of dynamic SQL construction using unsanitized user input. When developers concatenate strings to build queries, the database cannot distinguish between data and command intent. Identifying code patterns where user parameters are directly appended to a SQL string is a critical step in security assessments. This practice allows attackers to manipulate the query structure, leading to unauthorized data exposure, bypasses, or administrative actions within the database management system.

Answer

The application uses a relational database management system.

Answer

The database contains sensitive user data.

Answer

The application is written in an interpreted language.

Question 11

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Accepted Answer

A malicious user triggers a service to use its privileges against a resource.. The Confused Deputy problem occurs when a privileged service is coerced into performing an action on behalf of a user who lacks the permissions to perform that action directly. By utilizing 'External IDs' or 'Condition keys' like 'aws:SourceArn', developers can prevent this by ensuring that the service only assumes the role when the request originates from an authorized context, preventing unauthorized cross-account access and privilege escalation.

Answer

A user is assigned two different roles with conflicting permissions.

Answer

Two cloud administrators inadvertently delete each other's work.

Answer

A service fails to refresh its temporary tokens, causing a lockout.

Question 12

An attacker uses living-off-the-land binaries (LotLbins) to execute a malicious PowerShell script. Which detection strategy best identifies this activity while minimizing false positives from administrative scripts?

Accepted Answer

Monitor process lineage for common utilities launching suspicious child processes.. Detecting LotLbins requires focusing on process lineage and behavioral context rather than just the binary name. By correlating parent-child process relationships—specifically looking for common utilities like certutil.exe or mshta.exe spawning suspicious network connections or child shells—defenders can distinguish malicious intent from standard management tasks. This approach is critical in modern environments where native tools are frequently abused to bypass static signature-based detection mechanisms used by legacy EDR solutions.

Answer

Block all PowerShell execution via Group Policy Objects.

Answer

Flag any process execution involving native Windows binaries.

Answer

Implement static file hash signatures for all known LotLbins.

Question 13

Why are GPUs highly effective at cracking password hashes compared to traditional CPUs?

Accepted Answer

GPUs perform massively parallel operations. GPUs excel at parallel processing, containing thousands of small cores designed to perform simple mathematical operations simultaneously. Password hashing, particularly MD5 or SHA-1, involves repetitive, independent calculations, which is the perfect workload for a GPU. While a CPU might handle a few operations at once, a GPU can calculate millions of hashes per second. This speed advantage drastically reduces the time required for brute-force attacks against databases using weak, unsalted, or fast hashing algorithms.

Answer

GPUs have higher clock speeds than CPUs

Answer

GPUs access system RAM faster than CPUs

Answer

GPUs use a different instruction set than CPUs

Question 14

Which of the following is the primary risk associated with using unvetted AI models for malware signature generation?

Accepted Answer

The model may produce signatures that trigger on benign system binaries.. Using unvetted AI models for signature generation risks creating false signatures that could lead to widespread system instability or denial of service if deployed to endpoint protection platforms. In the context of malware investigation, these tools must be calibrated against known-good and known-bad datasets. Failing to vet the model results in a high false-positive rate, which ultimately undermines the efficacy of the incident response team and wastes valuable time during critical security incidents.

Answer

The model will always generate signatures that are too complex to implement.

Answer

The model will consume excessive processing power on the endpoint.

Answer

The model will force the malware to evolve into a polymorphic variant.

Question 15

A GCIH incident responder is investigating a suspected API attack where an attacker manipulated a JSON Web Token (JWT) to gain unauthorized access. The responder needs to identify which two conditions would allow a JWT 'kid' (Key ID) header injection attack to succeed. (Choose two.)

Accepted Answer

The application allows the 'kid' header to specify an absolute path or URL that the server will fetch to obtain the key.. JWT 'kid' injection succeeds when the application uses the 'kid' header to determine the verification key without validating its content. If the 'kid' is used to build a file path or fetch a remote key, an attacker can manipulate it to use a key they control, forging valid tokens. The other conditions describe different JWT weaknesses.

Answer

The application uses a symmetric signing algorithm and the secret is weak or guessable.

Answer

The JWT is transmitted over an unencrypted HTTP connection, allowing token interception.

