GCIH Multiple Select — 20 Questions

Question 1

Which TWO of the following are primary security risks associated with the SMBv1 protocol in a modern Windows environment?

Accepted Answer

Susceptibility to remote code execution via EternalBlue. SMBv1 is an archaic protocol that lacks modern security features, making it a critical target for attackers. Its primary risks include vulnerability to well-known remote code execution exploits like EternalBlue and its susceptibility to man-in-the-middle attacks due to weak or absent integrity checks. Understanding these risks is vital for incident handlers to prioritize the deprecation of legacy protocols, which are often the primary entry points for ransomware and lateral movement.

Answer

Inability to support Kerberos authentication

Answer

Lack of support for SMB message signing

Answer

Incompatibility with NTFS permissions

Question 2

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

Accepted Answer

Continuous ingestion of high-quality, normalized telemetry data.. Effective malware hunting requires a combination of strong data hygiene, human intuition, and robust analytical loops. AI provides the speed and pattern recognition necessary to handle large volumes of data, but it requires carefully curated inputs and human oversight to remain effective. These components are essential because they ensure that hunting efforts are scalable, reproducible, and aligned with the actual behavioral patterns observed during the adversary's lifecycle within the enterprise environment.

Answer

Eliminating all manual review to maximize the hunting speed.

Answer

Focusing exclusively on known malware signatures for speed.

Question 3

An analyst is investigating a suspected Pass-the-Hash attack within an Active Directory environment. Which TWO Windows Security Event Log IDs should the analyst examine to detect the use of stolen NTLM credential material for lateral movement? (Choose TWO)

Accepted Answer

Event ID 4624 (An account was successfully logged on). Event ID 4624 records successful logons, and specifying Logon Type 3 (Network) combined with NTLM authentication indicates a potential Pass-the-Hash event when originating from an unusual source. Event ID 4672 details special privileges assigned to new logins, helping verify if the compromised security context obtained administrative privileges across the domain.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4720 (A user account was created)

Answer

Event ID 1102 (The audit log was cleared)

Question 4

Which TWO of the following are common indicators that a password database has been compromised?

Accepted Answer

A high volume of account takeover reports. Detecting a password database compromise often involves monitoring for unusual database activity or indicators of downstream misuse. A sudden spike in failed login attempts across many accounts (credential stuffing) or an influx of reports from users about account takeovers on unrelated services are classic red flags. These events suggest that the attacker is leveraging stolen hashes to gain unauthorized access elsewhere, making these observations critical for triggering incident response procedures for a potential database breach.

Answer

Increased server CPU usage during off-hours

Answer

A change in the local system time on the server

Answer

An increase in valid user password reset requests

Question 5

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 6

An analyst is investigating potential data exfiltration via DNS tunneling. Which TWO of the following indicators would most strongly suggest this activity is occurring?

Accepted Answer

A sudden increase in DNS TXT record requests. DNS tunneling uses DNS queries to encapsulate non-DNS traffic, bypassing standard firewalls. Detecting this requires looking for abnormal patterns in traffic volume and request frequency. By identifying unusually long subdomains or high volumes of TXT/NULL record types, analysts can pinpoint covert channels. This is critical for detecting C2 traffic that hides in plain sight within common, often permitted, network protocols.

Answer

High volumes of HTTP GET requests to internal IPs

Answer

Frequent ICMP echo requests from the perimeter

Answer

TCP SYN floods targeting the local gateway

Question 7

An incident responder is investigating a suspected SMB relay attack on a corporate network. The attacker has compromised a workstation and is attempting to relay authentication to a domain controller. Which TWO of the following conditions are necessary for a successful SMB relay attack? (Choose two.)

Accepted Answer

SMB signing must be disabled or not required on the target server.. The correct answers are that SMB signing must be disabled or not required on the target server, and the victim's NTLM authentication must be relayed to a server that accepts NTLM. These conditions allow the attacker to forward authentication without detection. The other options are not necessary: valid credentials are not needed, physical access is not required, and SMB 1.0 is not a prerequisite.

