An operator needs to deploy a post-exploitation agent to multiple Windows servers in a segmented network. The agent must be installed without rebooting and without using a central management console. Which deployment method is most efficient and reliable?

Manually log into each server and run the installer

Use PowerShell remoting to run the installer on each server

Create a GPO to deploy the agent

Use a USB drive to install the agent on each server

Which action is part of preparing the target environment before installing a post-exploitation tool?

Uploading the tool to a public file-sharing service for backup

Deleting all logs from the target to avoid detection

Ensuring the target has the required runtime libraries and permissions

Running a vulnerability scanner against the target to identify weaknesses

A penetration tester is preparing to install a post-exploitation agent on a Linux server that is monitored by a host-based intrusion detection system (HIDS). The tester has root access but wants to avoid triggering alerts. Which environment preparation step is most effective?

Use a rootkit to hide the agent from the HIDS

Run the agent only during maintenance windows

Identify and temporarily disable the HIDS monitoring processes

Install the agent in a directory that is excluded from HIDS scans

Which action is most appropriate when downloading a post-exploitation script from a public repository?

Download over HTTPS and verify the file's digital signature or checksum

Download over HTTP to avoid compatibility issues with the target system

Use a direct IP address instead of a domain name to bypass DNS filtering

Copy the script from a colleague's USB drive without further checks

A red team is planning to install a post-exploitation framework on a cloud-hosted team server. The engagement requires that all C2 traffic be encrypted and that the team server's IP address not be exposed in DNS. Which setup best meets these requirements?

Use a DNS over HTTPS (DoH) listener that resolves to the team server's public IP.

Use a redirector with a TLS certificate and a domain that points to the redirector, not the team server.

Use an HTTP listener behind a CDN that caches the C2 responses.

Use a direct HTTPS listener on the team server with a self-signed certificate.

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 6)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 26–30

26expert · hard
An operator needs to deploy a post-exploitation agent to multiple Windows servers in a segmented network. The agent must be installed without rebooting and without using a central management console. Which deployment method is most efficient and reliable?
Select an answer first
27foundation · easy
Which action is part of preparing the target environment before installing a post-exploitation tool?
Select an answer first
28expert · hard
A penetration tester is preparing to install a post-exploitation agent on a Linux server that is monitored by a host-based intrusion detection system (HIDS). The tester has root access but wants to avoid triggering alerts. Which environment preparation step is most effective?
Select an answer first
29foundation · easy
Which action is most appropriate when downloading a post-exploitation script from a public repository?
Select an answer first
30application · medium
A red team is planning to install a post-exploitation framework on a cloud-hosted team server. The engagement requires that all C2 traffic be encrypted and that the team server's IP address not be exposed in DNS. Which setup best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.