GCIH Network and Log Investigations — Timed 25 Questions

Question 1

Refer to the exhibit. An analyst observes this log entry in the web server access logs. What type of attack is likely being attempted?

Accepted Answer

SQL Injection. The inclusion of the single quote and double hyphen (--) in the query parameter is a classic signature for SQL injection. Attackers use the quote to break out of the string context and the dashes to comment out the remainder of the legitimate SQL query. Identifying these patterns in logs is vital for detecting application-layer exploitation attempts that bypass traditional perimeter firewalls.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Buffer Overflow

Question 2

A responder is analyzing a compromised Linux host and suspects the attacker modified a persistent startup file to maintain access. Which file should be checked to identify malicious commands executing upon system boot?

Accepted Answer

~/.bashrc. Persistence mechanisms are a primary goal for attackers. On Linux, attackers often target shell profile files or systemd services to ensure their backdoors run automatically. Checking /etc/crontab or specific user profile files is fundamental to incident investigation. Identifying these modifications allows responders to not only remove the malicious persistence but also to understand the scope and duration of the attacker's presence on the system.

Answer

/etc/shadow

Answer

/var/log/syslog

Answer

/proc/net/dev

Question 3

During a forensic analysis, you identify that an attacker used a 'Pass-the-Hash' (PtH) attack. Which Windows log event ID is most indicative of this authentication activity occurring on a target system?

Accepted Answer

Event ID 4624 (Logon Type 3). Pass-the-Hash attacks allow an attacker to authenticate without the original plaintext password. In Windows, this manifests as a network logon event using NTLM authentication. Monitoring for logon types, specifically Type 3, is vital for identifying these lateral movement attempts. Incident responders must distinguish between legitimate network service authentication and malicious PtH activity to effectively scope the breach and identify compromised accounts.

Answer

Event ID 4625 (Logon Type 2)

Answer

Event ID 4688

Answer

Event ID 4720

Question 4

Refer to the exhibit. A firewall policy is implemented as shown. If a packet arrives from 10.5.5.5 destined for 192.168.1.10, what will be the result?

Accepted Answer

The packet will be blocked.. The source IP 10.5.5.5 falls within the 10.0.0.0/8 CIDR range (covering 10.0.0.0 to 10.255.255.255). The destination 192.168.1.10 is within the 192.168.1.0/24 range (covering 192.168.1.0 to 192.168.1.255). Because both match the policy parameters and the action is 'block', the packet will be dropped. Understanding CIDR notation is essential for correctly auditing network security policies during incident response investigations.

Answer

The packet will be allowed.

Answer

The packet will be ignored.

Answer

The packet will be routed to the DMZ.

Question 5

Which THREE log sources are most critical for reconstructing an attacker's movement across an Active Directory environment after they gain initial domain user access?

Accepted Answer

Domain Controller Security Event Logs. Active Directory logs provide the audit trail necessary for tracking lateral movement. Security event logs capture authentication, process creation, and service modifications. By correlating these, investigators can map the attacker's trajectory. If logs are missing, the ability to determine the extent of a compromise is severely hampered, making the integrity of these three log sources paramount for incident responders working in Windows-based enterprise environments.

Answer

DHCP Lease Logs

Answer

Printer Spooler Logs

Question 6

When performing memory forensics, which artifact is the most reliable for identifying the parent-child relationship of suspicious processes?

Accepted Answer

The EPROCESS block. The EPROCESS structure in the Windows kernel maintains a list of processes and their parent process IDs. Forensic tools like Volatility parse these structures to visualize the process tree. This is essential for detecting 'process hollowing' or 'injection' where a malicious process is spawned by a legitimate one (like explorer.exe or services.exe), allowing investigators to reconstruct the exact execution chain used by an attacker.

Answer

System Prefetch files

Answer

MFT (Master File Table)

Answer

Windows Event Logs

Question 7

During an investigation involving a compromised Linux server, an incident responder suspects an attacker installed a user-mode rootkit by replacing standard system binaries. The responder runs the 'rpm -Va' command to verify installed packages against the RPM database. Which specific finding from this verification output provides definitive cryptographic proof that the '/bin/netstat' binary has been modified?

Accepted Answer

A leading '5' indicator confirming that the cryptographic MD5 digest of the file does not match the RPM database record.. The rpm verification command checks installed files against the package database's cryptographic checksums and metadata. A digest or MD5 mismatch denoted by the '5' attribute flag indicates that the file contents on disk differ from the official package manifest, proving tampering occurred despite potential file timestamp manipulation.

Answer

A leading 'S' indicator showing that the file size has changed significantly compared to the original installation manifest.

Answer

A leading 'M' indicator demonstrating that the permission bits and file mode have been altered to grant world-writable access.

Answer

A leading 'T' indicator showing that the file modification timestamp was altered to conceal the exact time of the replacement.

