GCIH Practice Test 7 — 10 Questions

Question 1

Which of the following is an advantage of using a Key Derivation Function (KDF) like Argon2 over a simple hash like SHA-256?

Accepted Answer

KDFs are memory-hard and resist GPU cracking. Standard cryptographic hashes like SHA-256 are designed for speed, which is a disadvantage when storing passwords because it allows attackers to test millions of guesses per second. KDFs like Argon2 are specifically designed to be slow and resource-intensive (memory-hard). By forcing the hardware to consume significant memory and time for every single hash calculation, KDFs make large-scale brute-force and dictionary attacks computationally expensive, providing much better security for sensitive credentials.

Answer

KDFs are faster and improve login performance

Answer

KDFs allow for reversible password recovery

Answer

KDFs require less storage space in the database

Question 2

An incident handler is reviewing SMB traffic and notices a large number of SMB2 CREATE requests for files with extensions like .docx, .xlsx, and .pdf, followed by SMB2 WRITE requests that overwrite the same files with encrypted content. The traffic originates from a single workstation and targets a file server. Which type of attack is most likely occurring?

Accepted Answer

Ransomware encrypting files on the file server via SMB.. The correct answer is ransomware encrypting files via SMB. The sequence of opening document files and overwriting them with encrypted data is a hallmark of ransomware. The other options do not match the observed traffic: exfiltration would read files, brute-force would show failed logons, and worm propagation would target multiple hosts.

Answer

SMB worm propagation, where the attacker is scanning for vulnerable hosts.

Answer

Data exfiltration through SMB, where files are being copied to an external location.

Answer

SMB brute-force attack, where the attacker is attempting to guess passwords.

Question 3

During an incident response engagement, you capture SMB authentication traffic on a subnet where an attacker has positioned a rogue device. The traffic shows NTLMv2 challenge/response pairs being relayed to a file server that does not enforce SMB signing. Which of the following best describes the security control that would have most directly prevented the relayed authentication from succeeding?

Accepted Answer

Enforcing SMB signing on the target file server. SMB signing is the specific control that prevents NTLM relay to SMB file servers because it requires the client and server to sign every message with a session key. A relayed authentication cannot satisfy signing because the attacker does not possess the negotiated session key. Other controls like disabling NetBIOS or requiring Kerberos do not address the fundamental relay path over SMB.

Answer

Enabling Extended Protection for Authentication on the domain controller

Answer

Disabling NetBIOS over TCP/IP on all workstations

Answer

Requiring Kerberos authentication for all domain logons

Question 4

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

Accepted Answer

Principle of Least Privilege.. The 'AdministratorAccess' policy provides full, unrestricted access to all services. Assigning this to daily tasks violates the Principle of Least Privilege, which dictates that users should only have the minimum permissions necessary to perform their jobs. Over-privileged accounts are a significant liability, as they allow an attacker who compromises the account to perform any action, including deleting logs or resources, which massively increases the potential impact of an incident.

Answer

Separation of Duties.

Answer

Defense in Depth.

Answer

Security through Obscurity.

Question 5

A red team operator is building an LLM-assisted phishing campaign tool that generates personalized pretexts for targets. The tool queries an external LLM API with target names and job titles scraped from LinkedIn. A security architect warns that this workflow may expose sensitive engagement data and violate client scoping agreements. Which control best mitigates this risk while preserving the tool's functionality?

Accepted Answer

Deploy a locally hosted open-weight LLM within the engagement infrastructure and route all prompts to it instead of the external API.. The core risk is that target PII and engagement specifics leave the trusted environment when prompts are sent to a third-party API. A locally hosted open-weight model keeps all inference and data inside the engagement infrastructure, removing the third-party exposure entirely while still generating the required pretexts. Encoding, prompt instructions, and key rotation do not prevent the data itself from reaching the vendor, so they fail to address the actual scoping and confidentiality issue.

Answer

Rotate the API keys used for the external LLM service every 24 hours during the engagement.

Answer

Add a system prompt instructing the external LLM to forget all data after each response and never store it.

