An operator is downloading a post-exploitation tool from a vendor's website. The website offers a checksum file alongside the installer. What should the operator do to verify the download?

Run the installer and see if it works

Compare the checksum of the downloaded file to the checksum in the provided file

Verify the website's SSL certificate

Check the file size to ensure it is large enough

After installing a post-exploitation agent on a Linux host, the operator runs a test command but receives no output. The agent process is running. What should the operator check first?

Network connectivity to the C2 server

The system's firewall rules for inbound connections

The agent's configuration file for correct API endpoints

During deployment of a post-exploitation tool, which practice best helps avoid detection while maintaining stability?

Disabling all security monitoring tools on the target

Installing the tool in a temporary directory to clean up later

Using a stealthy installation method that mimics normal system activity

Running the installer with the highest possible privileges to ensure success

A penetration tester is setting up a Linux-based C2 server that must accept inbound connections from beacons on a segmented network. The tester has configured the listener and firewall, but beacons cannot connect. Which troubleshooting step should be performed first?

Rebuild the beacon payload with a different DNS name for the C2 server.

Check the beacon's configuration file for typos in the C2 URL.

Disable the firewall entirely to rule out firewall issues.

Verify that the listener is bound to the correct interface and port using netstat or ss.

After installing a persistence mechanism on a Windows domain controller, an operator wants to confirm it will survive a reboot. Which action provides the most reliable verification?

Check the registry key exists and has correct permissions

Verify the system time is synchronized with the domain

Reboot the system and check if the persistence mechanism is active

Run the persistence command manually and observe the output

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 5)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21application · easy
An operator is downloading a post-exploitation tool from a vendor's website. The website offers a checksum file alongside the installer. What should the operator do to verify the download?
Select an answer first
22application · medium
After installing a post-exploitation agent on a Linux host, the operator runs a test command but receives no output. The agent process is running. What should the operator check first?
Select an answer first
23foundation · easy
During deployment of a post-exploitation tool, which practice best helps avoid detection while maintaining stability?
Select an answer first
24application · medium
A penetration tester is setting up a Linux-based C2 server that must accept inbound connections from beacons on a segmented network. The tester has configured the listener and firewall, but beacons cannot connect. Which troubleshooting step should be performed first?
Select an answer first
25application · medium
After installing a persistence mechanism on a Windows domain controller, an operator wants to confirm it will survive a reboot. Which action provides the most reliable verification?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.