An attacker has compromised a workstation and obtained the NTLM hash of a domain user. The attacker wants to move laterally to a file server that the user has access to. Which technique would the attacker most likely use?

Use a remote desktop protocol (RDP) session with the hash

Pass-the-hash to authenticate to the file server using the NTLM hash

Pass-the-ticket using a Kerberos ticket

Overpass-the-hash to request a Kerberos ticket from the hash

A company is implementing network segmentation to limit lateral movement. The security team wants to prevent a compromised workstation in the user VLAN from reaching the database servers in the data center VLAN. Which control would be the most effective?

Enable port security on the user VLAN switches

Implement 802.1X authentication on the user VLAN

Configure a firewall rule that blocks all traffic from the user VLAN to the data center VLAN except on the required database port

Use a VLAN ACL on the data center VLAN

A penetration tester has compromised a domain-joined workstation and wants to move to a file server. The tester has obtained the NTLM hash of a user who has access to the file server. Which action would be most consistent with the lateral movement phase?

Enumerate the file server's open ports using a port scanner

Use the hash to authenticate to the file server via SMB using pass-the-hash

Dump the file server's memory to extract credentials

Create a new domain admin account for persistence

A threat hunter is analyzing a series of events that suggest lateral movement. They see a workstation authenticating to a server using a service account, followed by the creation of a remote service on that server. The service account is not supposed to have administrative rights on the server. Which conclusion is most likely?

The service account has been compromised and is being used for lateral movement via remote service execution

The workstation is infected with malware that is spreading automatically

The service account is legitimately performing maintenance tasks

The server is misconfigured and allowing unauthorized service creation

A company wants to limit the ability of attackers to move laterally from a compromised workstation to sensitive servers. They have already implemented least privilege for user accounts. Which additional control would be most effective in directly restricting lateral movement paths?

Implementing a SIEM to correlate authentication logs

Enforcing complex password policies for all users

Network segmentation with firewall rules that block unnecessary SMB and RDP traffic between workstation and server segments

Deploying a host-based intrusion prevention system on all servers

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 6)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 26–30

26application · medium
An attacker has compromised a workstation and obtained the NTLM hash of a domain user. The attacker wants to move laterally to a file server that the user has access to. Which technique would the attacker most likely use?
Select an answer first
27application · medium
A company is implementing network segmentation to limit lateral movement. The security team wants to prevent a compromised workstation in the user VLAN from reaching the database servers in the data center VLAN. Which control would be the most effective?
Select an answer first
28application · medium
A penetration tester has compromised a domain-joined workstation and wants to move to a file server. The tester has obtained the NTLM hash of a user who has access to the file server. Which action would be most consistent with the lateral movement phase?
Select an answer first
29expert · hard
A threat hunter is analyzing a series of events that suggest lateral movement. They see a workstation authenticating to a server using a service account, followed by the creation of a remote service on that server. The service account is not supposed to have administrative rights on the server. Which conclusion is most likely?
Select an answer first
30application · medium
A company wants to limit the ability of attackers to move laterally from a compromised workstation to sensitive servers. They have already implemented least privilege for user accounts. Which additional control would be most effective in directly restricting lateral movement paths?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.