GCIH Network and Log Investigations Practice Test 2 — 15 Questions

Question 1

An analyst discovers a suspicious file named 'svchost.exe' running from a user's 'AppData' directory. Why is this highly suspicious?

Accepted Answer

Legitimate svchost.exe resides in System32.. The legitimate svchost.exe process is a core Windows system component that resides in the System32 directory and is launched by the Service Control Manager. It is designed to host multiple Windows services. Attackers often rename their malicious binaries to 'svchost.exe' to blend in with legitimate processes, but they rarely place them in user-writable directories like AppData. Detecting this is a key indicator of malware masquerading as system processes.

Answer

It is always a virus.

Answer

Svchost must always run as SYSTEM.

Answer

Svchost cannot be executed by users.

Question 2

Which of the following is a primary benefit of using a centralized log management (CLM) solution during an incident?

Accepted Answer

It provides a unified view for log correlation.. Centralized log management aggregates logs from disparate sources, providing a single point of visibility. This is crucial for correlation, as it allows analysts to link events across different systems—such as matching a firewall block with a specific endpoint execution. Without CLM, responders must manually query every host, which is slow, error-prone, and often impossible if an attacker deletes local logs to cover their tracks.

Answer

It automatically blocks all malicious traffic.

Answer

It encrypts all data on the network.

Answer

It prevents unauthorized local access.

Question 3

You are investigating an alert regarding a 'Beaconing' pattern. Which aspect of the network connection is most indicative of automated C2 communication versus human browsing activity?

Accepted Answer

The consistency of the time interval between connections.. Beaconing refers to periodic, consistent communication patterns between a compromised host and a C2 server. While human browsing is stochastic and unpredictable, automated beacons often exhibit high regularity in interval and small, consistent packet sizes. Identifying these 'heartbeat' patterns in network traffic analysis is critical for detecting persistent threats that avoid large, noticeable data bursts but maintain constant connectivity for command receipt.

Answer

The total volume of data transferred.

Answer

The destination port used for the traffic.

Answer

The protocol used by the connection.

Question 4

During an investigation of a suspected lateral movement attempt within an Active Directory environment, an incident handler needs to isolate authentication events involving Kerberos ticket-granting service (TGS) requests that indicate potential Kerberoasting activity. Which Windows Security Event Log ID should the analyst examine to identify abnormal requests for service principal names (SPNs) using weak encryption algorithms?

Accepted Answer

Security Event ID 4769. Windows Security Event Log ID 4769 is generated whenever a Kerberos service ticket is requested. By filtering for Event ID 4769 and analyzing the encryption type field, analysts can spot requests using older, weaker encryption standards like RC4, which are heavily utilized during offline Kerberoasting password cracking attacks against service accounts.

Answer

Security Event ID 4624

Answer

Security Event ID 4768

Answer

Security Event ID 4771

Question 5

An incident responder notices an unusual outbound connection from a workstation to an external IP address on TCP port 443. Packet capture analysis shows that the SSL/TLS handshake completes, but the subsequent application-layer data payload is fully encrypted and does not match standard HTTPS browser traffic patterns. Which log investigation method provides the most reliable approach to determine if this traffic represents malicious command and control activity?

Accepted Answer

Correlate the network connection timestamp with endpoint process execution logs to identify the exact binary that initiated the socket.. Correlating endpoint process execution logs with network connection data via Sysmon Event ID 3 and Event ID 1 reveals the parent process responsible for establishing the socket. Relying solely on destination port 443 or external reputation feeds is insufficient because modern adversaries frequently tunnel malicious traffic over standard ports and encrypted channels to blend in with legitimate enterprise web traffic.

Answer

Perform a reverse DNS lookup on the destination IP address to verify if the domain belongs to a known content delivery network.

Answer

Inspect the certificate issuer authority within the TLS handshake to confirm if it matches internal corporate enterprise signing policies.

Answer

Analyze the TCP window size scaling factors during the initial three-way handshake to detect anomalies indicative of tunneling tools.

