GCIH Incident Response and Cyber Investigation — 15 Questions

Question 1

An organization experiences a ransomware attack. During the containment phase, the Incident Response team must decide between isolating the affected subnet or shutting down the critical database server. Which factor should be the primary driver for this decision?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The business impact of downtime compared to the risk of continued data exfiltration.. Effective incident response requires balancing business continuity with risk mitigation. In this scenario, the team must prioritize evidence preservation and containment effectiveness. Isolating the subnet prevents lateral movement while allowing for forensic imaging without immediate data loss associated with a hard shutdown. Understanding the business impact of each containment action is vital for minimizing downtime while preventing further adversary exploitation during the critical moments of an active intrusion.

Answer

The total estimated cost of the ransom payment requested by the threat actor.

Answer

The volatility of the data residing in the system's volatile memory (RAM).

Answer

The availability of the most recent offline backup for the database server.

Question 2

Which THREE factors should an investigator consider when evaluating the integrity of digital evidence collected during an incident?

Accepted Answer

The use of cryptographically strong hash functions (e.g., SHA-256) at the time of collection.. Evidence integrity is paramount for any forensic investigation. By using hashing, maintaining a strict chain of custody, and documenting the environment, an investigator ensures that the data presented in a report or court is authentic and untampered. Failure to account for these factors can lead to evidence being declared inadmissible or unreliable, undermining the entire investigative process and potentially allowing perpetrators to avoid accountability for their actions.

Answer

The total volume of data in gigabytes compared to the storage capacity.

Answer

The operating system version and kernel patch level of the source system.

Question 3

A GCIH incident handler is responding to a suspected data exfiltration incident on a Linux server. The handler needs to identify which processes are listening on network ports and which files they have open, to determine if a malicious backdoor is present. Which command should the handler use to list all open files and the processes that have them open?

Accepted Answer

`lsof`. The `lsof` command provides a comprehensive list of all open files and the processes that have them open, including network sockets. This allows the handler to see which processes are listening on ports and what files they are accessing, which is crucial for identifying a backdoor. Other commands like `ps` or `netstat` offer partial views but do not combine file and network information in one output.

Answer

`lsof -i`

Answer

`netstat -tulpn`

Answer

`ps aux`

Question 4

A GCIH incident handler is investigating a compromised Windows 10 workstation. The attacker gained access using stolen credentials and then attempted to dump credentials from memory. The handler runs Sysinternals ProcDump with the -ma flag against lsass.exe to capture a full memory dump for analysis. The attempt fails with an 'Access Denied' error. Which of the following is the MOST likely reason for this failure?

Accepted Answer

The handler is not running with the SeDebugPrivilege, which is required to open a handle to the LSASS process with PROCESS_VM_READ access.. To dump LSASS memory, the tool must run with administrative privileges that include SeDebugPrivilege. Without this privilege, the process cannot open LSASS with the necessary access rights, resulting in an access denied error. Credential Guard or PPL protections are not enabled by default and would require prior configuration, making them less likely causes in a typical incident.

Answer

The LSASS process is protected as a Process Light (PPL) and cannot be accessed even by administrators without a signed driver.

Answer

Windows Defender Credential Guard is enabled by default on Windows 10 and blocks all attempts to read LSASS memory.

Answer

The attacker enabled Credential Guard, which virtualizes LSASS and prevents direct memory access by non-protected processes.

Question 5

Which TWO steps are critical during the 'Preparation' phase of the incident response lifecycle to ensure effective forensic investigation during a future security breach?

Accepted Answer

Establishing a centralized logging architecture with immutable storage.. Preparation is the foundation of incident response. By establishing logging infrastructure and legal protocols in advance, an organization ensures that forensic evidence is available and admissible when an incident occurs. Failing to prepare these elements often results in fragmented logs or delayed response actions, which hinders the team's ability to reconstruct the attack timeline accurately and perform root cause analysis after the threat is contained.

Answer

Drafting an incident communication plan for notifying public regulatory bodies.

Answer

Conducting a comprehensive risk assessment of all internal business applications.

Answer

Purchasing cybersecurity insurance to cover potential ransomware payout costs.

Question 6

Refer to the exhibit. An analyst identifies these entries on a critical server. What should the analyst conclude regarding the process associated with PID 4?

Accepted Answer

The process is a legitimate Windows kernel operation for SMB file sharing.. In Windows environments, PID 4 is reserved for the System process. In the context of port 445 (SMB), this is standard behavior for the Server service and kernel-level file sharing. Recognizing legitimate OS behavior is critical to avoid false positives. If the source IPs were unknown or the connection volume was anomalous, further investigation into kernel-mode drivers or rootkits would be required, but this output represents standard file sharing functionality.

Answer

The server is likely compromised by a kernel-mode rootkit acting as a listener.

Answer

A remote adversary is using the SMB protocol to exfiltrate data from the system.

Answer

The system is currently scanning the network for vulnerabilities using SMB exploits.

Question 7

During a digital investigation, an incident responder is asked to preserve memory from a compromised Linux server. Which tool is most appropriate for a forensically sound memory acquisition?

Accepted Answer

LiME (Linux Memory Extractor) to generate an image file for offline analysis.. Forensic acquisition requires tools that do not alter the target system's state or metadata significantly. In Linux, LiME (Linux Memory Extractor) is the standard for generating a memory image while minimizing interference. Understanding tool limitations is critical, as improper collection can destroy volatile data, overwrite evidence, or lead to kernel panics, which would invalidate the integrity of the collected memory dump for subsequent analysis and courtroom admissibility.

