An attacker has compromised a file server and is using it to connect to other internal servers using the same service account. The service account has legitimate access to the file server but not to the other servers. What is the attacker doing?

Performing a denial of service attack

Installing a backdoor on the file server

Pivoting to other internal servers

An EDR alert fires on a workstation because a legitimate system tool, such as PowerShell, is executing a series of commands that download and run a script from an external URL. The user did not initiate this activity. Which detection technique is most likely to have triggered this alert?

File integrity monitoring that detects changes to system files.

Network intrusion detection that inspects the URL for malicious keywords.

Behavioral analysis that flags unusual use of system tools to download and execute code.

Signature-based antivirus that matches the script's hash against a known malware database.

A server is compromised with malware that is designed to be persistent and difficult to remove. You need to eradicate the malware while minimizing downtime for the server's critical business function. Which approach is most appropriate?

Disconnect the server from the network and leave it running for forensic analysis.

Attempt to manually remove the malware by deleting files and registry keys.

Run a full antivirus scan and quarantine the detected files.

Restore the server from a known-good backup taken before the compromise.

An attacker has compromised a web server and is using it to relay traffic to an internal application server that is not directly accessible from the internet. The internal application server is now sending data to an external IP. Which of the following best describes the attacker's technique?

Direct exploitation of the application server

Pivoting through the web server

Denial of service against the application server

Social engineering to gain access to the application server

You are responding to an incident where an attacker is using a compromised domain controller to pivot to other servers. You need to stop the pivoting, but you cannot take the domain controller offline because it is critical for authentication. Which action is the best compromise?

Promote a new domain controller and decommission the compromised one.

Implement network segmentation to block the domain controller from reaching other servers except for necessary authentication traffic.

Disable the domain controller's network adapter.

Reset the domain controller's password and reboot it.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 5)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 21–25

21application · medium
An attacker has compromised a file server and is using it to connect to other internal servers using the same service account. The service account has legitimate access to the file server but not to the other servers. What is the attacker doing?
Select an answer first
22application · medium
An EDR alert fires on a workstation because a legitimate system tool, such as PowerShell, is executing a series of commands that download and run a script from an external URL. The user did not initiate this activity. Which detection technique is most likely to have triggered this alert?
Select an answer first
23expert · hard
A server is compromised with malware that is designed to be persistent and difficult to remove. You need to eradicate the malware while minimizing downtime for the server's critical business function. Which approach is most appropriate?
Select an answer first
24expert · hard
An attacker has compromised a web server and is using it to relay traffic to an internal application server that is not directly accessible from the internet. The internal application server is now sending data to an external IP. Which of the following best describes the attacker's technique?
Select an answer first
25expert · hard
You are responding to an incident where an attacker is using a compromised domain controller to pivot to other servers. You need to stop the pivoting, but you cannot take the domain controller offline because it is critical for authentication. Which action is the best compromise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.