Answer

Base64-encode the target names and titles before sending them to the external API to obscure the data in transit.

Question 6

During an investigation, you observe an attacker using 'PsExec' to move laterally. What is the primary artifact created by PsExec that can be used to track its execution across the network?

Accepted Answer

The installation of a service named 'PSEXESVC'.. PsExec functions by creating a remote service named 'PSEXESVC' on the target machine. This service executes the payload and is then cleaned up. Identifying the creation and deletion of this specific service name in the Windows System event logs (Event ID 7045) is the most reliable way to track PsExec activity, provided that the logs have not been cleared by the attacker.

Answer

The creation of a temporary file named 'psexec.exe' in the root directory.

Answer

An entry in the 'Run' registry key for persistence.

Answer

A specific user-mode process named 'psexec_agent'.

Question 7

An incident responder is using an LLM to automate the parsing of obfuscated PowerShell scripts found during a breach. What is the primary operational risk when feeding these scripts into a cloud-based LLM API?

Accepted Answer

The input data may be retained and used for future model training, potentially leaking incident indicators.. Sharing obfuscated code with cloud-based LLMs risks leaking proprietary infrastructure details or sensitive credentials embedded within scripts into the vendor's training corpus. This data exposure violates confidentiality policies and undermines incident containment efforts. Security professionals must utilize local models or sanitized code snippets to prevent inadvertent data exfiltration while leveraging AI-assisted analysis for complex malware triage during active incident response workflows.

Answer

The LLM will automatically execute the PowerShell commands in the cloud environment.

Answer

The LLM will refuse to analyze the script because it contains malicious syntax.

Answer

The LLM will inject backdoors into the code during the deobfuscation process.

Question 8

An analyst discovers that an attacker is using AI to dynamically change the command-and-control (C2) infrastructure based on defensive responses. Which IR strategy is best suited to disrupt this behavior?

Accepted Answer

Implement proactive deception techniques to feed the attacker's AI false data.. The most effective way to counter dynamic, AI-driven infrastructure is to implement 'proactive deception' and 'automated environment hardening.' By creating a moving target environment, the responder forces the attacker's AI to constantly adjust to false or unstable indicators. This disrupts the adversary's ability to maintain a persistent connection, effectively neutralizing the advantage gained by their automated infrastructure adjustments during the incident containment phase.

Answer

Maintain the current defense and wait for the C2 to remain static.

Answer

Block all outbound traffic at the perimeter to stop the communication.

Answer

Perform a full system wipe of all endpoints involved in the C2 network.

Question 9

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

Accepted Answer

Implement IAM roles that grant temporary security credentials via STS.. Utilizing IAM roles with temporary security credentials is the best practice for cloud security. By assuming roles, you eliminate the risks associated with static access keys, which are frequently leaked or stolen. This approach aligns with the principle of least privilege, as temporary tokens expire automatically, reducing the window of opportunity for an attacker to exploit compromised credentials, thereby enhancing the overall security posture of the cloud environment.

Answer

Generate unique access keys for every developer stored in an encrypted S3 bucket.

Answer

Rotate IAM user access keys every 90 days via an automated script.

Answer

Use an IAM group policy to enforce Multi-Factor Authentication on all API requests.

Question 10

An incident handler is reviewing SMB traffic and notices multiple 'Tree Connect' requests to the IPC$ share. What does this activity typically signify in an attack scenario?

Accepted Answer

An attacker is likely performing reconnaissance or lateral movement.. The IPC$ (Inter-Process Communication) share is a special share used by Windows for communication between network devices, often for administrative functions. Attackers frequently connect to IPC$ to perform null sessions or to interact with the service control manager to remotely execute code. Identifying frequent, unauthorized connections to IPC$ is a strong indicator of reconnaissance or lateral movement, as it is a common starting point for an attacker to enumerate the system.

Answer

A standard user is accessing their home directory.

Answer

The workstation is simply performing routine backups.

Answer

The SMB server is correctly enforcing message signing.