GCIH Detecting Exploitation and Covert Communication Tools — Timed 10 Questions

Question 1

An analyst observes a series of outbound HTTPS connections to an unknown external IP address. The connections occur at exact 300-second intervals and maintain a consistent packet size. Which detection strategy is most effective for identifying this potential covert channel?

10 minute time limit — choose an answer to begin.

Accepted Answer

Analyze flow data for rhythmic beaconing patterns and session consistency.. Detecting periodic beacons is best achieved through statistical traffic analysis focusing on temporal regularity. Unlike signature-based detection, which fails against encrypted payloads, entropy and timing analysis identify the non-human pattern of automated heartbeats. This is crucial for incident handlers because command-and-control communication often hides within legitimate protocols, requiring baseline behavioral monitoring to differentiate between legitimate user activity and persistent automated threats.

Answer

Perform deep packet inspection on the encrypted TLS payload.

Answer

Filter outbound traffic based on known malicious domain reputation lists.

Answer

Monitor for anomalous user-agent strings in the HTTP headers.

Question 2

Refer to the exhibit. An analyst identifies this HTTP response during an investigation. Based on the Set-Cookie header content, what tool or technique is potentially being used by the threat actor?

Accepted Answer

JSON Web Token manipulation for privilege escalation. The cookie value is a Base64-encoded JWT (JSON Web Token), a common target for session hijacking or privilege escalation. Incident handlers must recognize these structures as they are often used to store user identity information on the client side. If the signature is weak or missing, attackers can modify the payload to gain administrative access, making this a critical area for detecting unauthorized privilege manipulation within web applications.

Answer

Cross-Site Scripting (XSS) payload delivery

Answer

SQL injection via cookie headers

Answer

DNS tunneling for data exfiltration

Question 3

Which TWO of the following indicators are highly suspicious when analyzing workstation memory for rootkit activity?

Accepted Answer

A process exists in the process list but cannot be found in the task manager.. Rootkits often modify kernel-mode structures or hide processes to maintain persistence. Detecting these requires looking for inconsistencies between system API reports and raw kernel memory analysis. As incident handlers, identifying these discrepancies is vital because it proves the operating system's integrity is compromised, rendering standard tools untrustworthy. Knowing these indicators helps in pivoting from standard analysis to advanced memory forensics.

Answer

Multiple legitimate background services running with high CPU usage.

Answer

Large quantities of temporary files in the user profile directory.

Answer

Increased network latency during peak business hours.

Question 4

Which tool is primarily used for identifying and analyzing covert communication channels by inspecting the timing and entropy of network packets?

Accepted Answer

Wireshark. Tools designed for traffic analysis allow incident handlers to see past simple payload inspection. Entropy analysis reveals the randomness of data, which often indicates encryption or obfuscation, while timing analysis shows the cadence of automated communication. This is vital for detecting sophisticated malware that uses custom protocols or timing intervals to hide its presence from traditional signature-based detection systems in the network.

Answer

Nmap

Answer

Metasploit

Answer

Burp Suite

Question 5

Which THREE of the following are considered hallmarks of steganography when used to hide data in network traffic?

Accepted Answer

High entropy in non-encrypted protocol header fields.. Steganography hides information within seemingly innocuous data, making detection difficult. By identifying these hallmarks, analysts can differentiate between standard protocol behavior and hidden tunnels. This is critical for uncovering data exfiltration or C2 communication that bypasses firewalls and DLP solutions. Understanding these indicators allows handlers to identify anomalies in protocol headers or payloads that are otherwise dismissed as noise.

Answer

Consistent packet headers across all transmitted sessions.

Answer

Frequent use of common protocols like HTTP.

Question 6

Refer to the exhibit. What is the effect of this AWS policy on access to the sensitive-data S3 bucket?

Accepted Answer

It allows access only to users within the 192.168.1.0/24 range.. This policy implements network-based access control, ensuring that only users originating from the specified CIDR block can access the data. This is a critical defensive measure for preventing data exfiltration by unauthorized entities. Incident handlers must understand these policies to determine if a data breach was facilitated by overly permissive IAM policies or if the existing security controls were successfully bypassed by an attacker.

Answer

It allows all users to access the bucket regardless of IP.

Answer

It denies all access to the bucket for all users.

Answer

It blocks access for users within the 192.168.1.0/24 range.

Question 7

An incident responder is investigating a compromised Windows host and suspects the presence of a covert command and control (C2) channel utilizing DNS tunneling. Which TWO registry locations or artifact categories should the analyst examine to identify DNS client cache activity and persistence associated with tunneling software?

Accepted Answer

The DNS Client service cache via PowerShell Get-DnsClientCache. Investigating DNS tunneling requires analyzing both the local DNS client cache to uncover historical malicious domain queries and examining Windows event logs specifically related to DNS client operations. These sources provide verifiable evidence of abnormal query volumes and structural encoding patterns used by tunneling tools.

Answer

SAM registry hive located at System32\config\SAM

Answer

SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key

Answer

NTUSER.DAT registry hive for the currently logged-in user

Question 8

During an incident response engagement on a Linux server, you discover suspicious outbound traffic communicating over raw sockets to an external IP address. The system administrator claims no custom applications are installed. Which utility should you run to inspect the process owning these raw socket file descriptors?

Accepted Answer

Execute lsof -n -P -i 4 -nn to list all open network files and map their socket inodes to active process IDs.. Using lsof with the appropriate flags lists open file descriptors for network sockets, including raw sockets. Incident handlers rely on this capability because malware often bypasses standard TCP/UDP logging by utilizing raw sockets for covert communication channels, making file descriptor inspection essential for uncovering hidden persistence and unauthorized network tunnels on compromised hosts.

Answer

Run netstat -antp to list all established TCP connections and map them to their corresponding process IDs.

Answer

Execute ss -raw to display raw socket statistics and associated socket memory allocation details.

Answer

Run ps auxww to inspect the full command line arguments of all running background system daemons.

Question 9

An incident responder is analyzing a memory dump from a compromised Windows 10 host. The responder suspects a rootkit is hiding a malicious driver. Which Volatility 3 plugin should be used to list loaded kernel modules and detect unlinked or hidden drivers?

Accepted Answer

windows.modules. In Volatility 3, the windows.modules plugin is designed to list loaded kernel modules and can identify hidden or unlinked drivers by comparing the module list with memory pool scans. This makes it the appropriate tool for detecting a rootkit that hides a malicious driver.

Answer

windows.callbacks

Answer

windows.driverscan

Answer

windows.ssdt

Question 10

An incident responder is examining a Windows workstation suspected of being part of a botnet. Network logs show periodic DNS queries for long, random-looking subdomains under the domain 'evil-c2.com'. The queries occur every 60 seconds. Which technique is the attacker most likely using?

Accepted Answer

Domain generation algorithm (DGA). The correct answer is domain generation algorithm (DGA). The scenario shows a compromised host making periodic DNS queries for random-looking subdomains under a single domain. This is a classic DGA pattern where malware generates many domain names to locate its C2 server, making it difficult for defenders to block the C2 domain. The regular 60-second interval suggests automated beaconing.

Answer

DNS cache poisoning

Answer

Fast flux DNS

Answer

DNS tunneling