Installation GDAT Practice Questions (Page 9)

Questions 41–43

1. 41expert · hard

   An operator is installing a post-exploitation tool from source code on a Linux server. The source code is downloaded from a GitHub repository that has been archived by the original author. The operator wants to ensure the code has not been tampered with since the author archived it. Which step is most reliable?

   • AReview the source code manually for malicious changes.
   • BUse the latest commit on the repository as the reference.
   • CCompare the file sizes of the downloaded source with the files listed on GitHub.
   • DCheck the commit hash of the downloaded source against the hash recorded in the author's release notes.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An operator is installing a post-exploitation agent on a Windows host that has Application Control (AppLocker) enabled, allowing only signed executables. The operator has a signed binary that is not the agent. Which technique would allow the agent to run without triggering AppLocker?

   • ARun the agent from a network share that is excluded from AppLocker.
   • BUse the signed binary to load an unsigned DLL that contains the agent code, using DLL sideloading.
   • CRename the agent executable to match the signed binary's name.
   • DPlace the agent in the Windows System32 folder to bypass AppLocker.
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A red-team engagement requires installing a post-exploitation agent on a highly monitored Windows server. The SOC monitors process creation, network connections, and file writes. The agent must maintain stealth and provide interactive access. The operator has local admin rights but cannot install a kernel driver. Which approach best balances stealth and functionality?

   • ACompile a custom agent as a Windows service and disable event logging for the service.
   • BInstall a Windows service that runs the agent and connects to a non-standard TCP port.
   • CUse a DLL sideloading technique with a signed legitimate executable to load the agent.
   • DUse a fileless PowerShell agent that runs in memory and communicates over HTTPS to a redirector.
   Reveal Solution Discussion Select an answer first