GCIH Detecting Exploitation and Covert Communication Tools — All Questions With Answers

Question 1

An analyst observes a series of outbound HTTPS connections to an unknown external IP address. The connections occur at exact 300-second intervals and maintain a consistent packet size. Which detection strategy is most effective for identifying this potential covert channel?

Accepted Answer

Analyze flow data for rhythmic beaconing patterns and session consistency.. Detecting periodic beacons is best achieved through statistical traffic analysis focusing on temporal regularity. Unlike signature-based detection, which fails against encrypted payloads, entropy and timing analysis identify the non-human pattern of automated heartbeats. This is crucial for incident handlers because command-and-control communication often hides within legitimate protocols, requiring baseline behavioral monitoring to differentiate between legitimate user activity and persistent automated threats.

Answer

Perform deep packet inspection on the encrypted TLS payload.

Answer

Filter outbound traffic based on known malicious domain reputation lists.

Answer

Monitor for anomalous user-agent strings in the HTTP headers.

Question 2

Refer to the exhibit. An analyst identifies this HTTP response during an investigation. Based on the Set-Cookie header content, what tool or technique is potentially being used by the threat actor?

Accepted Answer

JSON Web Token manipulation for privilege escalation. The cookie value is a Base64-encoded JWT (JSON Web Token), a common target for session hijacking or privilege escalation. Incident handlers must recognize these structures as they are often used to store user identity information on the client side. If the signature is weak or missing, attackers can modify the payload to gain administrative access, making this a critical area for detecting unauthorized privilege manipulation within web applications.

Answer

Cross-Site Scripting (XSS) payload delivery

Answer

SQL injection via cookie headers

Answer

DNS tunneling for data exfiltration

Question 3

Which TWO of the following indicators are highly suspicious when analyzing workstation memory for rootkit activity?

Accepted Answer

A process exists in the process list but cannot be found in the task manager.. Rootkits often modify kernel-mode structures or hide processes to maintain persistence. Detecting these requires looking for inconsistencies between system API reports and raw kernel memory analysis. As incident handlers, identifying these discrepancies is vital because it proves the operating system's integrity is compromised, rendering standard tools untrustworthy. Knowing these indicators helps in pivoting from standard analysis to advanced memory forensics.

Answer

Multiple legitimate background services running with high CPU usage.

Answer

Large quantities of temporary files in the user profile directory.

Answer

Increased network latency during peak business hours.

Question 4

Which tool is primarily used for identifying and analyzing covert communication channels by inspecting the timing and entropy of network packets?

Accepted Answer

Wireshark. Tools designed for traffic analysis allow incident handlers to see past simple payload inspection. Entropy analysis reveals the randomness of data, which often indicates encryption or obfuscation, while timing analysis shows the cadence of automated communication. This is vital for detecting sophisticated malware that uses custom protocols or timing intervals to hide its presence from traditional signature-based detection systems in the network.

Answer

Nmap

Answer

Metasploit

Answer

Burp Suite

Question 5

Which THREE of the following are considered hallmarks of steganography when used to hide data in network traffic?

Accepted Answer

High entropy in non-encrypted protocol header fields.. Steganography hides information within seemingly innocuous data, making detection difficult. By identifying these hallmarks, analysts can differentiate between standard protocol behavior and hidden tunnels. This is critical for uncovering data exfiltration or C2 communication that bypasses firewalls and DLP solutions. Understanding these indicators allows handlers to identify anomalies in protocol headers or payloads that are otherwise dismissed as noise.

Answer

Consistent packet headers across all transmitted sessions.

Answer

Frequent use of common protocols like HTTP.

Question 6

Refer to the exhibit. What is the effect of this AWS policy on access to the sensitive-data S3 bucket?

Accepted Answer

It allows access only to users within the 192.168.1.0/24 range.. This policy implements network-based access control, ensuring that only users originating from the specified CIDR block can access the data. This is a critical defensive measure for preventing data exfiltration by unauthorized entities. Incident handlers must understand these policies to determine if a data breach was facilitated by overly permissive IAM policies or if the existing security controls were successfully bypassed by an attacker.