Question 8

A security analyst is reviewing logs from a Linux web server and notices the following entry in /var/log/auth.log: 'sshd[1234]: Accepted password for root from 192.168.1.100 port 54321 ssh2'. Shortly after, the same IP appears in /var/log/apache2/access.log with a POST request to /admin/upload.php that returns a 200 status code. The server hosts a public e-commerce site. Which of the following is the MOST likely explanation for these log entries?

Accepted Answer

An attacker used stolen credentials to log in via SSH and then uploaded a malicious file through the web application.. The correct answer is that an attacker used stolen credentials to log in via SSH and then uploaded a malicious file. The logs show a successful SSH login as root from an external IP, followed by a POST to an admin upload script. This indicates the attacker had valid credentials and then leveraged the web application to upload a payload. The absence of failed login attempts supports credential use rather than brute force. This is a classic attack chain.

Answer

A legitimate administrator logged in via SSH and then uploaded a file through the web interface.

Answer

An attacker exploited a vulnerability in the web application to gain SSH access.

Answer

An attacker successfully brute-forced the root password and then uploaded a web shell.

Question 9

During an investigation of a compromised Linux server, an incident responder needs to determine which user account was used to establish an SSH session that originated from an external IP address. Which log file should the responder examine to find the username associated with the successful login?

Accepted Answer

/var/log/auth.log. On Debian-based Linux systems, authentication events including SSH logins are recorded in /var/log/auth.log. This file contains the username, source IP, and timestamp for successful logins. By examining auth.log, the responder can directly identify the account used from the external IP. Other logs either lack authentication details or are specific to other distributions.

Answer

/var/log/syslog

Answer

/var/log/secure

Answer

/var/log/lastlog

Question 10

An incident responder is reviewing firewall logs and notices a series of denied inbound connections from various external IP addresses to TCP port 3389 on a public-facing server. What is the most likely explanation for this activity?

Accepted Answer

The server is being scanned for open RDP ports by automated tools.. The denied inbound connections to port 3389 from multiple external IPs indicate that the server is being scanned for open RDP ports. Port scanning is a common reconnaissance technique used by attackers to identify potential entry points. Since the firewall is blocking the connections, the RDP service is not exposed, but the scan activity itself is noteworthy. This is not a brute-force attack because the connections are denied before reaching the service, and it is not C2 traffic because the direction and port are inconsistent with typical botnet communication.

Answer

The server is experiencing a brute-force attack against RDP.

Answer

The server is part of a botnet and is receiving commands from a C2 server.

Answer

A misconfigured application is repeatedly attempting to connect to the server.

Question 11

An incident responder is investigating a suspected compromise of a Windows workstation. The responder has collected volatile data and needs to identify evidence of persistence mechanisms. Which two artifacts should the responder examine to find programs configured to run automatically at startup? (Choose two.)

Accepted Answer

Registry keys under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Persistence mechanisms on Windows often include registry Run keys and Startup folders. These locations automatically execute programs when a user logs in. Examining them reveals unauthorized additions. While Scheduled Tasks can also provide persistence, they are trigger-based and not exclusively startup programs. The two most direct artifacts for auto-start programs are the Run keys and Startup folders.

Answer

Windows Prefetch files

Answer

Event logs in the Security log

Answer

Scheduled Tasks in Task Scheduler

Question 12

An incident responder notices a spike in outbound traffic on port 443 originating from a server that normally only communicates with a local database. Which tool is most effective for identifying the specific process responsible for this anomalous network activity?

Accepted Answer

netstat -ano. Identifying the link between network sockets and the system process is critical during incident handling. Netstat or ss utilities, specifically when used with process identification flags, allow responders to map external traffic to local binaries. This visibility is essential for distinguishing between legitimate service communication and unauthorized exfiltration or command-and-control beacons, enabling the responder to terminate malicious processes and isolate affected infrastructure quickly.

Answer

tcpdump -i eth0

Answer

nmap -sV target

Answer

ifconfig -a

Question 13

An analyst is investigating potential data exfiltration via DNS tunneling. Which TWO of the following indicators would most strongly suggest this activity is occurring?

Accepted Answer

A sudden increase in DNS TXT record requests. DNS tunneling uses DNS queries to encapsulate non-DNS traffic, bypassing standard firewalls. Detecting this requires looking for abnormal patterns in traffic volume and request frequency. By identifying unusually long subdomains or high volumes of TXT/NULL record types, analysts can pinpoint covert channels. This is critical for detecting C2 traffic that hides in plain sight within common, often permitted, network protocols.

Answer

High volumes of HTTP GET requests to internal IPs

Answer

Frequent ICMP echo requests from the perimeter

Answer

TCP SYN floods targeting the local gateway

Question 14

Which of the following best describes the purpose of 'flow data' (like NetFlow) during an incident investigation?

