GIAC GCIH Practice Test

Answer choices

1. A. Enforce request-size, concurrency, per-user quota, execution-time, and resource-consumption limits appropriate to the operation.
2. B. Require stronger passwords for the accounts submitting the jobs.
3. C. Rename the transformation endpoint so automated clients cannot discover it.
4. D. Permit unlimited jobs but add more detailed error messages when capacity is exhausted.

Wrong-answer review

• B. Require stronger passwords for the accounts submitting the jobs.: Incorrect. The requests are already authenticated; the problem is unbounded resource consumption through valid operations.
• C. Rename the transformation endpoint so automated clients cannot discover it.: Incorrect. Endpoint obscurity does not constrain resource use once the API is known.
• D. Permit unlimited jobs but add more detailed error messages when capacity is exhausted.: Incorrect. Better errors do not prevent deliberate exhaustion and may provide attackers with additional feedback.

Answer choices

1. A. Block all HTTPS traffic from the subnet before examining the higher-fidelity logs.
2. B. Align the periodic connections with proxy URL/host data and endpoint DNS resolution to determine whether the same process is repeatedly contacting a consistent external service.
3. C. Treat the 60-second interval as proof of command-and-control without additional evidence.
4. D. Ignore the proxy and DNS evidence because encrypted HTTPS prevents useful investigation.

Answer choices

1. A. Password spraying, because many accounts were targeted in a short period.
2. B. Online brute force, because every successful login proves repeated exhaustive guessing.
3. C. Credential stuffing using previously compromised username/password pairs from another service.
4. D. Pass-the-hash, because passwords from one service can be used directly as NTLM hashes against another web portal.

Answer choices

1. A. Upgrade the appliance to the supported SMB3 firmware and keep SMB1 disabled on the file servers.
2. B. Re-enable SMB1 globally but require complex passwords for the appliance account.
3. C. Re-enable SMB1 only on every file server the appliance might access.
4. D. Disable SMB signing so the appliance can negotiate the older protocol more easily.

Answer choices

1. A. Send full raw evidence to any public model because model output is only a summary.
2. B. Disable logging so sensitive prompts cannot appear in audit records.
3. C. Give the LLM direct access to all incident repositories so it can decide what data it needs.
4. D. Minimize or redact sensitive input to what is necessary, use an approved controlled model/service, restrict access, log usage, and retain human validation of outputs.

Answer choices

1. A. Ncat is listening on port 4444 and is configured to keep accepting additional connections instead of exiting after the first one.
2. B. Ncat is sending UDP packets to port 4444 because `-k` selects datagram mode as the first technical action.
3. C. Ncat is scanning remote port 4444 repeatedly until it finds an open host.
4. D. Ncat is verifying a TLS certificate on port 4444 because listen mode implies SSL.

Answer choices

1. A. PowerShell commands are always Persistence because scripts can survive reboot.
2. B. PowerShell should be mapped as RDP whenever the command was launched remotely.
3. C. Map the observed interpreter to T1059.001, then separately map any evasion behavior only if the command’s actions provide evidence of an evasion technique.
4. D. Any encoded PowerShell is automatically the Defense Evasion tactic and no additional mapping is needed.

Answer choices

1. A. Capture volatile memory and current process/network state before performing recovery actions that would destroy that state.
2. B. Reboot immediately to force the malware out of memory, then capture memory.
3. C. Run a disk defragmentation pass so the forensic image is easier to analyze.
4. D. Disable logging to prevent the malware from generating additional noise.

Answer choices

1. A. Emphasize sufficient length, reject commonly used or compromised passwords with a blocklist, and remove arbitrary composition and periodic-change requirements absent evidence of compromise.
2. B. Keep the composition rules and shorten rotation to 30 days so stolen passwords expire faster.
3. C. Remove minimum length because a breach-password blocklist makes password length irrelevant.
4. D. Require security questions for every password change so users can recover complex passwords.

Answer choices

1. A. Hash the `accountId` in the mobile app so users cannot read it.
2. B. Move the account ID from the JSON body to a custom HTTP header.
3. C. Require TLS 1.3; encrypted transport prevents object-level authorization failures.
4. D. Authorize the authenticated principal against the referenced account object before executing the transfer.