Question 6

An analyst is investigating a suspected Pass-the-Hash attack within an Active Directory environment. Which TWO Windows Security Event Log IDs should the analyst examine to detect the use of stolen NTLM credential material for lateral movement? (Choose TWO)

Accepted Answer

Event ID 4624 (An account was successfully logged on). Event ID 4624 records successful logons, and specifying Logon Type 3 (Network) combined with NTLM authentication indicates a potential Pass-the-Hash event when originating from an unusual source. Event ID 4672 details special privileges assigned to new logins, helping verify if the compromised security context obtained administrative privileges across the domain.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4720 (A user account was created)

Answer

Event ID 1102 (The audit log was cleared)

Question 7

An incident handler is examining a packet capture from a compromised workstation and observes a series of DNS queries for domains like 'a1b2c3d4e5.exfil.example.com', each followed by a large TXT response. The queries are sent at regular 30-second intervals, and the subdomains contain random-looking alphanumeric strings. Which of the following techniques is MOST likely being used by the attacker?

Accepted Answer

DNS tunneling for data exfiltration. The correct answer is DNS tunneling for data exfiltration. The combination of regular intervals, random subdomains, and large TXT responses is a hallmark of DNS tunneling, where attackers encode data in DNS queries and responses to bypass network filters. This allows stealthy exfiltration even when other protocols are blocked. Fast-flux, cache poisoning, and DGA do not involve such data transfer patterns.

Answer

DNS cache poisoning to redirect traffic

Answer

Fast-flux DNS for resilience

Answer

Domain generation algorithm (DGA) for C2

Question 8

An incident handler is investigating a suspected data exfiltration on a Windows workstation. The SIEM generated an alert for a large outbound transfer to an unfamiliar IP address. The handler needs to determine which process initiated the connection. Which built-in Windows tool is most appropriate to correlate the active network connection to its owning process?

Accepted Answer

netstat -ano. Correlating a live network connection to its owning process is a core incident response task. The netstat -ano command provides the essential PID mapping, which can then be resolved to an executable using tasklist or Task Manager. This native capability allows rapid triage without installing additional tools, directly answering which process initiated the suspicious outbound transfer.

Answer

nslookup

Answer

tracert

Answer

arp -a

Question 9

A security analyst is reviewing a packet capture from a compromised host and observes a series of DNS queries for randomly generated subdomains of a single domain, each followed by a TXT record response containing encoded data. The queries occur at regular intervals of approximately 60 seconds. Which type of attack is most strongly indicated by this pattern?

Accepted Answer

DNS tunneling for command and control. DNS tunneling exploits the DNS protocol to carry data covertly. The random subdomains and TXT records with encoded payloads, combined with regular timing, strongly indicate a command-and-control channel. This method is popular because DNS is often allowed through firewalls. Recognizing this pattern allows incident handlers to block the domain and investigate the infected host for malware.

Answer

DNS amplification DDoS

Answer

Fast flux DNS

Answer

DNS cache poisoning

Question 10

An incident responder is analyzing a network capture to identify potential command-and-control (C2) communication. The capture shows a workstation making regular DNS queries to 'update.microsoft.com' every 60 seconds, each followed by a small HTTPS session to a different IP address. The HTTPS sessions use self-signed certificates and the User-Agent string is 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)'. Which TWO of the following indicators most strongly suggest malicious C2 activity? (Choose two.)

Accepted Answer

The User-Agent string is outdated and inconsistent with the operating system.. The correct answers are that the HTTPS sessions use self-signed certificates and the User-Agent string is outdated and inconsistent. Self-signed certificates are a hallmark of malware C2 because they are not trusted and often used to avoid detection. An outdated User-Agent like MSIE 6.0 on a modern system suggests the traffic is generated by malware with hardcoded strings. Together, these strongly indicate malicious C2 activity, whereas the other options can be benign.

