An operator downloads a post-exploitation framework from a mirror site and wants to verify its authenticity before deployment. The framework's official site lists a SHA-256 hash and a PGP signature. Which step should the operator take first?

Compare the SHA-256 hash with the one listed on the mirror site.

Run the file in a sandbox to see if it behaves as expected.

Verify the PGP signature using the developer's public key from a key server.

Check the file's digital signature in Windows Explorer properties.

An operator is deploying a post-exploitation agent to a Linux server that has SELinux enforcing. The agent is not starting after installation. What should the operator do to resolve the issue?

Check SELinux audit logs and adjust the policy or context for the agent

Reinstall the agent with a different installer

Run the agent as root to bypass SELinux

A red-team operator must install a post-exploitation framework on a high-security Windows domain controller. The engagement rules require minimal footprint and no reboots. The operator has local admin but not domain admin. Which installation approach best balances stealth and functionality?

Use a scheduled task that runs at logon

Use a fileless in-memory loader that runs from PowerShell without writing to disk

Copy the tool to the Windows directory and run it

Install a service that runs as SYSTEM for persistence

When obtaining a post-exploitation tool from a trusted source, which practice best verifies the tool's integrity and authenticity?

Reading user reviews on a public forum to confirm the tool works as expected

Ensuring the tool is available from multiple download mirrors

Comparing the tool's SHA-256 hash against the value published by the vendor

Checking that the tool's filename matches the version number in the documentation

A red-team operator needs to deploy Cobalt Strike on a Windows 10 workstation that has no internet access. The operator has a USB drive with the installer and a SHA-256 hash printed on a label. Which step is most important before running the installer?

Run the installer as an administrator

Verify the SHA-256 hash of the installer matches the label

Disable Windows Defender before copying the installer

GIAC Defending Advanced Threats

Domain 2Objective 1

Installation GDAT Practice Questions (Page 8)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 36–40

36application · medium
An operator downloads a post-exploitation framework from a mirror site and wants to verify its authenticity before deployment. The framework's official site lists a SHA-256 hash and a PGP signature. Which step should the operator take first?
Select an answer first
37application · medium
An operator is deploying a post-exploitation agent to a Linux server that has SELinux enforcing. The agent is not starting after installation. What should the operator do to resolve the issue?
Select an answer first
38expert · hard
A red-team operator must install a post-exploitation framework on a high-security Windows domain controller. The engagement rules require minimal footprint and no reboots. The operator has local admin but not domain admin. Which installation approach best balances stealth and functionality?
Select an answer first
39foundation · easy
When obtaining a post-exploitation tool from a trusted source, which practice best verifies the tool's integrity and authenticity?
Select an answer first
40application · medium
A red-team operator needs to deploy Cobalt Strike on a Windows 10 workstation that has no internet access. The operator has a USB drive with the installer and a SHA-256 hash printed on a label. Which step is most important before running the installer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.