After installing a post-exploitation tool, which action is part of post-installation verification?

Reviewing the tool's source code for vulnerabilities

Running a basic command to confirm the tool responds as expected

Rebooting the target system to ensure the tool persists

Deleting the installation files to free up disk space

An operator needs to acquire a post-exploitation tool for a client engagement. The client requires that all tools be vetted for malicious behavior. The operator finds the tool on a public forum but the original author's website is down. What is the best course of action?

Download the tool from the forum and compare its hash to a hash published by the author before the site went down

Use the tool from the forum without verification because it is the only source

Ask the forum users if the tool is safe

Recreate the tool from source code if available

A penetration tester is installing Cobalt Strike on a Linux team server. The tester needs to ensure that the team server can receive HTTPS beacon callbacks from compromised hosts on an internal network. Which preparation step is most critical before starting the team server?

Open the HTTPS listener port on the firewall and confirm the team server has a route to the target network.

Create a new user account with sudo privileges for the team server process.

Disable SELinux to avoid blocking the team server process.

Install the latest version of Java and set the JAVA_HOME environment variable.

During the planning phase for installing a post-exploitation framework, which activity is most directly part of defining the installation scope?

Downloading the latest version of the framework from the vendor's website

Determining which target systems will need the tool and what actions the tool will perform

Configuring the firewall to allow outbound connections from the tool

Running a test command to confirm the tool executes without errors

A penetration tester is preparing to install a post-exploitation agent on a Windows server that has User Account Control (UAC) enabled. The tester has a standard user account. What should the tester do to prepare the environment for installation?

Run the installer in compatibility mode

Use a portable version of the tool that does not require installation

Disable UAC through the registry

Obtain administrative credentials or elevate privileges

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 1)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1foundation · easy
After installing a post-exploitation tool, which action is part of post-installation verification?
Select an answer first
2expert · hard
An operator needs to acquire a post-exploitation tool for a client engagement. The client requires that all tools be vetted for malicious behavior. The operator finds the tool on a public forum but the original author's website is down. What is the best course of action?
Select an answer first
3application · medium
A penetration tester is installing Cobalt Strike on a Linux team server. The tester needs to ensure that the team server can receive HTTPS beacon callbacks from compromised hosts on an internal network. Which preparation step is most critical before starting the team server?
Select an answer first
4foundation · easy
During the planning phase for installing a post-exploitation framework, which activity is most directly part of defining the installation scope?
Select an answer first
5application · medium
A penetration tester is preparing to install a post-exploitation agent on a Windows server that has User Account Control (UAC) enabled. The tester has a standard user account. What should the tester do to prepare the environment for installation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.