Installation GDAT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Before deploying a post-exploitation agent, which environment preparation step is essential to ensure the agent can communicate with the command-and-control server?

   • AChanging the target's hostname to a random string
   • BConfiguring the target's firewall to allow outbound traffic to the server's IP and port
   • CDisabling the target's antivirus software permanently
   • DInstalling the latest version of Python on the target system
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A red-team operator is planning to install a post-exploitation framework on a Windows 10 workstation that is used by a developer. The engagement rules prohibit any disruption to the user's work. What should the operator include in the installation plan?

   • AA plan to disable the user's antivirus
   • BA schedule to install the tool during the user's lunch break
   • CA backup of the user's files before installation
   • DA rollback plan to remove the tool quickly if the user complains
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An operator is deploying a PowerShell-based post-exploitation tool to a Windows host. The tool must run without triggering AMSI or logging to the PowerShell event log. Which deployment method is most likely to achieve this?

   • AEncode the script in Base64 and pass it to powershell.exe -EncodedCommand.
   • BSave the script to disk in the user's Temp folder and run it with powershell.exe -ExecutionPolicy Bypass.
   • CExecute the script from memory using a reflective loader that patches AMSI and skips script block logging.
   • DUse a compiled .NET executable that invokes the PowerShell script via the .NET API.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   After installing a post-exploitation tool on a Linux server, the operator notices that the tool's process is killed shortly after starting. The tool worked in a lab environment. What is the most likely cause?

   • AThe server does not have enough memory to run the tool
   • BThe tool's process is being terminated by an endpoint protection product
   • CThe tool is incompatible with the server's kernel version
   • DThe tool's configuration file is malformed
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After installing a persistence mechanism on a Windows workstation, an operator needs to verify that it will survive a reboot and execute with the correct privileges. Which verification step is most appropriate?

   • ARun the persistence command manually and observe the output.
   • BReboot the workstation and check that the persistence mechanism runs and establishes a callback.
   • CReview the event logs for the previous boot to see if the mechanism ran.
   • DCheck the registry key or scheduled task exists and has the correct file path.
   Reveal Solution Discussion Select an answer first