A security team is evaluating controls to reduce lateral movement in an environment with a high risk of credential theft. They have a limited budget and need to prioritize. Which control would provide the most significant reduction in lateral movement risk for the investment?

Implementing privileged access management (PAM) to rotate and isolate administrative credentials

Increasing the frequency of vulnerability scans

Deploying additional endpoint detection and response (EDR) agents

Purchasing a new SIEM for better log correlation

A security analyst is investigating a suspected lateral movement incident. The analyst sees a series of successful logons from a workstation to multiple servers, but the logons are using different accounts. The analyst also notices that the workstation has recently been infected with malware that extracts credentials from memory. Which technique is the attacker most likely using?

Pass-the-ticket with multiple tickets

Pass-the-hash with multiple hashes

A penetration tester is on a compromised Windows workstation and wants to move laterally to a Linux server that is used for development. The Linux server is configured to accept SSH key-based authentication only. Which technique would be most effective?

Search for SSH private keys on the workstation and use them to authenticate to the Linux server

Use a Kerberos ticket to access the Linux server via SSH

Use pass-the-hash to authenticate to the Linux server via SMB

Exploit a vulnerability in the SSH service to execute commands

What is a common characteristic of remote service execution as a lateral movement technique?

It requires physical access to the target machine

It uses a legitimate remote administration protocol to execute commands or binaries on a remote host

It relies on exploiting a vulnerability in a network service to gain a shell

It involves creating a new user account on the target system

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 4)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 16–20

16application · medium
An attacker has compromised a server and wants to move laterally to a domain controller. The attacker has obtained the NTLM hash of a domain admin account. Which technique would allow the attacker to authenticate to the domain controller without knowing the plaintext password?
Select an answer first
17expert · hard
A security team is evaluating controls to reduce lateral movement in an environment with a high risk of credential theft. They have a limited budget and need to prioritize. Which control would provide the most significant reduction in lateral movement risk for the investment?
Select an answer first
18expert · hard
A security analyst is investigating a suspected lateral movement incident. The analyst sees a series of successful logons from a workstation to multiple servers, but the logons are using different accounts. The analyst also notices that the workstation has recently been infected with malware that extracts credentials from memory. Which technique is the attacker most likely using?
Select an answer first
19expert · hard
A penetration tester is on a compromised Windows workstation and wants to move laterally to a Linux server that is used for development. The Linux server is configured to accept SSH key-based authentication only. Which technique would be most effective?
Select an answer first
20foundation · easy
What is a common characteristic of remote service execution as a lateral movement technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Lateral Movement GDAT Practice Questions (Page 4)

Questions 16–20

An attacker has compromised a server and wants to move laterally to a domain controller. The attacker has obtained the NTLM hash of a domain admin account. Which technique would allow the attacker to authenticate to the domain controller without knowing the plaintext password?

A security team is evaluating controls to reduce lateral movement in an environment with a high risk of credential theft. They have a limited budget and need to prioritize. Which control would provide the most significant reduction in lateral movement risk for the investment?

A penetration tester is on a compromised Windows workstation and wants to move laterally to a Linux server that is used for development. The Linux server is configured to accept SSH key-based authentication only. Which technique would be most effective?

What is a common characteristic of remote service execution as a lateral movement technique?

Keep studying — Post-Exploitation and Movement