GCIH Incident Response and Cyber Investigation — Timed 25 Questions

Question 1

An organization experiences a ransomware attack. During the containment phase, the Incident Response team must decide between isolating the affected subnet or shutting down the critical database server. Which factor should be the primary driver for this decision?

25 minute time limit — choose an answer to begin.

Accepted Answer

The business impact of downtime compared to the risk of continued data exfiltration.. Effective incident response requires balancing business continuity with risk mitigation. In this scenario, the team must prioritize evidence preservation and containment effectiveness. Isolating the subnet prevents lateral movement while allowing for forensic imaging without immediate data loss associated with a hard shutdown. Understanding the business impact of each containment action is vital for minimizing downtime while preventing further adversary exploitation during the critical moments of an active intrusion.

Answer

The total estimated cost of the ransom payment requested by the threat actor.

Answer

The volatility of the data residing in the system's volatile memory (RAM).

Answer

The availability of the most recent offline backup for the database server.

Question 2

Which THREE factors should an investigator consider when evaluating the integrity of digital evidence collected during an incident?

Accepted Answer

The use of cryptographically strong hash functions (e.g., SHA-256) at the time of collection.. Evidence integrity is paramount for any forensic investigation. By using hashing, maintaining a strict chain of custody, and documenting the environment, an investigator ensures that the data presented in a report or court is authentic and untampered. Failure to account for these factors can lead to evidence being declared inadmissible or unreliable, undermining the entire investigative process and potentially allowing perpetrators to avoid accountability for their actions.

Answer

The total volume of data in gigabytes compared to the storage capacity.

Answer

The operating system version and kernel patch level of the source system.

Question 3

A GCIH incident handler is responding to a suspected data exfiltration incident on a Linux server. The handler needs to identify which processes are listening on network ports and which files they have open, to determine if a malicious backdoor is present. Which command should the handler use to list all open files and the processes that have them open?

Accepted Answer

`lsof`. The `lsof` command provides a comprehensive list of all open files and the processes that have them open, including network sockets. This allows the handler to see which processes are listening on ports and what files they are accessing, which is crucial for identifying a backdoor. Other commands like `ps` or `netstat` offer partial views but do not combine file and network information in one output.

Answer

`lsof -i`

Answer

`netstat -tulpn`

Answer

`ps aux`

Question 4

A GCIH incident handler is investigating a compromised Windows 10 workstation. The attacker gained access using stolen credentials and then attempted to dump credentials from memory. The handler runs Sysinternals ProcDump with the -ma flag against lsass.exe to capture a full memory dump for analysis. The attempt fails with an 'Access Denied' error. Which of the following is the MOST likely reason for this failure?

Accepted Answer

The handler is not running with the SeDebugPrivilege, which is required to open a handle to the LSASS process with PROCESS_VM_READ access.. To dump LSASS memory, the tool must run with administrative privileges that include SeDebugPrivilege. Without this privilege, the process cannot open LSASS with the necessary access rights, resulting in an access denied error. Credential Guard or PPL protections are not enabled by default and would require prior configuration, making them less likely causes in a typical incident.

Answer

The LSASS process is protected as a Process Light (PPL) and cannot be accessed even by administrators without a signed driver.

Answer

Windows Defender Credential Guard is enabled by default on Windows 10 and blocks all attempts to read LSASS memory.

Answer

The attacker enabled Credential Guard, which virtualizes LSASS and prevents direct memory access by non-protected processes.

Question 5

Which TWO steps are critical during the 'Preparation' phase of the incident response lifecycle to ensure effective forensic investigation during a future security breach?

Accepted Answer

Establishing a centralized logging architecture with immutable storage.. Preparation is the foundation of incident response. By establishing logging infrastructure and legal protocols in advance, an organization ensures that forensic evidence is available and admissible when an incident occurs. Failing to prepare these elements often results in fragmented logs or delayed response actions, which hinders the team's ability to reconstruct the attack timeline accurately and perform root cause analysis after the threat is contained.

Answer

Drafting an incident communication plan for notifying public regulatory bodies.

Answer

Conducting a comprehensive risk assessment of all internal business applications.

Answer

Purchasing cybersecurity insurance to cover potential ransomware payout costs.

Question 6

Refer to the exhibit. An analyst identifies these entries on a critical server. What should the analyst conclude regarding the process associated with PID 4?

Accepted Answer

The process is a legitimate Windows kernel operation for SMB file sharing.. In Windows environments, PID 4 is reserved for the System process. In the context of port 445 (SMB), this is standard behavior for the Server service and kernel-level file sharing. Recognizing legitimate OS behavior is critical to avoid false positives. If the source IPs were unknown or the connection volume was anomalous, further investigation into kernel-mode drivers or rootkits would be required, but this output represents standard file sharing functionality.

Answer

The server is likely compromised by a kernel-mode rootkit acting as a listener.

