GCIH Practice Test 8 — 10 Questions

Question 1

When performing a password audit, you identify the use of 'PBKDF2-HMAC-SHA256' for credential storage. What makes this a strong choice compared to basic salted hashes, and how does it specifically hinder offline attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It stretches the password, making individual guesses slow. PBKDF2 (Password-Based Key Derivation Function 2) is a key stretching algorithm that applies a pseudorandom function repeatedly to the input password and salt. This 'stretching' makes the process intentionally slow. By increasing the iteration count, defenders force the attacker to expend significantly more CPU time for each guess, making brute-force or dictionary attacks prohibitively slow compared to standard hashing methods.

Answer

It uses hardware-specific instructions to prevent GPU cracking

Answer

It encrypts the hash so it cannot be decrypted

Answer

It requires a secret key that is stored on a HSM

Question 2

An organization detects a web-based attack and wants to perform a thorough investigation. Which THREE artifacts should the team collect to analyze the adversary's entry point and activity?

Accepted Answer

HTTP access and error logs from the web server.. Analyzing a web-based attack requires a multi-layered approach. By correlating web server logs, application-level logs, and firewall traffic, investigators can reconstruct the full attack chain from the initial exploit attempt to post-exploitation activity. This holistic view is necessary to verify the entry point, understand the impact, and ensure all malicious persistence mechanisms are identified and removed during the remediation process, preventing the attacker from regaining unauthorized access to the environment.

Answer

System event logs for all workstations in the local network.

Answer

Email gateway logs showing internal-to-external communication patterns.

Question 3

Which TWO steps are critical during the 'Preparation' phase of the incident response lifecycle to ensure effective forensic investigation during a future security breach?

Accepted Answer

Establishing a centralized logging architecture with immutable storage.. Preparation is the foundation of incident response. By establishing logging infrastructure and legal protocols in advance, an organization ensures that forensic evidence is available and admissible when an incident occurs. Failing to prepare these elements often results in fragmented logs or delayed response actions, which hinders the team's ability to reconstruct the attack timeline accurately and perform root cause analysis after the threat is contained.

Answer

Drafting an incident communication plan for notifying public regulatory bodies.

Answer

Conducting a comprehensive risk assessment of all internal business applications.

Answer

Purchasing cybersecurity insurance to cover potential ransomware payout costs.

Question 4

Refer to the exhibit. An analyst identifies these entries on a critical server. What should the analyst conclude regarding the process associated with PID 4?

Accepted Answer

The process is a legitimate Windows kernel operation for SMB file sharing.. In Windows environments, PID 4 is reserved for the System process. In the context of port 445 (SMB), this is standard behavior for the Server service and kernel-level file sharing. Recognizing legitimate OS behavior is critical to avoid false positives. If the source IPs were unknown or the connection volume was anomalous, further investigation into kernel-mode drivers or rootkits would be required, but this output represents standard file sharing functionality.

Answer

The server is likely compromised by a kernel-mode rootkit acting as a listener.

Answer

A remote adversary is using the SMB protocol to exfiltrate data from the system.

Answer

The system is currently scanning the network for vulnerabilities using SMB exploits.

Question 5

An organization is responding to an Advanced Persistent Threat (APT). During the 'Eradication' phase, why is it critical to go beyond just removing identified malware?

Accepted Answer

Because malware is often just a dropper for a secondary, more complex backdoor.. APT actors are methodical and typically establish multiple persistence mechanisms and backdoors to ensure continued access. If a responder only removes the single piece of malware they found, the attacker can easily pivot back into the network. Eradication must involve comprehensive cleaning, including resetting compromised credentials, closing open vulnerabilities, and auditing the environment to ensure no hidden persistence points remain.

Answer

Because antivirus signatures are always outdated and will miss the actual threat.

Answer

Because the attacker will likely sue the organization if any artifacts remain.

Answer

Because the cleanup process must generate new forensic evidence for police.

Question 6

Which Nmap scan flag allows a responder to bypass simple packet filters by using specific source ports, such as port 53, to appear as legitimate DNS traffic?

Accepted Answer

--source-port 53. The --source-port flag allows for the manipulation of the packet's source port, which is a common technique for bypassing firewall rules configured to permit traffic from trusted services like DNS. This is useful for responders trying to map networks where basic ingress/egress filtering is in place, as it mimics expected protocol behavior to slip through simple security controls.

Answer

--spoof-mac

Answer

-f

Answer

--data-length

Question 7

What is the primary function of SMB (Server Message Block) in a Windows network environment?

Accepted Answer

To enable file, printer, and resource sharing across a network. SMB is the primary network file sharing protocol used in Windows environments, facilitating access to files, printers, and serial ports on remote systems. It acts as a client-server communication protocol, allowing users to interact with shared resources as if they were local. Because it is so widely used for infrastructure services, its security configuration is a primary concern for protecting enterprise data and maintaining system integrity against unauthorized access.

Answer

To provide a secure method for remote desktop management

Answer

To manage directory services and user authentication

Answer

To provide encrypted terminal access to server consoles

Question 8

Which TWO of the following steps are considered effective for hardening the SMB service against modern threats?

Accepted Answer

Require SMB signing for all connections. Hardening SMB involves a combination of removing legacy protocols and enforcing strong authentication and integrity controls. Disabling SMBv1 is the most critical step to prevent known exploits, while enforcing SMB signing provides the necessary protection against man-in-the-middle and relay attacks. Together, these measures significantly reduce the risk of lateral movement and unauthorized access, creating a much more resilient file-sharing environment that aligns with current security standards for enterprise networks.

Answer

Enable Guest Auth for compatibility

Answer

Use the LanmanServer for internet access

Answer

Disable all firewall logging on port 445

Question 9

Which of the following scenarios best demonstrates why multi-factor authentication (MFA) is superior to password-only authentication?

Accepted Answer

It prevents unauthorized access despite password theft. MFA introduces a secondary requirement that is independent of the password. Even if an attacker obtains the password through phishing, credential stuffing, or a database breach, they cannot gain access without the second factor (like a physical security key or a time-based token). This breaks the single point of failure that exists with password-only systems, rendering stolen credentials useless for unauthorized account access, which is the ultimate goal of the adversary.

Answer

It makes passwords faster to type for users

Answer

It eliminates the need for complex passwords

Answer

It ensures that the password never expires

Question 10

Refer to the exhibit. If an attacker successfully injects into a page, what happens?

Accepted Answer

The browser blocks the script and logs a violation.. The CSP policy explicitly permits only scripts from the application's own origin ('self') and from the trusted CDN. Because the injected inline script does not match these sources, the browser will block its execution. This is a crucial security control because it forces the developer to rely on external files, rendering traditional inline XSS payloads useless. It effectively mitigates the risk by ensuring only scripts from trusted, verified locations can run.

Answer

The script executes successfully.

Answer

The browser executes the script only if the user is an admin.

Answer

The browser automatically strips the script tags.