A SOC analyst is reviewing network traffic and notices an unusual pattern: a workstation is making repeated SMB connections to multiple servers, and each connection is followed by a scheduled task creation on the target. Which lateral movement technique is most likely being used?

LLMNR poisoning to capture credentials

Remote service execution via scheduled tasks

Pass-the-ticket to access file shares

DCSync to replicate domain credentials

A company is implementing a zero-trust architecture to limit lateral movement. They have a mix of on-premises and cloud workloads. Which approach would be most effective in enforcing identity-based access controls across both environments?

Implement a single sign-on (SSO) solution with conditional access policies that require device compliance and risk-based authentication

Use a VPN for all remote access to the network

Segment the network into multiple VLANs with strict firewall rules

Deploy a network access control (NAC) solution for all endpoints

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 1)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 1–5

1expert · hard
A security analyst is reviewing logs after a suspected lateral movement incident. The analyst sees a successful logon from a workstation to a server using a service account. The service account has administrative rights on the server. The analyst also notices that the workstation has been compromised with malware that can extract Kerberos tickets. Which technique is the attacker most likely using?
Select an answer first
2application · medium
A SOC analyst is reviewing network traffic and notices an unusual pattern: a workstation is making repeated SMB connections to multiple servers, and each connection is followed by a scheduled task creation on the target. Which lateral movement technique is most likely being used?
Select an answer first
3expert · hard
A company is implementing a zero-trust architecture to limit lateral movement. They have a mix of on-premises and cloud workloads. Which approach would be most effective in enforcing identity-based access controls across both environments?
Select an answer first
4application · medium
An attacker has compromised a domain controller and extracted a Kerberos ticket for a highly privileged account. The attacker wants to use this ticket to access a file server. Which technique is the attacker using?
Select an answer first
5application · medium
A security analyst is monitoring network traffic for signs of lateral movement. The analyst notices a series of SMB connections from a workstation to multiple servers, each followed by a service creation request (e.g., SC Manager). Which lateral movement technique does this pattern suggest?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Lateral Movement GDAT Practice Questions (Page 1)

Questions 1–5

A SOC analyst is reviewing network traffic and notices an unusual pattern: a workstation is making repeated SMB connections to multiple servers, and each connection is followed by a scheduled task creation on the target. Which lateral movement technique is most likely being used?

A company is implementing a zero-trust architecture to limit lateral movement. They have a mix of on-premises and cloud workloads. Which approach would be most effective in enforcing identity-based access controls across both environments?

An attacker has compromised a domain controller and extracted a Kerberos ticket for a highly privileged account. The attacker wants to use this ticket to access a file server. Which technique is the attacker using?

A security analyst is monitoring network traffic for signs of lateral movement. The analyst notices a series of SMB connections from a workstation to multiple servers, each followed by a service creation request (e.g., SC Manager). Which lateral movement technique does this pattern suggest?

Keep studying — Post-Exploitation and Movement