Answer

The target server must be running SMB 1.0.

Answer

The attacker must have valid domain credentials for the target server.

Answer

The attacker must have physical access to the victim's workstation.

Question 8

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 9

Which TWO of the following are considered best practices for password hashing to mitigate offline cracking?

Accepted Answer

Use a unique, random salt for every user. Modern password storage must prioritize computational cost and uniqueness. Using a per-user salt ensures that even identical passwords result in different hashes, preventing rainbow table attacks. Increasing the computational work factor (e.g., iterations) forces attackers to spend more CPU time per guess, making massive brute-force efforts prohibitively expensive. These controls are foundational to defense-in-depth, protecting user data integrity even when the authentication database is successfully exfiltrated by a threat actor.

Answer

Use a global static pepper appended to all hashes

Answer

Truncate passwords to 8 characters to save space

Answer

Store hashes in plain text for performance

Question 10

A GCIH incident responder is investigating a suspected API attack where an attacker manipulated a JSON Web Token (JWT) to gain unauthorized access. The responder needs to identify which two conditions would allow a JWT 'kid' (Key ID) header injection attack to succeed. (Choose two.)

Accepted Answer

The application allows the 'kid' header to specify an absolute path or URL that the server will fetch to obtain the key.. JWT 'kid' injection succeeds when the application uses the 'kid' header to determine the verification key without validating its content. If the 'kid' is used to build a file path or fetch a remote key, an attacker can manipulate it to use a key they control, forging valid tokens. The other conditions describe different JWT weaknesses.

Answer

The application uses a symmetric signing algorithm and the secret is weak or guessable.

Answer

The JWT is transmitted over an unencrypted HTTP connection, allowing token interception.

Answer

The application supports the 'none' algorithm and accepts unsigned tokens.

Question 11

A security analyst is investigating a suspected local file inclusion (LFI) attack against a PHP web application. The web server logs show the following request: `GET /download.php?file=php://filter/convert.base64-encode/resource=index.php`. The analyst needs to determine the attacker's objective and the potential impact. (Choose two.)

Accepted Answer

The attacker is attempting to read the source code of `index.php` by encoding it in Base64 to bypass PHP execution.. The payload uses the `php://filter` wrapper with Base64 encoding to read the source code of `index.php`. This technique bypasses PHP execution, allowing the attacker to view the raw code, which may contain sensitive information like database credentials. The other options misidentify the objective, such as command execution or CSRF, which are not supported by the specific payload.

Answer

The attacker is attempting to retrieve the contents of a sensitive file, such as `/etc/passwd`, by including it directly.

Answer

The attacker is attempting to perform a cross-site request forgery (CSRF) attack against the web application.

Answer

The attacker is attempting to execute arbitrary commands on the server via the `file` parameter.

Question 12

During a forensic analysis of a compromised developer workstation, an incident handler discovers scripts showing an attacker utilized an LLM to automate reconnaissance tasks. Which TWO capabilities are typically enhanced when integrating LLMs into modern offensive enumeration workflows? (Choose two)

Accepted Answer

Synthesizing unstructured banner-grabbing outputs into structured asset inventories. Integrating Large Language Models into offensive reconnaissance enhances operations by parsing unstructured network data and generating complex scripting logic on the fly. Incident responders must recognize these patterns during host artifact analysis to map out how attackers accelerated their initial target discovery phases.

Answer

Direct physical manipulation of smart-city IoT gateway switches via radio frequency

Answer

Autonomously generating custom multi-threaded port scanner binaries in compiled C

Answer

Bypassing hardware-enforced memory encryption mechanisms on remote hypervisors

Question 13

An incident handler is reviewing password storage mechanisms after a breach. The attacker exfiltrated a file containing password hashes. Which of the following TWO characteristics would make the hashes more resistant to offline cracking? (Choose two.)

Accepted Answer

Each hash includes a unique, random salt value.. The two characteristics that make hashes more resistant to offline cracking are the use of a slow key derivation function (like bcrypt) and the inclusion of a unique random salt per hash. A slow KDF increases the time required to compute each hash, while salting prevents the use of precomputed tables and ensures that identical passwords yield different hashes. Together, they significantly raise the cost for an attacker.