Answer

It allows all users to access the bucket regardless of IP.

Answer

It denies all access to the bucket for all users.

Answer

It blocks access for users within the 192.168.1.0/24 range.

Question 7

An incident responder is investigating a compromised Windows host and suspects the presence of a covert command and control (C2) channel utilizing DNS tunneling. Which TWO registry locations or artifact categories should the analyst examine to identify DNS client cache activity and persistence associated with tunneling software?

Accepted Answer

The DNS Client service cache via PowerShell Get-DnsClientCache. Investigating DNS tunneling requires analyzing both the local DNS client cache to uncover historical malicious domain queries and examining Windows event logs specifically related to DNS client operations. These sources provide verifiable evidence of abnormal query volumes and structural encoding patterns used by tunneling tools.

Answer

SAM registry hive located at System32\config\SAM

Answer

SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key

Answer

NTUSER.DAT registry hive for the currently logged-in user

Question 8

During an incident response engagement on a Linux server, you discover suspicious outbound traffic communicating over raw sockets to an external IP address. The system administrator claims no custom applications are installed. Which utility should you run to inspect the process owning these raw socket file descriptors?

Accepted Answer

Execute lsof -n -P -i 4 -nn to list all open network files and map their socket inodes to active process IDs.. Using lsof with the appropriate flags lists open file descriptors for network sockets, including raw sockets. Incident handlers rely on this capability because malware often bypasses standard TCP/UDP logging by utilizing raw sockets for covert communication channels, making file descriptor inspection essential for uncovering hidden persistence and unauthorized network tunnels on compromised hosts.

Answer

Run netstat -antp to list all established TCP connections and map them to their corresponding process IDs.

Answer

Execute ss -raw to display raw socket statistics and associated socket memory allocation details.

Answer

Run ps auxww to inspect the full command line arguments of all running background system daemons.

Question 9

An incident responder is analyzing a memory dump from a compromised Windows 10 host. The responder suspects a rootkit is hiding a malicious driver. Which Volatility 3 plugin should be used to list loaded kernel modules and detect unlinked or hidden drivers?

Accepted Answer

windows.modules. In Volatility 3, the windows.modules plugin is designed to list loaded kernel modules and can identify hidden or unlinked drivers by comparing the module list with memory pool scans. This makes it the appropriate tool for detecting a rootkit that hides a malicious driver.

Answer

windows.callbacks

Answer

windows.driverscan

Answer

windows.ssdt

Question 10

An incident responder is examining a Windows workstation suspected of being part of a botnet. Network logs show periodic DNS queries for long, random-looking subdomains under the domain 'evil-c2.com'. The queries occur every 60 seconds. Which technique is the attacker most likely using?

Accepted Answer

Domain generation algorithm (DGA). The correct answer is domain generation algorithm (DGA). The scenario shows a compromised host making periodic DNS queries for random-looking subdomains under a single domain. This is a classic DGA pattern where malware generates many domain names to locate its C2 server, making it difficult for defenders to block the C2 domain. The regular 60-second interval suggests automated beaconing.

Answer

DNS cache poisoning

Answer

Fast flux DNS

Answer

DNS tunneling

Question 11

A security analyst notices that a user's workstation is communicating with an external IP address on port 53, but the traffic is not standard DNS. The packets are larger than typical DNS queries and contain binary data. Which type of covert channel is most likely being used?

Accepted Answer

DNS tunneling. The traffic on port 53 with large packets and binary data is most consistent with DNS tunneling. Attackers use DNS tunneling to exfiltrate data or establish command and control because DNS is often allowed through firewalls. The binary data is encoded into DNS queries and responses.

Answer

SSH tunneling

Answer

HTTP tunneling

Answer

ICMP tunneling

Question 12

An incident responder is investigating a suspected covert channel on a Linux server. The responder observes outbound traffic that uses the TCP protocol but does not match any known application signatures. The traffic is encrypted and sent to an external IP address on port 443. Which two indicators would suggest that this is a covert channel established by a tool like Cobalt Strike? (Choose two.)

