GCIH Practice Test 9 — 10 Questions

Question 1

An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoke active sessions using IAM boundary conditions and rotate or restrict the attached IAM instance profile role permissions.. Revoking existing session tokens and updating the IAM role trust and permission policies immediately restricts the attacker from leveraging active temporary security credentials. Incident handlers must remember that compromising an instance profile yields immediate access to STS tokens which persist even if the application vulnerability is patched or the instance is stopped without credential invalidation.

Answer

Terminate the compromised EC2 instance immediately to destroy any running malicious processes and volatile memory artifacts.

Answer

Attach a restrictive Network ACL to the subnet to block all inbound and outbound traffic originating from the compromised instance's private IP address.

Answer

Modify the VPC route table to remove the internet gateway route, isolating the entire virtual private cloud from external communication.

Question 2

Refer to the exhibit. An analyst observes this command output on a compromised server. What is the most likely intent of the attacker?

Accepted Answer

Preparing for ransomware deployment by removing backups.. Attackers use `vssadmin` to delete shadow copies, effectively disabling the system's ability to recover files after encryption by ransomware. Detecting this command is a high-fidelity signal of an active ransomware attack or a data destruction event. Incident responders must act immediately upon seeing this, as it indicates the adversary is cleaning up recovery options before deploying their final payload or after exfiltration is complete.

Answer

Listing available files for exfiltration.

Answer

Escalating privileges to the SYSTEM account.

Answer

Cleaning up evidence of previous tool execution.

Question 3

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 4

Which of the following best describes the risk of using 'credential stuffing' against a web application, and how does it differ from a standard dictionary attack?

Accepted Answer

Stuffing tests leaked credentials; dictionary attacks guess passwords. Credential stuffing uses previously leaked username/password pairs from one service to gain unauthorized access to another. It differs from a dictionary attack because it utilizes valid, known credentials rather than guessing passwords. This is highly effective because users often reuse passwords across multiple sites, making it a critical threat to organizations that do not enforce multifactor authentication (MFA) or monitor for logins from unusual locations.

Answer

Dictionary attacks use compromised lists; stuffing uses random passwords

Answer

Dictionary attacks are faster than credential stuffing

Answer

Stuffing targets the database; dictionary attacks target the login

Question 5

Which of the following is a reliable method to detect an adversary using 'WMI Event Subscription' for persistence?

Accepted Answer

Auditing WMI event filters and consumers for anomalies.. WMI event subscriptions allow attackers to trigger malicious code execution upon specific system events, such as system startup or a timer. Because WMI is a legitimate administrative interface, malicious subscriptions are often overlooked. Detection requires auditing WMI repositories for suspicious 'ActiveScriptEventConsumer' or 'CommandLineEventConsumer' entries, which are the primary mechanisms used to run code through the WMI system for long-term persistence.

Answer

Monitoring for new files in the Startup folder.

Answer

Blocking all PowerShell execution at the kernel level.

Answer

Scanning the Windows Registry for Run keys.

Question 6

Which of the following best explains why 'Rainbow Tables' are less effective against modern systems that implement salted hashes?

Accepted Answer

Salts negate the precomputed nature of rainbow tables. Rainbow tables are precomputed tables of hashes for all possible plaintext passwords within a specific character set. By adding a random, per-user salt before hashing, the final hash becomes dependent on both the password and the salt. This means an attacker would need to build a new rainbow table for every unique salt, rendering precomputed tables computationally useless.

Answer

Salting increases the length of the hash, causing buffer overflows

Answer

Salts make the total hash space too large to compute

Answer

Salts slow down the hashing algorithm significantly

Question 7

An analyst detects an outbound connection using a non-standard port that exhibits high-frequency 'jitter'. Which technique best characterizes the nature of this communication?

Accepted Answer

Command and control beaconing with evasion techniques.. Jitter is the deliberate randomization of time intervals between network beacons to evade detection by algorithms looking for fixed-cadence heartbeats. By introducing this variability, attackers make their C2 traffic appear more 'human' or natural. Recognizing this technique is vital for incident handlers because it highlights the sophistication of the C2 infrastructure, requiring advanced statistical analysis beyond simple threshold-based alerts to identify the underlying automated pattern.

Answer

Data exfiltration using high-speed burst transfers.

Answer

Standard web browsing activity during lunch hours.

Answer

Network congestion caused by heavy application traffic.

Question 8

An analyst is reviewing logs and finds multiple failed logins followed by a single successful login from a different IP address, which then executes 'whoami' and 'net user'. What is the most likely scenario?

Accepted Answer

Credential stuffing followed by automated reconnaissance.. This sequence is a classic indicator of credential stuffing or password spraying followed by immediate reconnaissance. The shift from multiple failures (guessing) to a successful login (success) and then immediate discovery commands (post-exploitation) strongly suggests a compromised account being used by an adversary. This pattern is vital to detect early in the kill chain before the attacker moves laterally or achieves persistence within the network environment.

Answer

A user struggling to remember their password.

Answer

A network administrator performing routine maintenance.

Answer

An automated script updating software versions.

Question 9

Which TWO of the following practices are the most effective at mitigating Insecure Direct Object Reference (IDOR) vulnerabilities?

Accepted Answer

Implementing server-side authorization checks for every object access. Mitigating IDOR requires shifting from user-controlled identifiers to server-side access control checks. Relying on unpredictable identifiers makes guessing harder, but verifying identity and authorization for every requested object is the primary defense. These practices ensure that even if an attacker discovers a valid ID, they lack the authorization to perform operations on the underlying data, thereby closing the logical gap that allows unauthorized object access.

Answer

Increasing the length of session tokens

Answer

Employing a Web Application Firewall (WAF)

Answer

Moving all sensitive data to a cloud storage bucket

Question 10

Refer to the exhibit. An attacker attempts to establish persistence by creating a new service. Why did the command fail?

Accepted Answer

The command syntax is incorrect for creating a service.. The 'sc query' command is used to inspect existing services, not to register new ones. The attacker attempted to use the query syntax rather than the 'create' command to define the service. Understanding the proper syntax for service manipulation is critical for incident handlers to identify how attackers attempt to achieve persistence via Windows Service Control Manager or other system-level configuration methods.

Answer

The service has already been deleted by the system.

Answer

The 'sc' command does not support the 'binPath' argument.

Answer

The user lacks sufficient privileges to query services.