GCIH Practice Test 6 — 10 Questions

Question 1

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics

Question 2

During a forensic analysis of a compromised developer workstation, an incident handler discovers scripts showing an attacker utilized an LLM to automate reconnaissance tasks. Which TWO capabilities are typically enhanced when integrating LLMs into modern offensive enumeration workflows? (Choose two)

Accepted Answer

Synthesizing unstructured banner-grabbing outputs into structured asset inventories. Integrating Large Language Models into offensive reconnaissance enhances operations by parsing unstructured network data and generating complex scripting logic on the fly. Incident responders must recognize these patterns during host artifact analysis to map out how attackers accelerated their initial target discovery phases.

Answer

Direct physical manipulation of smart-city IoT gateway switches via radio frequency

Answer

Autonomously generating custom multi-threaded port scanner binaries in compiled C

Answer

Bypassing hardware-enforced memory encryption mechanisms on remote hypervisors

Question 3

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Accepted Answer

Using pre-commit hooks to scan code for patterns.. Pre-commit hooks are local scripts that run before a commit is finalized, scanning for patterns like API keys or passwords. They allow developers to catch mistakes immediately on their local machines before sensitive data is pushed to a remote repository. This prevents the secret from ever entering the version history, which is the most effective way to maintain the security of credentials in a distributed development workflow.

Answer

Implementing a post-push webhook to scan the repository.

Answer

Enabling public repository visibility scanning.

Answer

Enforcing HTTPS for all Git operations.

Question 4

During a web application incident investigation, the SOC analyst discovers that an attacker sent a modified JSON payload containing an unexpected administrative attribute "is_admin": true during user registration, which successfully elevated the user's privileges. What vulnerability enabled this exploitation?

Accepted Answer

Mass Assignment. Mass assignment occurs when frameworks automatically bind user input parameters directly to backend data models without proper filtering. This allows attackers to inject privileged fields that were never intended to be exposed during client-side registration forms. GCIH handlers must trace data binding configurations and ensure explicit allowlisting of updatable attributes to prevent privilege escalation incidents via API request tampering.

Answer

Broken User Authentication

Answer

Server-Side Request Forgery

Answer

Cross-Site Scripting

Question 5

An incident responder investigates a Windows endpoint and discovers an unexpected service running with administrative privileges, executing a binary from an anomalous temporary directory. Reviewing the registry, the responder notices that the service binary path uses a space-separated executable path without surrounding double quotes, and the folder name contains a space. Which post-exploitation persistence and privilege escalation technique has the attacker deployed?

Accepted Answer

Unquoted service path exploitation leveraging Windows path parsing behavior.. Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

Answer

DLL search order hijacking involving system directory redirection.

Answer

Scheduled task modification using legitimate administrator task IDs.

Answer

Windows Management Instrumentation event subscription persistence.

Question 6

Which of the following describes the primary danger of an Insecure Deserialization vulnerability in a web application?

Accepted Answer

It facilitates the execution of arbitrary code via gadget chains.. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a DoS, or execute arbitrary code. By manipulating the serialized object, an attacker can modify application state, bypass authentication, or leverage existing application code (gadget chains) to gain remote code execution. This is critical because modern frameworks often automatically deserialize objects from user-provided data without sufficient verification or integrity checks on the source.

Answer

The vulnerability enables unauthorized database password decryption.

Answer

It allows attackers to inject malicious code into the database.

Answer

It causes the application to leak internal memory structures.

Question 7

Which of the following describes an 'LLM Hallucination' in the context of analyzing an unknown binary?

Accepted Answer

The model generates a convincing but false explanation of a function's purpose.. An LLM hallucination occurs when the model generates confident but factually incorrect information. When analyzing binaries, this manifests as the model identifying non-existent vulnerabilities or describing functions that do not actually exist in the provided code. This is dangerous because it can lead an analyst to waste time chasing false positives or implementing incorrect remediations based on the AI's plausible-sounding but erroneous technical assessment of the binary.

Answer

The model successfully deobfuscates the binary and identifies a buffer overflow.

Answer

The model refuses to analyze the binary due to safety policy violations.

Answer

The model correctly identifies the compiler used to build the binary.

Question 8

During an investigation, you observe an attacker using 'living-off-the-land' (LotL) techniques. Why is it difficult to detect this activity using traditional signature-based antivirus?

Accepted Answer

The tools are trusted binaries and the malicious intent is in the parameters.. Living-off-the-land attacks use legitimate, signed system binaries (like PowerShell, wmic, or certutil) to perform malicious actions. Since the tools themselves are trusted components of the operating system, antivirus software rarely flags them as malicious. Detecting LotL requires behavioral analysis, command-line logging, and monitoring for anomalous execution patterns rather than relying on file signatures, which are ineffective against tools that are inherently part of the system's baseline.

Answer

These binaries are encrypted on the disk, preventing antivirus from scanning them.

Answer

The tools operate entirely in volatile memory and never touch the disk.

Answer

Antivirus software is only capable of detecting malware written in assembly language.

Question 9

An incident handler is reviewing password storage mechanisms after a breach. The attacker exfiltrated a file containing password hashes. Which of the following TWO characteristics would make the hashes more resistant to offline cracking? (Choose two.)

Accepted Answer

Each hash includes a unique, random salt value.. The two characteristics that make hashes more resistant to offline cracking are the use of a slow key derivation function (like bcrypt) and the inclusion of a unique random salt per hash. A slow KDF increases the time required to compute each hash, while salting prevents the use of precomputed tables and ensures that identical passwords yield different hashes. Together, they significantly raise the cost for an attacker.

Answer

The password policy requires a minimum length of 8 characters with complexity.

Answer

The hashes are generated using SHA-256 without any salt.

Answer

The hashes are stored in a compressed archive to save space.

Question 10

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.