Accepted Answer

The traffic exhibits regular beaconing intervals with jitter.. Cobalt Strike's HTTPS beacon typically uses regular beaconing with jitter and often employs a self-signed certificate. These two indicators, when combined with encrypted traffic to an external IP on port 443, strongly suggest a covert channel. Other options are either not typical of Cobalt Strike or too generic to be reliable indicators.

Answer

The traffic is sent to a known cloud service IP address.

Answer

The traffic uses the UDP protocol on port 443.

Answer

The traffic contains HTTP GET requests with long, random-looking URIs.

Question 13

An incident responder is analyzing a Linux server that is suspected of being compromised. The server is exhibiting unusual outbound network traffic. Which TWO of the following commands would be most useful to identify processes that have established network connections? (Choose two.)

Accepted Answer

lsof -i. The correct answers are ss -tup and lsof -i. Both commands provide a mapping between network connections and the processes that own them. ss is a modern replacement for netstat and shows established connections with process information. lsof -i lists network sockets and their owning processes. Together, they allow an incident responder to quickly identify suspicious processes communicating over the network.

Answer

ifconfig -a

Answer

ps aux

Answer

netstat -tulpn

Question 14

An incident responder is examining a memory dump from a compromised Windows host. The responder suspects that an attacker used a reflective DLL injection technique to load a malicious payload. Which artifact in memory would best confirm this?

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE permissions that contains a PE header. The correct answer is a memory region with PAGE_EXECUTE_READWRITE permissions that contains a PE header. Reflective DLL injection maps a DLL into memory without using the Windows loader, often resulting in executable memory regions that contain a PE header. This is a strong indicator of the technique. Other options may indicate injection but are not as specific to reflective loading.

Answer

An entry in the PEB's InLoadOrderModuleList for a DLL that does not exist on disk

Answer

A thread that is not associated with any known module

Answer

A DLL with a suspicious name loaded from a non-standard path

Question 15

An adversary uses PowerShell to establish a reverse shell. The command includes the '-EncodedCommand' flag with a long Base64 string. What is the most effective way to detect this activity without relying on static command signatures?

Accepted Answer

Enable PowerShell Script Block Logging to capture de-obfuscated code.. Static signatures fail against randomized Base64 encoding. Behavioral detection, specifically script block logging, captures the de-obfuscated code before execution. This is essential for incident handlers because attackers frequently use obfuscation to bypass simple keyword filters. Script block logging provides the exact command executed in memory, allowing for accurate analysis of the intent regardless of the obfuscation technique employed by the attacker.

Answer

Block all outbound connections originating from PowerShell processes.

Answer

Monitor for any usage of the 'powershell.exe' process in logs.

Answer

Perform string analysis on all files in the system directories.

Question 16

Refer to the exhibit. An analyst observes this command output on a compromised server. What is the most likely intent of the attacker?

Accepted Answer

Preparing for ransomware deployment by removing backups.. Attackers use `vssadmin` to delete shadow copies, effectively disabling the system's ability to recover files after encryption by ransomware. Detecting this command is a high-fidelity signal of an active ransomware attack or a data destruction event. Incident responders must act immediately upon seeing this, as it indicates the adversary is cleaning up recovery options before deploying their final payload or after exfiltration is complete.

Answer

Listing available files for exfiltration.

Answer

Escalating privileges to the SYSTEM account.

Answer

Cleaning up evidence of previous tool execution.

Question 17

An analyst detects an outbound connection using a non-standard port that exhibits high-frequency 'jitter'. Which technique best characterizes the nature of this communication?

Accepted Answer

Command and control beaconing with evasion techniques.. Jitter is the deliberate randomization of time intervals between network beacons to evade detection by algorithms looking for fixed-cadence heartbeats. By introducing this variability, attackers make their C2 traffic appear more 'human' or natural. Recognizing this technique is vital for incident handlers because it highlights the sophistication of the C2 infrastructure, requiring advanced statistical analysis beyond simple threshold-based alerts to identify the underlying automated pattern.

