Integrating LLMs with Offensive Operations GCIH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is reviewing their email gateway's ability to detect AI-generated phishing emails. They want to implement a control that specifically targets the use of LLMs to create evasive content. Which control is most effective?

   • ABlock all emails that contain links to external websites.
   • BDeploy a machine learning-based email filter that analyzes the linguistic patterns of emails and flags those that are statistically similar to known AI-generated content.
   • CRequire all emails to include a digital signature from the sender's domain.
   • DIncrease the spam score threshold to block more emails, regardless of content.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A red team is using an LLM to generate a variety of phishing emails for a simulated attack. The team wants to test the effectiveness of different email templates. Which approach is most efficient?

   • AUse the LLM to generate one template and then manually modify it for each variation.
   • BUse the LLM API to generate multiple templates in a single batch request.
   • CUse the LLM to generate templates that are completely random and unrelated to the target.
   • DUse the LLM to generate templates that are all identical to a known successful phishing email.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During an incident response, a defender discovers a set of fake social media accounts that are posting technical details about the attack. The details are partially correct but contain deliberate inaccuracies. The defender suspects the attacker is using an LLM to generate this disinformation. What is the best way to confirm this?

   • ALook for the attacker's IP address in the post metadata.
   • BAnalyze the posts for statistical patterns typical of AI-generated text, such as low perplexity and uniform sentence length.
   • CAsk the LLM that is suspected of being used to generate the posts.
   • DCheck if the posts contain any known malware signatures.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A penetration tester is using an LLM to generate a malicious macro for a Word document. The tester needs the macro to evade antivirus and also be functional. The tester has limited time and must choose between two approaches: (1) use the LLM to generate a unique obfuscated macro, or (2) use the LLM to modify a known macro. Which approach is more likely to succeed?

   • AUse the LLM to generate a macro that is very large to overwhelm the antivirus.
   • BModify a known macro by changing variable names and adding comments.
   • CGenerate a unique obfuscated macro and test it against the target's antivirus, iterating if necessary.
   • DUse the LLM to generate a macro in a less common language, such as VBScript.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How can an LLM be used to create evasive techniques that bypass security controls?

   • ABy deleting system logs after an attack to cover tracks.
   • BBy encrypting the attacker's command-and-control traffic.
   • CBy generating code that is obfuscated or polymorphic to evade signature-based detection.
   • DBy increasing the volume of network traffic to overwhelm security monitoring.
   Reveal Solution Discussion Select an answer first