GCIH Practice Questions

Question 1

An analyst uses an LLM to generate a C++ exploit. The model provides code that uses an deprecated memory copy function. What is the most appropriate action for the analyst to take?

Accepted Answer

Modify the code to use modern alternatives and perform rigorous security testing.. The analyst must manually review and test all code generated by an LLM. Relying on AI-generated code without verification is dangerous, as LLMs often suggest outdated or insecure practices. The analyst should modernize the code, verify its functionality in a controlled sandbox environment, and ensure it complies with secure coding practices before attempting to deploy it in any real-world offensive operation or security test.

Answer

Execute the code immediately in the production environment to verify functionality.

Answer

Re-run the prompt with a higher temperature to get a different code version.

Answer

Accept the code as is, as the LLM has already accounted for the system requirements.

Question 2

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

Accepted Answer

To detect anomalies in process lineage and execution context.. PPID analysis reveals the execution chain, which is often a major red flag for malicious activity. For example, a web server process spawning a shell is highly suspicious. Understanding these relationships allows incident handlers to detect process hollowing and injection attacks. This context is essential because it distinguishes between legitimate system operations and adversarial techniques designed to blend into the system's normal process hierarchy.

Answer

To identify which user account initiated the malicious activity.

Answer

To determine the file creation date on the disk.

Answer

To ensure the process is running with administrative privileges.

Question 3

What is the primary risk associated with using 'aggressive' scan timing templates (like T4 or T5) in an environment with high network latency?

Accepted Answer

The scan will yield inaccurate results due to premature timeouts.. Aggressive timing templates rely on short timeouts, expecting quick responses from targets. In high-latency networks, these short timeouts lead to false negatives, where Nmap incorrectly labels a port as 'filtered' simply because the response did not arrive before the aggressive timer expired. This leads to inaccurate mapping and missed vulnerabilities, directly undermining the goals of the incident investigation.

Answer

The scan will consume excessive bandwidth.

Answer

The scan will trigger an automated shutdown of the network.

Answer

The scan will crash the Nmap engine.

Question 4

Which TWO of the following are primary security risks associated with the SMBv1 protocol in a modern Windows environment?

Accepted Answer

Susceptibility to remote code execution via EternalBlue. SMBv1 is an archaic protocol that lacks modern security features, making it a critical target for attackers. Its primary risks include vulnerability to well-known remote code execution exploits like EternalBlue and its susceptibility to man-in-the-middle attacks due to weak or absent integrity checks. Understanding these risks is vital for incident handlers to prioritize the deprecation of legacy protocols, which are often the primary entry points for ransomware and lateral movement.

Answer

Inability to support Kerberos authentication

Answer

Lack of support for SMB message signing

Answer

Incompatibility with NTFS permissions

Question 5

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

Accepted Answer

Continuous ingestion of high-quality, normalized telemetry data.. Effective malware hunting requires a combination of strong data hygiene, human intuition, and robust analytical loops. AI provides the speed and pattern recognition necessary to handle large volumes of data, but it requires carefully curated inputs and human oversight to remain effective. These components are essential because they ensure that hunting efforts are scalable, reproducible, and aligned with the actual behavioral patterns observed during the adversary's lifecycle within the enterprise environment.

Answer

Eliminating all manual review to maximize the hunting speed.

Answer

Focusing exclusively on known malware signatures for speed.

Question 6

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.

Question 7

An analyst is investigating a suspected Pass-the-Hash attack within an Active Directory environment. Which TWO Windows Security Event Log IDs should the analyst examine to detect the use of stolen NTLM credential material for lateral movement? (Choose TWO)

Accepted Answer

Event ID 4624 (An account was successfully logged on). Event ID 4624 records successful logons, and specifying Logon Type 3 (Network) combined with NTLM authentication indicates a potential Pass-the-Hash event when originating from an unusual source. Event ID 4672 details special privileges assigned to new logins, helping verify if the compromised security context obtained administrative privileges across the domain.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4720 (A user account was created)

Answer

Event ID 1102 (The audit log was cleared)

Question 8

An application uses a Base64 encoded string as a parameter for object references. An attacker decodes the string, modifies the ID, re-encodes it, and successfully accesses unauthorized data. Why did the security control fail?

Accepted Answer

Base64 encoding is inherently reversible. The failure occurred because the application relied on encoding (Base64) as a security control instead of proper authorization logic. Encoding is a data representation technique, not a security mechanism. Because the server failed to perform access control checks on the decoded identifier, it allowed the attacker to bypass the intended security model. This highlights the importance of never confusing data format obfuscation with actual authorization or identity management.