Answer

A remote adversary is using the SMB protocol to exfiltrate data from the system.

Answer

The system is currently scanning the network for vulnerabilities using SMB exploits.

Question 7

During a digital investigation, an incident responder is asked to preserve memory from a compromised Linux server. Which tool is most appropriate for a forensically sound memory acquisition?

Accepted Answer

LiME (Linux Memory Extractor) to generate an image file for offline analysis.. Forensic acquisition requires tools that do not alter the target system's state or metadata significantly. In Linux, LiME (Linux Memory Extractor) is the standard for generating a memory image while minimizing interference. Understanding tool limitations is critical, as improper collection can destroy volatile data, overwrite evidence, or lead to kernel panics, which would invalidate the integrity of the collected memory dump for subsequent analysis and courtroom admissibility.

Answer

The 'dd' command to copy /dev/mem directly to a remote storage server.

Answer

The 'cat' command to pipe the contents of /proc/kcore into a file.

Answer

Installing a commercial agent to automate the imaging process via a GUI.

Question 8

An organization detects a web-based attack and wants to perform a thorough investigation. Which THREE artifacts should the team collect to analyze the adversary's entry point and activity?

Accepted Answer

HTTP access and error logs from the web server.. Analyzing a web-based attack requires a multi-layered approach. By correlating web server logs, application-level logs, and firewall traffic, investigators can reconstruct the full attack chain from the initial exploit attempt to post-exploitation activity. This holistic view is necessary to verify the entry point, understand the impact, and ensure all malicious persistence mechanisms are identified and removed during the remediation process, preventing the attacker from regaining unauthorized access to the environment.

Answer

System event logs for all workstations in the local network.

Answer

Email gateway logs showing internal-to-external communication patterns.

Question 9

Which phase of the incident response process is most likely to involve the creation of a 'lessons learned' report to improve future security posture?

Accepted Answer

Post-Incident Activity. Post-Incident Activity, often referred to as the 'Lessons Learned' phase, is the final stage of the IR lifecycle. It is essential for organizational growth, allowing the team to reflect on the effectiveness of their response, identify gaps in detection or containment, and update playbooks. This continuous improvement cycle is what differentiates a maturing security program from one that repeats the same mistakes during recurring security incidents.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Question 10

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 11

An incident responder discovers an attacker has established persistence using a Windows 'Run' key. What is the most important first step after identifying the malicious registry entry?

Accepted Answer

Capture the registry state and the associated binary file for analysis.. Identifying the persistence mechanism is only the first step. Before removal, the responder must ensure that evidence is captured, as registry keys can provide valuable data about the attacker's tools and techniques. After imaging the state, the responder must safely remove the entry and then investigate how the attacker initially gained the access required to modify the registry in the first place.

Answer

Immediately delete the registry key to stop the persistence mechanism.

Answer

Reimage the affected workstation to ensure total eradication of the malware.

Answer

Change all user and service account passwords on the local system.

Question 12

During an investigation, you observe an attacker using 'living-off-the-land' (LotL) techniques. Why is it difficult to detect this activity using traditional signature-based antivirus?

Accepted Answer

The tools are trusted binaries and the malicious intent is in the parameters.. Living-off-the-land attacks use legitimate, signed system binaries (like PowerShell, wmic, or certutil) to perform malicious actions. Since the tools themselves are trusted components of the operating system, antivirus software rarely flags them as malicious. Detecting LotL requires behavioral analysis, command-line logging, and monitoring for anomalous execution patterns rather than relying on file signatures, which are ineffective against tools that are inherently part of the system's baseline.

Answer

These binaries are encrypted on the disk, preventing antivirus from scanning them.

Answer

The tools operate entirely in volatile memory and never touch the disk.

Answer

Antivirus software is only capable of detecting malware written in assembly language.

Question 13

You are performing a live response and encounter a suspicious process. Which action should you take FIRST to gather the most intelligence without alerting the adversary or crashing the system?

Accepted Answer

Capture volatile data, including process listings, open handles, and network connections.. In live response, the principle of 'least intrusive first' is paramount. Collecting volatile data (like process lists and network connections) should always precede disk-based forensic imaging. By capturing the state of the system first, you ensure that you obtain the memory-resident artifacts that would be lost upon a reboot or power-down, providing the best foundation for a successful analysis.

Answer

Take a forensic image of the hard drive using a hardware write-blocker.

Answer

Power down the system immediately to preserve the current state.

Answer

Run an antivirus scan to identify and delete the malicious process.

Question 14

Refer to the exhibit. Why might an investigator use the output of 'vssadmin' during a cyber investigation?

Accepted Answer

To recover previous versions of system files and registry hives for analysis.. Volume Shadow Copies are an essential artifact in Windows forensics. They allow an investigator to access older versions of files, including logs, registry hives, and malware binaries that the attacker might have modified or deleted to cover their tracks. By mounting these shadows, an investigator can perform 'time-travel' analysis, recovering evidence that is otherwise invisible on the live file system.

