A company is implementing network segmentation to limit lateral movement. The security team wants to ensure that a compromised workstation cannot reach the domain controllers. Which control is the most effective?

Disable the workstation's network interface

Place domain controllers in a separate VLAN and restrict access with firewall rules

Enable MAC address filtering on the workstation VLAN

Use a single flat network for all devices

A penetration tester is attempting to move laterally in a Windows environment. They have obtained a Kerberos ticket for a user and want to use it to access a web server. Which tool or method would be most appropriate?

Use the ticket with a tool like Rubeus to inject it into the current session and access the web server

Use the ticket to crack the user's password offline

Convert the ticket to an NTLM hash using a tool like mimikatz

Use the ticket to create a new domain admin account

How can network traffic analysis help detect lateral movement?

By identifying large data transfers to external servers

By blocking all traffic to the internet

By detecting encrypted traffic that cannot be decrypted

By spotting unusual internal connections, such as a workstation connecting to many other hosts on administrative ports

A company wants to limit the blast radius of a compromised domain admin account. The security team proposes implementing tiered administration, but the IT director is concerned about the operational overhead of managing multiple admin accounts. Which approach best balances security and operational overhead?

Use separate admin accounts for different tiers and restrict logon rights to each tier

Use a single admin account but restrict its logon hours

Use a single admin account but change the password every 30 days

Use a single admin account for all administrative tasks but enable Multi-Factor Authentication (MFA)

A company is implementing a least-privilege model to limit lateral movement. The security team wants to ensure that users only have access to the resources they need. Which approach is the most effective?

Use role-based access control (RBAC) to assign permissions based on job function

Disable all user accounts except for a few

Give all users the same level of access to simplify management

Use a single administrator account for all administrative tasks

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 2)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 6–10

6application · medium
A company is implementing network segmentation to limit lateral movement. The security team wants to ensure that a compromised workstation cannot reach the domain controllers. Which control is the most effective?
Select an answer first
7application · medium
A penetration tester is attempting to move laterally in a Windows environment. They have obtained a Kerberos ticket for a user and want to use it to access a web server. Which tool or method would be most appropriate?
Select an answer first
8foundation · easy
How can network traffic analysis help detect lateral movement?
Select an answer first
9application · medium
A company wants to limit the blast radius of a compromised domain admin account. The security team proposes implementing tiered administration, but the IT director is concerned about the operational overhead of managing multiple admin accounts. Which approach best balances security and operational overhead?
Select an answer first
10application · medium
A company is implementing a least-privilege model to limit lateral movement. The security team wants to ensure that users only have access to the resources they need. Which approach is the most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.