After installing a post-exploitation tool on a Windows server, the operator wants to confirm that the tool can execute commands with SYSTEM privileges. Which verification step is most appropriate?

Run a command that requires SYSTEM privileges, such as querying the SAM database

Check the tool's file properties for the 'Run as administrator' flag

Check the tool's version number

Verify the tool is in the Windows directory

A security analyst is setting up a lab to test a new post-exploitation framework. The analyst downloads the framework from a GitHub repository but notices the repository has no releases or tags. What should the analyst do to ensure the tool is trustworthy?

Use the tool as-is because it is on GitHub

Look for a package manager version of the tool

Check the commit history and verify the author's identity

Run the tool in a sandbox to see if it works

A red-team operator needs to deploy a post-exploitation agent to a Windows domain-joined workstation. The engagement rules prohibit using any tool that requires administrative privileges to install, and the operator must ensure the agent survives a reboot. The workstation has PowerShell 5.1 and no internet access. Which approach best satisfies the constraints?

Drop a DLL into the user's AppData folder and use a DLL search-order hijack on a system binary.

Schedule a task with schtasks.exe to run the agent at logon, storing the task in the system32 folder.

Use a PowerShell script that runs from the user's startup folder and connects to a local C2 server over SMB.

Compile a Windows service binary and register it with sc.exe using the current user's credentials.

What is the primary purpose of post-installation verification for a post-exploitation tool?

To document the tool's features for the team's knowledge base

To remove all traces of the installation from the target system

To confirm the tool is installed correctly and operates as intended in the target environment

To update the tool to the latest version available

An operator is deploying a post-exploitation agent to a Linux server that has SELinux enforcing. The agent needs to bind to a high port and read certain files. Which action should the operator take to ensure the agent runs without being blocked?

Set SELinux to permissive mode for the duration of the engagement.

Move the agent binary to /usr/bin to use a standard SELinux context.

Run the agent as root to bypass SELinux restrictions.

Create a custom SELinux policy module that allows the agent's specific operations.

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 7)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 31–35

31application · medium
After installing a post-exploitation tool on a Windows server, the operator wants to confirm that the tool can execute commands with SYSTEM privileges. Which verification step is most appropriate?
Select an answer first
32application · medium
A security analyst is setting up a lab to test a new post-exploitation framework. The analyst downloads the framework from a GitHub repository but notices the repository has no releases or tags. What should the analyst do to ensure the tool is trustworthy?
Select an answer first
33application · medium
A red-team operator needs to deploy a post-exploitation agent to a Windows domain-joined workstation. The engagement rules prohibit using any tool that requires administrative privileges to install, and the operator must ensure the agent survives a reboot. The workstation has PowerShell 5.1 and no internet access. Which approach best satisfies the constraints?
Select an answer first
34foundation · easy
What is the primary purpose of post-installation verification for a post-exploitation tool?
Select an answer first
35application · medium
An operator is deploying a post-exploitation agent to a Linux server that has SELinux enforcing. The agent needs to bind to a high port and read certain files. Which action should the operator take to ensure the agent runs without being blocked?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.