Answer

To identify hidden partitions created by rootkits for persistence.

Answer

To check for unauthorized changes to the system's BIOS/UEFI firmware.

Answer

To list all currently active network sockets on the host.

Question 15

An organization is responding to an Advanced Persistent Threat (APT). During the 'Eradication' phase, why is it critical to go beyond just removing identified malware?

Accepted Answer

Because malware is often just a dropper for a secondary, more complex backdoor.. APT actors are methodical and typically establish multiple persistence mechanisms and backdoors to ensure continued access. If a responder only removes the single piece of malware they found, the attacker can easily pivot back into the network. Eradication must involve comprehensive cleaning, including resetting compromised credentials, closing open vulnerabilities, and auditing the environment to ensure no hidden persistence points remain.

Answer

Because antivirus signatures are always outdated and will miss the actual threat.

Answer

Because the attacker will likely sue the organization if any artifacts remain.

Answer

Because the cleanup process must generate new forensic evidence for police.

Question 16

A GCIH incident handler is investigating a suspected compromise on a Windows 10 workstation. The user reported unusual outbound network connections and sluggish performance. To determine the scope and impact of the incident, the handler must collect volatile evidence first. Which TWO artifacts should the handler prioritize to capture active network connections and running processes before memory is altered or lost? (Choose two.)

Accepted Answer

Output of the `netstat -anob` command. In incident response, volatile data such as active network connections and running processes must be collected first because they are lost when the system is shut down or memory is altered. The `netstat -anob` command provides a snapshot of network connections and associated processes, while `tasklist /v` lists running processes with details. Together, they offer a current view of system activity, enabling the handler to identify malicious processes and their network communications.

Answer

List of scheduled tasks from the Task Scheduler library

Answer

Contents of the Windows Security event log

Answer

Contents of the `C:\Windows\Prefetch` directory

Question 17

During a security incident, a GCIH analyst discovers that an attacker used PowerShell to download and execute a malicious script from a remote server. The analyst wants to determine the full command line and parent process of the PowerShell execution to understand the attack vector. Which Windows artifact should the analyst examine to retrieve this information?

Accepted Answer

Sysmon event ID 1 (Process Create). Sysmon event ID 1 provides comprehensive process creation data, including the full command line and parent process, which are critical for understanding how PowerShell was invoked and what it executed. Other logs either lack command-line detail (Security 4688 by default) or focus on script content (PowerShell 4104) rather than process lineage. Thus, Sysmon is the most appropriate artifact to retrieve the required information.

Answer

PowerShell operational log, event ID 4104

Answer

Windows System event log, event ID 7045

Answer

Windows Security event log, event ID 4688

Question 18

An incident responder is reviewing an IDS alert and needs to determine whether a suspicious executable that ran on a Windows workstation has been seen in other attacks. Which framework should the responder consult to map the observed adversary behavior to known tactics, techniques, and procedures?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is designed specifically to catalog adversary tactics, techniques, and procedures from real-world observations. Mapping the suspicious executable to ATT&CK techniques allows the responder to understand what the binary is doing in terms of known behaviors and which threat actors employ those methods. This supports faster triage, prioritization, and detection engineering.

Answer

NIST SP 800-61

Answer

The Diamond Model of Intrusion Analysis

Answer

The Cyber Kill Chain

Question 19

A SOC analyst receives a report that a workstation is beaconing to an unknown external IP every 60 seconds. The analyst runs netstat -anob and identifies the process responsible. The process is svchost.exe, but the parent process is not services.exe. Which of the following should the analyst do FIRST to determine if this is a malicious injection?

Accepted Answer

Capture a memory dump of the svchost.exe process and examine its loaded modules.. The correct first step is to capture a memory dump of the suspicious svchost.exe process. This preserves volatile evidence like injected code and network connections, allowing the analyst to confirm malicious activity before taking disruptive actions. Terminating the process or running an AV scan may destroy evidence or miss fileless malware, while event logs alone may not show the injection.

Answer

Terminate the svchost.exe process immediately to stop the beaconing.

Answer

Run a full antivirus scan on the workstation to detect and remove the malware.

Answer

Check the Windows Event Log for service creation events around the same time.

Question 20

During an investigation of a compromised Linux web server, an incident responder needs to identify which user account was used to establish an outbound SSH session to an external IP address. Which artifact should the responder examine first?

Accepted Answer

The system authentication log, such as /var/log/auth.log or /var/log/secure. SSH session events are logged by the sshd daemon to the system authentication log, which includes the account name and connection endpoints. Examining /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems gives the responder the user attribution and timing needed. Other artifacts lack the necessary account-to-connection correlation.

Answer

The system's cron job definitions under /etc/cron.d

Answer

The bash command history file for each user under /home

Answer

The kernel ring buffer output from the dmesg command