Answer

The password policy requires a minimum length of 8 characters with complexity.

Answer

The hashes are generated using SHA-256 without any salt.

Answer

The hashes are stored in a compressed archive to save space.

Question 14

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.

Question 15

An organization detects a web-based attack and wants to perform a thorough investigation. Which THREE artifacts should the team collect to analyze the adversary's entry point and activity?

Accepted Answer

HTTP access and error logs from the web server.. Analyzing a web-based attack requires a multi-layered approach. By correlating web server logs, application-level logs, and firewall traffic, investigators can reconstruct the full attack chain from the initial exploit attempt to post-exploitation activity. This holistic view is necessary to verify the entry point, understand the impact, and ensure all malicious persistence mechanisms are identified and removed during the remediation process, preventing the attacker from regaining unauthorized access to the environment.

Answer

System event logs for all workstations in the local network.

Answer

Email gateway logs showing internal-to-external communication patterns.

Question 16

Which TWO steps are critical during the 'Preparation' phase of the incident response lifecycle to ensure effective forensic investigation during a future security breach?

Accepted Answer

Establishing a centralized logging architecture with immutable storage.. Preparation is the foundation of incident response. By establishing logging infrastructure and legal protocols in advance, an organization ensures that forensic evidence is available and admissible when an incident occurs. Failing to prepare these elements often results in fragmented logs or delayed response actions, which hinders the team's ability to reconstruct the attack timeline accurately and perform root cause analysis after the threat is contained.

Answer

Drafting an incident communication plan for notifying public regulatory bodies.

Answer

Conducting a comprehensive risk assessment of all internal business applications.

Answer

Purchasing cybersecurity insurance to cover potential ransomware payout costs.

Question 17

Which TWO of the following steps are considered effective for hardening the SMB service against modern threats?

Accepted Answer

Require SMB signing for all connections. Hardening SMB involves a combination of removing legacy protocols and enforcing strong authentication and integrity controls. Disabling SMBv1 is the most critical step to prevent known exploits, while enforcing SMB signing provides the necessary protection against man-in-the-middle and relay attacks. Together, these measures significantly reduce the risk of lateral movement and unauthorized access, creating a much more resilient file-sharing environment that aligns with current security standards for enterprise networks.

Answer

Enable Guest Auth for compatibility

Answer

Use the LanmanServer for internet access

Answer

Disable all firewall logging on port 445

Question 18

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 19

Which TWO of the following practices are the most effective at mitigating Insecure Direct Object Reference (IDOR) vulnerabilities?

Accepted Answer

Implementing server-side authorization checks for every object access. Mitigating IDOR requires shifting from user-controlled identifiers to server-side access control checks. Relying on unpredictable identifiers makes guessing harder, but verifying identity and authorization for every requested object is the primary defense. These practices ensure that even if an attacker discovers a valid ID, they lack the authorization to perform operations on the underlying data, thereby closing the logical gap that allows unauthorized object access.

Answer

Increasing the length of session tokens

Answer

Employing a Web Application Firewall (WAF)

Answer

Moving all sensitive data to a cloud storage bucket

Question 20

Which TWO of the following are significant risks associated with using LLMs for automated malware analysis?

Accepted Answer

Inadvertent disclosure of proprietary code or indicators of compromise.. Automated malware analysis with LLMs carries risks related to data leakage and the inherent inaccuracy of AI models. If the model is not properly sandboxed, it may inadvertently leak indicators of compromise (IOCs) or sensitive binary analysis results to the provider. Additionally, the tendency of models to hallucinate or misinterpret complex obfuscation patterns can lead to incorrect analysis reports, which may cause responders to overlook actual threats or pursue useless remediation strategies during an investigation.

Answer

The model will automatically execute the malware and infect the local network.

Answer

The LLM will automatically report the malware to the vendor for analysis.

Answer

The model will increase the time required to complete the analysis.