GCIH Practice Question: Detecting Evasive and Post-Exploitation Techniques
Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?
⚠ Common exam trap
Test-takers often confuse process injection with process hollowing or standard DLL sideloading, missing the broader definition of forcing code into an active, running process memory space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process Injection
Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Code signing
Why it's wrong here
Code signing is a security feature used to verify the integrity and origin of software. It has no relation to the act of injecting code into another process's memory space and is, in fact, a mechanism designed to prevent the execution of untrusted or modified code.
- ✓
Process Injection
Why this is correct
Process injection is the act of inserting code into the address space of a separate, live process. This allows the attacker to execute their code with the permissions of the host process, effectively masking the malicious activity from security tools that scan files on the disk.
- ✗
Data Execution Prevention (DEP)
Why it's wrong here
DEP is a security feature that marks certain memory regions as non-executable to prevent malicious code from running. It is a defensive mechanism, not an attack technique. Attackers work specifically to bypass DEP, not to utilize it as part of their post-exploitation methodology.
- ✗
Memory Forensics
Why it's wrong here
Memory forensics is the process of analyzing a computer's RAM to find evidence of malicious activity. It is the practice used by security analysts to detect process injection, not the injection itself. Confusing detection methods with the attack techniques being analyzed is a common error in incident response.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.