During an incident, you observe that an attacker is using a compromised workstation to connect to multiple internal servers using the same credentials. The credentials belong to a service account that has administrative rights on several servers. You need to stop the pivoting while minimizing disruption to business operations. Which action is the best first step?

Block the workstation's IP address at the firewall.

Isolate all servers that the service account can access.

Disable the service account entirely.

Reset the service account's password and revoke its access to the affected servers.

How does pivoting facilitate lateral movement in a network attack?

It allows an attacker to move from a compromised host to other hosts that are otherwise inaccessible

It encrypts all network traffic to hide the attack

It creates a backdoor for remote access

It disables security controls on target systems

In the context of network attacks, what does 'pivoting' refer to?

Rotating IP addresses to evade detection

Using a compromised host as a stepping stone to access other systems in the network

Switching between different attack tools

Rebooting a compromised system to clear memory

You are responding to an incident where an attacker has compromised a domain controller and is using it to pivot to other servers. You need to stop the pivoting while preserving the ability to investigate the attacker's activities. Which action best achieves this?

Take a memory dump and then reimage the domain controller.

Block outbound connections from the domain controller to other internal hosts at the firewall.

Reset the domain controller's password and disable its network adapter.

Immediately power off the domain controller to sever all connections.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 4)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 16–20

16expert · hard
During an incident, you observe that an attacker is using a compromised workstation to connect to multiple internal servers using the same credentials. The credentials belong to a service account that has administrative rights on several servers. You need to stop the pivoting while minimizing disruption to business operations. Which action is the best first step?
Select an answer first
17foundation · easy
How does pivoting facilitate lateral movement in a network attack?
Select an answer first
18foundation · easy
In the context of network attacks, what does 'pivoting' refer to?
Select an answer first
19expert · hard
You are responding to an incident where an attacker has compromised a domain controller and is using it to pivot to other servers. You need to stop the pivoting while preserving the ability to investigate the attacker's activities. Which action best achieves this?
Select an answer first
20application · medium
A user reports that their computer is infected after they plugged in a USB drive found in the parking lot. The EDR shows that the USB drive contained an autorun script that executed when inserted. Which endpoint attack vector was used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Endpoint Attack and Pivoting GCIH Practice Questions (Page 4)

Questions 16–20

How does pivoting facilitate lateral movement in a network attack?

In the context of network attacks, what does 'pivoting' refer to?

You are responding to an incident where an attacker has compromised a domain controller and is using it to pivot to other servers. You need to stop the pivoting while preserving the ability to investigate the attacker's activities. Which action best achieves this?

A user reports that their computer is infected after they plugged in a USB drive found in the parking lot. The EDR shows that the USB drive contained an autorun script that executed when inserted. Which endpoint attack vector was used?

Keep studying — Attack Techniques and Detection