GCIH Practice Test 4 — 10 Questions

Question 1

An incident responder is investigating a suspected SMB relay attack on a corporate network. The attacker has compromised a workstation and is attempting to relay authentication to a domain controller. Which TWO of the following conditions are necessary for a successful SMB relay attack? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SMB signing must be disabled or not required on the target server.. The correct answers are that SMB signing must be disabled or not required on the target server, and the victim's NTLM authentication must be relayed to a server that accepts NTLM. These conditions allow the attacker to forward authentication without detection. The other options are not necessary: valid credentials are not needed, physical access is not required, and SMB 1.0 is not a prerequisite.

Answer

The target server must be running SMB 1.0.

Answer

The attacker must have valid domain credentials for the target server.

Answer

The attacker must have physical access to the victim's workstation.

Question 2

Refer to the exhibit. An application reflects user input directly into the HTML value attribute. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The exhibit shows input being reflected back into the HTML attribute without proper sanitization. This is a classic example of Reflected Cross-Site Scripting (XSS). Because the input is rendered inside a tag attribute, an attacker can break out of the context using quotes to execute arbitrary JavaScript. This highlights the danger of rendering untrusted input, requiring rigorous encoding or validation strategies to ensure the browser interprets data as literal text.

Answer

SQL Injection

Answer

Command Injection

Answer

Insecure Direct Object Reference (IDOR)

Question 3

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 4

A GCIH analyst is examining a web application that uses GraphQL. The analyst notices that an attacker sent a deeply nested query that caused the server to consume excessive resources, leading to a denial of service. Which GraphQL-specific vulnerability is being exploited?

Accepted Answer

GraphQL query depth attack. GraphQL's flexible query language allows clients to specify nested fields. Without proper limits, an attacker can send a query with excessive depth, causing the server to recursively resolve many levels and exhaust CPU or memory. This is a query depth attack, a common GraphQL-specific denial-of-service vector.

Answer

GraphQL alias overloading

Answer

GraphQL batching attack

Answer

GraphQL introspection abuse

Question 5

A penetration tester discovers that a web application uses a predictable numeric parameter `user_id` in the URL to retrieve user profiles. While authenticated as user 1001, the tester changes the parameter to 1002 and successfully views another user's profile. The application does not perform any additional authorization checks beyond verifying the session. Which of the following best describes the vulnerability and its immediate impact?

Accepted Answer

Insecure Direct Object Reference (IDOR) allowing horizontal privilege escalation. The application trusts the client-supplied `user_id` without verifying that the authenticated user is authorized to access that object. By changing the identifier to another user's ID, the attacker accesses data belonging to a peer, which is horizontal privilege escalation. This is a classic IDOR because the reference to the object is direct and predictable, and the application lacks an access control check on the object level.

Answer

Vertical privilege escalation due to missing role-based access control

Answer

SQL injection because the user_id parameter is likely used in a database query

Answer

Cross-Site Request Forgery (CSRF) enabling unauthorized actions

Question 6

During a cloud incident response engagement, an analyst reviews AWS CloudTrail logs and finds that an access key belonging to an IAM user was used from an unfamiliar IP address to call GetSecretValue against AWS Secrets Manager. The key is still active. Which immediate containment action best limits further credential misuse while preserving the ability to investigate who used the key?

Accepted Answer

Deactivate the access key with UpdateAccessKey, then rotate the key and review CloudTrail history associated with that key ID.. The exposed long-term access key is the active threat, so the priority is to make it unusable right away. Deactivating the key with UpdateAccessKey halts all API calls tied to that credential while leaving the IAM user and its policies intact for analysis. CloudTrail retains the access key ID in every event record, so the investigation can continue after containment. Rotating the credential afterward restores access without reintroducing the compromised secret.

Answer

Enable AWS GuardDuty and wait for its findings to confirm the anomaly before taking any action on the credential.

Answer

Delete the IAM user entirely with DeleteUser and recreate it later with the same permissions and a new access key.

Answer

Attach an inline IAM policy to the user that denies all actions with a Condition testing aws:SourceIp against the unfamiliar address.

Question 7

An attacker is using WMI (Windows Management Instrumentation) to move laterally. Which WMI class and method combination is frequently abused for remote process execution?

Accepted Answer

Win32_Process, Create. The Win32_Process class, specifically the Create method, allows for the execution of arbitrary commands on remote systems. Incident responders often look for WMI-based process creation events in logs to detect lateral movement. Because WMI is a legitimate administrative tool, distinguishing between normal management traffic and malicious movement is a key challenge for detection and response teams.

Answer

Win32_Service, StartService

Answer

Win32_StartupCommand, Create

Answer

Win32_ScheduledJob, Create

Question 8

Which TWO of the following are considered best practices for password hashing to mitigate offline cracking?

Accepted Answer

Use a unique, random salt for every user. Modern password storage must prioritize computational cost and uniqueness. Using a per-user salt ensures that even identical passwords result in different hashes, preventing rainbow table attacks. Increasing the computational work factor (e.g., iterations) forces attackers to spend more CPU time per guess, making massive brute-force efforts prohibitively expensive. These controls are foundational to defense-in-depth, protecting user data integrity even when the authentication database is successfully exfiltrated by a threat actor.

Answer

Use a global static pepper appended to all hashes

Answer

Truncate passwords to 8 characters to save space

Answer

Store hashes in plain text for performance

Question 9

An incident handler is analyzing a packet capture and notices a high volume of TCP SYN packets sent to multiple ports on a single target host, with no corresponding SYN-ACK responses. The source IP is spoofed. What type of activity does this indicate?

Accepted Answer

TCP SYN flood. The combination of numerous TCP SYN packets, spoofed source IP, and absence of SYN-ACK responses is a hallmark of a SYN flood attack. This type of denial-of-service attempts to exhaust the target's resources by leaving half-open connections. Recognizing this pattern helps responders mitigate by enabling SYN cookies or rate limiting.

Answer

Port scanning

Answer

ARP spoofing

Answer

UDP fragmentation attack

Question 10

When evaluating potential SQL injection in an application, what is the most significant indicator that an application is vulnerable?

Accepted Answer

User input is directly concatenated into a query string.. The most definitive indicator is the presence of dynamic SQL construction using unsanitized user input. When developers concatenate strings to build queries, the database cannot distinguish between data and command intent. Identifying code patterns where user parameters are directly appended to a SQL string is a critical step in security assessments. This practice allows attackers to manipulate the query structure, leading to unauthorized data exposure, bypasses, or administrative actions within the database management system.

Answer

The application uses a relational database management system.

Answer

The database contains sensitive user data.

Answer

The application is written in an interpreted language.