Answer

The 'dd' command to copy /dev/mem directly to a remote storage server.

Answer

The 'cat' command to pipe the contents of /proc/kcore into a file.

Answer

Installing a commercial agent to automate the imaging process via a GUI.

Question 8

An organization detects a web-based attack and wants to perform a thorough investigation. Which THREE artifacts should the team collect to analyze the adversary's entry point and activity?

Accepted Answer

HTTP access and error logs from the web server.. Analyzing a web-based attack requires a multi-layered approach. By correlating web server logs, application-level logs, and firewall traffic, investigators can reconstruct the full attack chain from the initial exploit attempt to post-exploitation activity. This holistic view is necessary to verify the entry point, understand the impact, and ensure all malicious persistence mechanisms are identified and removed during the remediation process, preventing the attacker from regaining unauthorized access to the environment.

Answer

System event logs for all workstations in the local network.

Answer

Email gateway logs showing internal-to-external communication patterns.

Question 9

Which phase of the incident response process is most likely to involve the creation of a 'lessons learned' report to improve future security posture?

Accepted Answer

Post-Incident Activity. Post-Incident Activity, often referred to as the 'Lessons Learned' phase, is the final stage of the IR lifecycle. It is essential for organizational growth, allowing the team to reflect on the effectiveness of their response, identify gaps in detection or containment, and update playbooks. This continuous improvement cycle is what differentiates a maturing security program from one that repeats the same mistakes during recurring security incidents.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Question 10

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 11

An incident responder discovers an attacker has established persistence using a Windows 'Run' key. What is the most important first step after identifying the malicious registry entry?

Accepted Answer

Capture the registry state and the associated binary file for analysis.. Identifying the persistence mechanism is only the first step. Before removal, the responder must ensure that evidence is captured, as registry keys can provide valuable data about the attacker's tools and techniques. After imaging the state, the responder must safely remove the entry and then investigate how the attacker initially gained the access required to modify the registry in the first place.

Answer

Immediately delete the registry key to stop the persistence mechanism.

Answer

Reimage the affected workstation to ensure total eradication of the malware.

Answer

Change all user and service account passwords on the local system.

Question 12

During an investigation, you observe an attacker using 'living-off-the-land' (LotL) techniques. Why is it difficult to detect this activity using traditional signature-based antivirus?

Accepted Answer

The tools are trusted binaries and the malicious intent is in the parameters.. Living-off-the-land attacks use legitimate, signed system binaries (like PowerShell, wmic, or certutil) to perform malicious actions. Since the tools themselves are trusted components of the operating system, antivirus software rarely flags them as malicious. Detecting LotL requires behavioral analysis, command-line logging, and monitoring for anomalous execution patterns rather than relying on file signatures, which are ineffective against tools that are inherently part of the system's baseline.

Answer

These binaries are encrypted on the disk, preventing antivirus from scanning them.

Answer

The tools operate entirely in volatile memory and never touch the disk.

Answer

Antivirus software is only capable of detecting malware written in assembly language.

Question 13

You are performing a live response and encounter a suspicious process. Which action should you take FIRST to gather the most intelligence without alerting the adversary or crashing the system?

Accepted Answer

Capture volatile data, including process listings, open handles, and network connections.. In live response, the principle of 'least intrusive first' is paramount. Collecting volatile data (like process lists and network connections) should always precede disk-based forensic imaging. By capturing the state of the system first, you ensure that you obtain the memory-resident artifacts that would be lost upon a reboot or power-down, providing the best foundation for a successful analysis.

Answer

Take a forensic image of the hard drive using a hardware write-blocker.

Answer

Power down the system immediately to preserve the current state.

Answer

Run an antivirus scan to identify and delete the malicious process.

Question 14

Refer to the exhibit. Why might an investigator use the output of 'vssadmin' during a cyber investigation?

Accepted Answer

To recover previous versions of system files and registry hives for analysis.. Volume Shadow Copies are an essential artifact in Windows forensics. They allow an investigator to access older versions of files, including logs, registry hives, and malware binaries that the attacker might have modified or deleted to cover their tracks. By mounting these shadows, an investigator can perform 'time-travel' analysis, recovering evidence that is otherwise invisible on the live file system.

Answer

To identify hidden partitions created by rootkits for persistence.

Answer

To check for unauthorized changes to the system's BIOS/UEFI firmware.

Answer

To list all currently active network sockets on the host.

Question 15

An organization is responding to an Advanced Persistent Threat (APT). During the 'Eradication' phase, why is it critical to go beyond just removing identified malware?

Accepted Answer

Because malware is often just a dropper for a secondary, more complex backdoor.. APT actors are methodical and typically establish multiple persistence mechanisms and backdoors to ensure continued access. If a responder only removes the single piece of malware they found, the attacker can easily pivot back into the network. Eradication must involve comprehensive cleaning, including resetting compromised credentials, closing open vulnerabilities, and auditing the environment to ensure no hidden persistence points remain.

Answer

Because antivirus signatures are always outdated and will miss the actual threat.

Answer

Because the attacker will likely sue the organization if any artifacts remain.

Answer

Because the cleanup process must generate new forensic evidence for police.