An operator is about to install a Python-based post-exploitation tool on a Windows machine that has Python 3.8 installed. The tool requires Python 3.9 or later. What should the operator do first?

Run the tool and see if it works despite the version mismatch

Disable the Windows firewall to avoid network issues

Upgrade Python to a compatible version

An operator needs to install a specific version of a post-exploitation tool that is no longer available on the official repository. The operator finds a copy on a community forum. What should the operator do before using it?

Trust the forum post because it has many positive comments from other users.

Compare the file's hash to a hash published by the original author in archived documentation.

Run the tool in a virtual machine to see if it functions correctly.

Use the file as-is because it is the only available copy.

During a red-team engagement, an operator needs to install a backdoor on a Windows server that has application whitelisting enabled. Which deployment method is most likely to succeed while avoiding detection?

Use a signed binary that is already whitelisted

Rename the backdoor to match a whitelisted application

Disable the application whitelisting service temporarily

Compile a custom binary and place it in the startup folder

An operator is installing a post-exploitation agent on a Linux server that has a strict egress firewall. The agent needs to communicate with a C2 server on the internet. What should the operator verify before deploying the agent?

The server can reach the C2 server's IP and port through the firewall

The server has enough disk space for the agent

The server has a public IP address

The agent is compatible with the server's kernel version

A red-team operator must install a post-exploitation framework on a Linux server that is part of a high-availability cluster. The engagement rules require that the installation not cause a failover. What should the operator prioritize in the installation plan?

Use the latest version of the framework

Install the framework on all cluster nodes simultaneously

Minimize resource usage and avoid restarting services

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 3)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 11–15

11application · easy
An operator is about to install a Python-based post-exploitation tool on a Windows machine that has Python 3.8 installed. The tool requires Python 3.9 or later. What should the operator do first?
Select an answer first
12application · medium
An operator needs to install a specific version of a post-exploitation tool that is no longer available on the official repository. The operator finds a copy on a community forum. What should the operator do before using it?
Select an answer first
13application · medium
During a red-team engagement, an operator needs to install a backdoor on a Windows server that has application whitelisting enabled. Which deployment method is most likely to succeed while avoiding detection?
Select an answer first
14application · medium
An operator is installing a post-exploitation agent on a Linux server that has a strict egress firewall. The agent needs to communicate with a C2 server on the internet. What should the operator verify before deploying the agent?
Select an answer first
15expert · hard
A red-team operator must install a post-exploitation framework on a Linux server that is part of a high-availability cluster. The engagement rules require that the installation not cause a failover. What should the operator prioritize in the installation plan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.