Which item is a prerequisite that should be confirmed before installing a post-exploitation tool on a target system?

The tool's source code has been reviewed by the development team

The target system has sufficient disk space and memory to run the tool

The tool has been compiled with the latest compiler optimizations

The target system's hostname has been changed to avoid detection

An operator needs to install a post-exploitation framework on an air-gapped network. The operator can bring a USB drive into the facility, but all files are subject to inspection. The framework's official site provides a PGP signature and a SHA-256 hash. Which action best ensures the integrity and authenticity of the software?

Download the framework and signature on an internet-connected machine, verify the PGP signature, then copy the verified files to the USB drive.

Use the USB drive to transfer the framework and also bring a copy of the public key from the official site.

Copy the framework and signature to the USB drive and verify the PGP signature on the air-gapped machine.

Copy the framework to the USB drive and compare its SHA-256 hash to the one on the official site printed on paper.

A penetration tester is planning to install a post-exploitation framework on a compromised Linux server. The tester needs to avoid disrupting a critical production database running on the same host. Which planning step is most important?

Document the server's resource usage and schedule installation during low-activity hours

Create a backup of the database before installation

Download the latest version of the framework from the vendor's website

Verify the framework's license and legal compliance

Which action is a recommended best practice when executing the installation of a post-exploitation framework?

Following the vendor's installation instructions and using the appropriate options for the target environment

Modifying the installation script to skip all error checks to save time

Installing the tool on every system in the network simultaneously

Using the default configuration without reviewing it for compatibility

After installing a post-exploitation tool on a Windows host, an operator runs a test command and receives an error that a required DLL is missing. The tool was working on the operator's lab machine. What is the most likely cause?

The target host's architecture is different from the lab machine.

The tool's configuration file is corrupted.

The target host does not have a required Visual C++ Redistributable installed.

The tool was not copied to the same folder as the DLL.

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 2)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 6–10

6foundation · easy
Which item is a prerequisite that should be confirmed before installing a post-exploitation tool on a target system?
Select an answer first
7expert · hard
An operator needs to install a post-exploitation framework on an air-gapped network. The operator can bring a USB drive into the facility, but all files are subject to inspection. The framework's official site provides a PGP signature and a SHA-256 hash. Which action best ensures the integrity and authenticity of the software?
Select an answer first
8application · medium
A penetration tester is planning to install a post-exploitation framework on a compromised Linux server. The tester needs to avoid disrupting a critical production database running on the same host. Which planning step is most important?
Select an answer first
9foundation · easy
Which action is a recommended best practice when executing the installation of a post-exploitation framework?
Select an answer first
10application · medium
After installing a post-exploitation tool on a Windows host, an operator runs a test command and receives an error that a required DLL is missing. The tool was working on the operator's lab machine. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.