Answer

Data exfiltration using high-speed burst transfers.

Answer

Standard web browsing activity during lunch hours.

Answer

Network congestion caused by heavy application traffic.

Question 18

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

Accepted Answer

To detect anomalies in process lineage and execution context.. PPID analysis reveals the execution chain, which is often a major red flag for malicious activity. For example, a web server process spawning a shell is highly suspicious. Understanding these relationships allows incident handlers to detect process hollowing and injection attacks. This context is essential because it distinguishes between legitimate system operations and adversarial techniques designed to blend into the system's normal process hierarchy.

Answer

To identify which user account initiated the malicious activity.

Answer

To determine the file creation date on the disk.

Answer

To ensure the process is running with administrative privileges.

Question 19

An analyst is reviewing logs and finds multiple failed logins followed by a single successful login from a different IP address, which then executes 'whoami' and 'net user'. What is the most likely scenario?

Accepted Answer

Credential stuffing followed by automated reconnaissance.. This sequence is a classic indicator of credential stuffing or password spraying followed by immediate reconnaissance. The shift from multiple failures (guessing) to a successful login (success) and then immediate discovery commands (post-exploitation) strongly suggests a compromised account being used by an adversary. This pattern is vital to detect early in the kill chain before the attacker moves laterally or achieves persistence within the network environment.

Answer

A user struggling to remember their password.

Answer

A network administrator performing routine maintenance.

Answer

An automated script updating software versions.

Question 20

Which THREE actions are effective at identifying hidden 'living-off-the-land' (LotL) binary usage in a compromised system?

Accepted Answer

Reviewing command-line argument logs for suspicious flags.. LotL attacks use legitimate tools like WMI, PowerShell, and certutil to perform malicious actions, making them difficult to detect. Since the binaries are trusted, defenders must look for suspicious execution contexts, unusual parameters, or non-standard parent processes. This is critical because attackers use these techniques to bypass signature-based endpoint protection, requiring behavioral analysis to uncover the unauthorized activity within the noise of standard system management tasks.

Answer

Scanning the disk for all instances of binary files.

Answer

Restricting all user permissions to local system accounts.

GCIH Detecting Exploitation and Covert Communication Tools — All Questions With Answers

An analyst observes a series of outbound HTTPS connections to an unknown external IP address. The connections occur at exact 300-second intervals and maintain a consistent packet size. Which detection strategy is most effective for identifying this potential covert channel?

Refer to the exhibit. An analyst identifies this HTTP response during an investigation. Based on the Set-Cookie header content, what tool or technique is potentially being used by the threat actor?

Exhibit

Which TWO of the following indicators are highly suspicious when analyzing workstation memory for rootkit activity?

Which tool is primarily used for identifying and analyzing covert communication channels by inspecting the timing and entropy of network packets?

Which THREE of the following are considered hallmarks of steganography when used to hide data in network traffic?

Refer to the exhibit. What is the effect of this AWS policy on access to the sensitive-data S3 bucket?

Exhibit

An incident responder is analyzing a memory dump from a compromised Windows 10 host. The responder suspects a rootkit is hiding a malicious driver. Which Volatility 3 plugin should be used to list loaded kernel modules and detect unlinked or hidden drivers?

An incident responder is examining a Windows workstation suspected of being part of a botnet. Network logs show periodic DNS queries for long, random-looking subdomains under the domain 'evil-c2.com'. The queries occur every 60 seconds. Which technique is the attacker most likely using?

A security analyst notices that a user's workstation is communicating with an external IP address on port 53, but the traffic is not standard DNS. The packets are larger than typical DNS queries and contain binary data. Which type of covert channel is most likely being used?

An incident responder is analyzing a Linux server that is suspected of being compromised. The server is exhibiting unusual outbound network traffic. Which TWO of the following commands would be most useful to identify processes that have established network connections? (Choose two.)