Answer

The application supports the 'none' algorithm and accepts unsigned tokens.

Question 16

A security analyst is investigating a suspected local file inclusion (LFI) attack against a PHP web application. The web server logs show the following request: `GET /download.php?file=php://filter/convert.base64-encode/resource=index.php`. The analyst needs to determine the attacker's objective and the potential impact. (Choose two.)

Accepted Answer

The attacker is attempting to read the source code of `index.php` by encoding it in Base64 to bypass PHP execution.. The payload uses the `php://filter` wrapper with Base64 encoding to read the source code of `index.php`. This technique bypasses PHP execution, allowing the attacker to view the raw code, which may contain sensitive information like database credentials. The other options misidentify the objective, such as command execution or CSRF, which are not supported by the specific payload.

Answer

The attacker is attempting to retrieve the contents of a sensitive file, such as `/etc/passwd`, by including it directly.

Answer

The attacker is attempting to perform a cross-site request forgery (CSRF) attack against the web application.

Answer

The attacker is attempting to execute arbitrary commands on the server via the `file` parameter.

Question 17

An incident responder investigates a web application breach where an attacker successfully extracted sensitive user data by appending UNION SELECT statements to a numeric product ID parameter. Which backend remediation approach directly eliminates this vulnerability class while preserving application functionality?

Accepted Answer

Refactor database queries to use prepared statements with bound parameters via the application data access layer.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine treats input exclusively as data rather than executable code. Implementing parameterized queries globally stops SQL injection by neutralizing untrusted input regardless of characters appended by attackers, making it the definitive defense for database interaction security in incident response hardening.

Answer

Implement client-side JavaScript regex validation to strip SQL keywords from input parameters before transmission.

Answer

Wrap all user inputs inside custom string-escaping functions designed to neutralize single quotes and semicolons.

Answer

Deploy a traditional network firewall configured with signature rules to block incoming HTTP GET requests containing UNION.

Question 18

An incident responder is analyzing a compromised Linux server. The responder notices that the file /etc/ld.so.preload contains the path /lib/libprocess.so, which is not a standard library. The responder suspects an attacker is using this for persistence and privilege escalation. Which post-exploitation technique is being employed?

Accepted Answer

Dynamic linker preloading via /etc/ld.so.preload. The /etc/ld.so.preload file is used by the dynamic linker to load specified shared libraries before any others for all dynamically linked executables. An attacker can place a malicious library there to intercept function calls, escalate privileges, or maintain persistence. This technique is stealthy because it affects all programs and is not easily detected by process monitoring.

Answer

Cron job persistence

Answer

Kernel module rootkit insertion

Answer

LD_PRELOAD environment variable hijacking

Question 19

A security analyst is reviewing logs from a Linux web server and notices that the 'last' command output shows a login by user 'root' from an IP address that is not part of the company's network. The login occurred at 03:00 AM, and the analyst also finds that the file /root/.ssh/authorized_keys was modified at the same time. Which post-exploitation technique has the attacker most likely used?

Accepted Answer

SSH key persistence. The modification of /root/.ssh/authorized_keys to include an attacker's public key is a classic SSH key persistence technique. The suspicious root login from an external IP at an odd hour corroborates this. Attackers use this to maintain access without needing a password, even if credentials are changed.

Answer

LD_PRELOAD hijacking

Answer

Cron job persistence

Answer

Kernel module rootkit

Question 20

Refer to the exhibit. Given the provided log entry, which attack is likely occurring, and what does the sub-status code indicate?

Accepted Answer

Brute-force/Dictionary attack; 0xC000006A means bad password. Event ID 4625 with sub-status 0xC000006A indicates a failed logon due to a bad password. When this appears repeatedly from a single source for an administrative account, it strongly suggests a brute-force or dictionary attack. The NTLM authentication process indicates that the attacker is attempting to authenticate using the legacy NTLM protocol, which is a common indicator of targeted attacks against Windows environments.

Answer

Pass-the-Hash; 0xC000006A means the hash is expired

Answer

Account lockout; 0xC000006A means account is disabled

Answer

Kerberoasting; 0xC000006A means SPN not found