Answer

The server failed to enforce HTTPS

Answer

The session token was not included in the payload

Answer

The application used an insecure hashing algorithm

Question 9

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 10

Which THREE items are essential components of an API security documentation strategy for incident responders?

Accepted Answer

Up-to-date OpenAPI/Swagger specifications. Effective incident response for APIs requires comprehensive documentation. API specifications (like OpenAPI/Swagger) provide the baseline for expected behavior and valid endpoints. Inventory documentation ensures all endpoints are known and monitored. Finally, security headers and rate-limiting policies document the defense-in-depth posture. Without these, responders cannot differentiate between legitimate traffic patterns and malicious exploitation attempts during an active security event or during post-incident forensic analysis.

Answer

Hardcoded database credentials for internal services

Answer

Customer personal identifiable information (PII) logs

Question 11

An incident responder analyzes a web application log and discovers that an attacker successfully extracted database schema names by manipulating a parameter where the application dynamically constructs SQL statements. The database error messages returned verbose structural details. Which remediation strategy provides the most robust defense against this injection vector while maintaining application functionality?

Accepted Answer

Refactor the data access layer to utilize parameterized queries and prepared statements exclusively.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine interprets data strictly as parameters rather than executable code. This eliminates SQL injection vulnerabilities at the architectural level, regardless of input complexity or encoding techniques, protecting the underlying database management system from unauthorized data access and structural enumeration.

Answer

Implement client-side JavaScript validation checks to strip dangerous SQL characters before submission.

Answer

Configure the web application firewall to block requests containing common SQL keywords like UNION and SELECT.

Answer

Disable verbose database error messages globally to prevent attackers from viewing schema details.

Question 12

Which TWO of the following are common indicators that a password database has been compromised?

Accepted Answer

A high volume of account takeover reports. Detecting a password database compromise often involves monitoring for unusual database activity or indicators of downstream misuse. A sudden spike in failed login attempts across many accounts (credential stuffing) or an influx of reports from users about account takeovers on unrelated services are classic red flags. These events suggest that the attacker is leveraging stolen hashes to gain unauthorized access elsewhere, making these observations critical for triggering incident response procedures for a potential database breach.

Answer

Increased server CPU usage during off-hours

Answer

A change in the local system time on the server

Answer

An increase in valid user password reset requests

Question 13

Which of the following best describes the purpose of 'flow data' (like NetFlow) during an incident investigation?

Accepted Answer

To analyze the volume, source, and destination of network traffic.. Flow data provides a high-level summary of network communications, including source, destination, ports, and duration. Unlike full packet capture, which is resource-intensive, flow data is lightweight and allows for long-term retention. It is invaluable for reconstructing an attacker's movement across the network and identifying patterns of communication, such as beaconing to C2 servers, even when specific payload contents are not available.

Answer

To capture the full payload content of every packet.

Answer

To provide a record of who accessed which specific file.

Answer

To perform real-time decryption of SSL/TLS traffic.

Question 14

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 15

A GCIH analyst is reviewing web server logs and sees repeated requests to /search?q=... where the q parameter contains strings like ../../../etc/passwd and ....//....//etc/shadow. The responses include root:x:0:0 entries. The application is a Java servlet that concatenates a user-supplied filename onto a base directory before calling new File(baseDir + userInput). Which vulnerability class best describes this incident?

Accepted Answer

Path Traversal. The attacker manipulates a filename parameter to escape the intended directory using ../ sequences and reads /etc/passwd, which is the defining behavior of Path Traversal. The vulnerable Java code concatenates user input onto a base path without canonicalization or validation, allowing the traversal. SSRF, LFI, and XXE each involve different mechanisms and would not produce this specific log pattern.

Answer

XML External Entity (XXE) injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

GIAC Certified Incident Handler GCIH practice test

Three ways to study

Study GCIH by domain

Study GCIH by topic

Securing Credentials and Data in Cloud practice questions

Endpoint Attack and Pivoting practice questions

SMB Security practice questions

Malware and AI-Assisted Investigations practice questions

Understanding Passwords practice questions

Detecting Exploitation and Covert Communication Tools practice questions

Detecting Evasive and Post-Exploitation Techniques practice questions

Integrating LLMs with Offensive Operations practice questions

Network and Log Investigations practice questions

Exploiting Insecure Web App References practice questions

Web App API Attacks practice questions

Web App Injection Attacks practice questions

GIAC Certified Incident Handler practice questions