An incident responder is examining a memory dump from a compromised Windows host. The responder suspects that an attacker used a reflective DLL injection technique to load a malicious payload. Which artifact in memory would best confirm this?

An adversary uses PowerShell to establish a reverse shell. The command includes the '-EncodedCommand' flag with a long Base64 string. What is the most effective way to detect this activity without relying on static command signatures?

Refer to the exhibit. An analyst observes this command output on a compromised server. What is the most likely intent of the attacker?

Exhibit

An analyst detects an outbound connection using a non-standard port that exhibits high-frequency 'jitter'. Which technique best characterizes the nature of this communication?

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

An analyst is reviewing logs and finds multiple failed logins followed by a single successful login from a different IP address, which then executes 'whoami' and 'net user'. What is the most likely scenario?

Which THREE actions are effective at identifying hidden 'living-off-the-land' (LotL) binary usage in a compromised system?

An analyst discovers a malicious DLL file in a system directory. What is the most effective way to identify which process loaded this DLL into memory?

During incident response, you observe that a compromised host is sending ICMP echo request packets with a payload size of 1000 bytes to an external IP. The payload appears to contain non-printable characters. What is the most likely explanation?

GCIH Detecting Exploitation and Covert Communication Tools — All Questions With Answers

An analyst observes a series of outbound HTTPS connections to an unknown external IP address. The connections occur at exact 300-second intervals and maintain a consistent packet size. Which detection strategy is most effective for identifying this potential covert channel?

Refer to the exhibit. An analyst identifies this HTTP response during an investigation. Based on the Set-Cookie header content, what tool or technique is potentially being used by the threat actor?

Exhibit

Which TWO of the following indicators are highly suspicious when analyzing workstation memory for rootkit activity?

Which tool is primarily used for identifying and analyzing covert communication channels by inspecting the timing and entropy of network packets?

Which THREE of the following are considered hallmarks of steganography when used to hide data in network traffic?

Refer to the exhibit. What is the effect of this AWS policy on access to the sensitive-data S3 bucket?

Exhibit

An incident responder is analyzing a memory dump from a compromised Windows 10 host. The responder suspects a rootkit is hiding a malicious driver. Which Volatility 3 plugin should be used to list loaded kernel modules and detect unlinked or hidden drivers?

An incident responder is examining a Windows workstation suspected of being part of a botnet. Network logs show periodic DNS queries for long, random-looking subdomains under the domain 'evil-c2.com'. The queries occur every 60 seconds. Which technique is the attacker most likely using?

A security analyst notices that a user's workstation is communicating with an external IP address on port 53, but the traffic is not standard DNS. The packets are larger than typical DNS queries and contain binary data. Which type of covert channel is most likely being used?

An incident responder is analyzing a Linux server that is suspected of being compromised. The server is exhibiting unusual outbound network traffic. Which TWO of the following commands would be most useful to identify processes that have established network connections? (Choose two.)

An incident responder is examining a memory dump from a compromised Windows host. The responder suspects that an attacker used a reflective DLL injection technique to load a malicious payload. Which artifact in memory would best confirm this?

An adversary uses PowerShell to establish a reverse shell. The command includes the '-EncodedCommand' flag with a long Base64 string. What is the most effective way to detect this activity without relying on static command signatures?

Refer to the exhibit. An analyst observes this command output on a compromised server. What is the most likely intent of the attacker?

Exhibit

An analyst detects an outbound connection using a non-standard port that exhibits high-frequency 'jitter'. Which technique best characterizes the nature of this communication?

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

An analyst is reviewing logs and finds multiple failed logins followed by a single successful login from a different IP address, which then executes 'whoami' and 'net user'. What is the most likely scenario?

Which THREE actions are effective at identifying hidden 'living-off-the-land' (LotL) binary usage in a compromised system?

An analyst discovers a malicious DLL file in a system directory. What is the most effective way to identify which process loaded this DLL into memory?

During incident response, you observe that a compromised host is sending ICMP echo request packets with a payload size of 1000 bytes to an external IP. The payload appears to contain non-printable characters. What is the most likely explanation?