Answer

The DNS queries are for a legitimate domain but resolve to multiple IP addresses.

Answer

The DNS queries occur at regular 60-second intervals.

Answer

The HTTPS sessions are to different IP addresses each time.

Question 11

An incident handler is examining a web server's access logs after a suspected SQL injection attempt. The log shows a request with a long URL containing multiple single quotes and 'UNION SELECT' statements. Which log field is most critical to correlate this request with other events to determine if the attack succeeded?

Accepted Answer

The source IP address and timestamp. Correlating events across disparate logs requires a common identifier such as source IP and timestamp. These fields allow the incident handler to pivot from the web server log to database logs, firewall logs, or IDS alerts to see if the SQL injection resulted in data extraction, error messages, or additional requests. Other fields like User-Agent or status code may provide context but lack the uniqueness needed for reliable correlation.

Answer

The HTTP status code

Answer

The User-Agent string

Answer

The requested URL path

Question 12

During a network investigation, an incident responder notices a high volume of outbound DNS queries to a single external domain, with each query containing a long, random-looking subdomain. The queries occur at regular intervals of approximately 30 seconds. Which type of attack is most likely indicated?

Accepted Answer

DNS tunneling for data exfiltration. The combination of high volume, long random subdomains, and regular intervals strongly suggests DNS tunneling for data exfiltration. Attackers use this technique to encode stolen data into DNS queries, which are often allowed through firewalls. The regular interval indicates automated beaconing or a scheduled exfiltration process. Other DNS-based attacks like cache poisoning or amplification would present different traffic patterns, such as spoofed source IPs or redirection of legitimate queries.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Fast flux DNS

Question 13

An incident handler is investigating a suspected compromised Windows workstation. They review Windows Security event logs and notice a large number of Event ID 4625 (An account failed to log on) followed by a single Event ID 4624 (An account was successfully logged on) from the same source IP within a short period. Which of the following best describes the activity?

Accepted Answer

A successful brute-force attack against a user account.. The correct answer is a successful brute-force attack. The pattern of many failed logon attempts (Event ID 4625) followed by a successful logon (Event ID 4624) from the same source IP in a short period is indicative of a brute-force attack. The attacker systematically tried passwords until one worked. This is a common initial access technique, and incident handlers should investigate the source IP and check for further compromise.

Answer

A user mistyped their password several times before logging in successfully.

Answer

A password-spraying attack targeting multiple accounts.

Answer

An account lockout policy being triggered and then reset.

Question 14

An incident handler is analyzing a packet capture to identify command-and-control (C2) communication. Which two characteristics are most indicative of C2 traffic? (Choose two.)

Accepted Answer

Periodic connections to the same external IP address at regular intervals. Beaconing and DNS tunneling are two strong indicators of C2 communication. Beaconing involves regular, periodic connections that malware uses to check in with its controller. DNS tunneling encodes data in DNS queries, often using high entropy subdomains to carry commands or exfiltrate data. Other characteristics like non-standard ports or large transfers may be present but are not as specific to C2, as they can occur in legitimate traffic. Combining multiple indicators increases confidence.

Answer

Use of HTTP GET requests with long, random-looking URI parameters

Answer

Large outbound data transfers to an external IP address during non-business hours

Answer

Connections to an external IP address on a non-standard port that is not associated with any known service

Question 15

An incident handler is analyzing a packet capture and notices a high volume of TCP SYN packets sent to multiple ports on a single target host, with no corresponding SYN-ACK responses. The source IP is spoofed. What type of activity does this indicate?

Accepted Answer

TCP SYN flood. The combination of numerous TCP SYN packets, spoofed source IP, and absence of SYN-ACK responses is a hallmark of a SYN flood attack. This type of denial-of-service attempts to exhaust the target's resources by leaving half-open connections. Recognizing this pattern helps responders mitigate by enabling SYN cookies or rate limiting.

Answer

Port scanning

Answer

ARP spoofing

Answer

UDP fragmentation attack