Accepted Answer

To analyze the volume, source, and destination of network traffic.. Flow data provides a high-level summary of network communications, including source, destination, ports, and duration. Unlike full packet capture, which is resource-intensive, flow data is lightweight and allows for long-term retention. It is invaluable for reconstructing an attacker's movement across the network and identifying patterns of communication, such as beaconing to C2 servers, even when specific payload contents are not available.

Answer

To capture the full payload content of every packet.

Answer

To provide a record of who accessed which specific file.

Answer

To perform real-time decryption of SSL/TLS traffic.

Question 15

You are analyzing a PCAP and notice a large number of packets with the 'RST' flag set. What is the most likely cause for this behavior in an incident context?

Accepted Answer

Port scanning activity.. The TCP RST (Reset) flag is used to abruptly terminate a connection. A surge of these packets can indicate an active port scan, a misconfigured firewall rejecting unauthorized traffic, or an attacker attempting to clear out half-open connections. Understanding TCP state transitions is fundamental to identifying network scanning or denial-of-service attempts during the investigation of anomalous traffic patterns in packet captures.

Answer

Successful data transfer.

Answer

Normal encrypted session renegotiation.

Answer

DNS zone transfer.

Question 16

An analyst discovers a suspicious file named 'svchost.exe' running from a user's 'AppData' directory. Why is this highly suspicious?

Accepted Answer

Legitimate svchost.exe resides in System32.. The legitimate svchost.exe process is a core Windows system component that resides in the System32 directory and is launched by the Service Control Manager. It is designed to host multiple Windows services. Attackers often rename their malicious binaries to 'svchost.exe' to blend in with legitimate processes, but they rarely place them in user-writable directories like AppData. Detecting this is a key indicator of malware masquerading as system processes.

Answer

It is always a virus.

Answer

Svchost must always run as SYSTEM.

Answer

Svchost cannot be executed by users.

Question 17

Which of the following is a primary benefit of using a centralized log management (CLM) solution during an incident?

Accepted Answer

It provides a unified view for log correlation.. Centralized log management aggregates logs from disparate sources, providing a single point of visibility. This is crucial for correlation, as it allows analysts to link events across different systems—such as matching a firewall block with a specific endpoint execution. Without CLM, responders must manually query every host, which is slow, error-prone, and often impossible if an attacker deletes local logs to cover their tracks.

Answer

It automatically blocks all malicious traffic.

Answer

It encrypts all data on the network.

Answer

It prevents unauthorized local access.

Question 18

You are investigating an alert regarding a 'Beaconing' pattern. Which aspect of the network connection is most indicative of automated C2 communication versus human browsing activity?

Accepted Answer

The consistency of the time interval between connections.. Beaconing refers to periodic, consistent communication patterns between a compromised host and a C2 server. While human browsing is stochastic and unpredictable, automated beacons often exhibit high regularity in interval and small, consistent packet sizes. Identifying these 'heartbeat' patterns in network traffic analysis is critical for detecting persistent threats that avoid large, noticeable data bursts but maintain constant connectivity for command receipt.

Answer

The total volume of data transferred.

Answer

The destination port used for the traffic.

Answer

The protocol used by the connection.

Question 19

During an investigation of a suspected lateral movement attempt within an Active Directory environment, an incident handler needs to isolate authentication events involving Kerberos ticket-granting service (TGS) requests that indicate potential Kerberoasting activity. Which Windows Security Event Log ID should the analyst examine to identify abnormal requests for service principal names (SPNs) using weak encryption algorithms?

Accepted Answer

Security Event ID 4769. Windows Security Event Log ID 4769 is generated whenever a Kerberos service ticket is requested. By filtering for Event ID 4769 and analyzing the encryption type field, analysts can spot requests using older, weaker encryption standards like RC4, which are heavily utilized during offline Kerberoasting password cracking attacks against service accounts.

Answer

Security Event ID 4624

Answer

Security Event ID 4768

Answer

Security Event ID 4771

Question 20

An incident responder notices an unusual outbound connection from a workstation to an external IP address on TCP port 443. Packet capture analysis shows that the SSL/TLS handshake completes, but the subsequent application-layer data payload is fully encrypted and does not match standard HTTPS browser traffic patterns. Which log investigation method provides the most reliable approach to determine if this traffic represents malicious command and control activity?

Accepted Answer

Correlate the network connection timestamp with endpoint process execution logs to identify the exact binary that initiated the socket.. Correlating endpoint process execution logs with network connection data via Sysmon Event ID 3 and Event ID 1 reveals the parent process responsible for establishing the socket. Relying solely on destination port 443 or external reputation feeds is insufficient because modern adversaries frequently tunnel malicious traffic over standard ports and encrypted channels to blend in with legitimate enterprise web traffic.

Answer

Perform a reverse DNS lookup on the destination IP address to verify if the domain belongs to a known content delivery network.

Answer

Inspect the certificate issuer authority within the TLS handshake to confirm if it matches internal corporate enterprise signing policies.

Answer

Analyze the TCP window size scaling factors during the initial three-way handshake to detect anomalies indicative of tunneling tools.