A red team is simulating an advanced attacker. They have compromised a domain controller and want to move laterally to a database server. The database server only accepts Kerberos authentication and has a host firewall that only allows traffic from a specific management subnet. Which technique would be most effective for the red team to use?

Use WMI to execute a payload on the database server

Disable the host firewall on the database server remotely

Forge a Kerberos ticket for a service account that has access to the database server and use pass-the-ticket from a host on the management subnet

Use pass-the-hash with the database administrator's NTLM hash

Which of the following best describes a pass-the-hash attack?

Forcing a user to authenticate to a malicious server to capture their credentials

Intercepting a Kerberos ticket and replaying it to gain access to a service

Cracking a password hash offline to recover the plaintext password

Using a captured password hash to authenticate to other systems without knowing the plaintext password

A SOC analyst is reviewing logs after a suspected breach. The analyst sees a series of successful logons from a single workstation to multiple servers within a few minutes, each using the same account. The logon type is 3 (network) and the source IP is the same. Which additional evidence would most strongly indicate pass-the-hash rather than normal administrative activity?

The account is a standard user account with no administrative rights on the destination servers

The account had recently changed its password

The destination servers are all in the same subnet

The logons occurred during normal business hours

A company is designing a network architecture to limit lateral movement. They have a tiered model where administrative access to servers is only allowed from a dedicated jump host. Which principle does this primarily implement?

Least privilege by removing all local admin rights

Network segmentation and privileged access workstation (PAW) concept

Data loss prevention by restricting USB devices

Application whitelisting on all servers

An incident response team is investigating a suspected lateral movement campaign. They have access to Windows Security logs, network flow data, and endpoint detection and response (EDR) alerts. The team needs to identify the initial entry point and the full scope of movement. Which combination of data sources would be most effective?

Correlate EDR alerts with Windows Security logs to trace process creation and authentication events across hosts

Use EDR alerts only, as they contain all necessary information

Use only network flow data to identify all connections between hosts

Rely solely on Windows Security logs to identify logon events

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 7)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 31–35

31expert · hard
A red team is simulating an advanced attacker. They have compromised a domain controller and want to move laterally to a database server. The database server only accepts Kerberos authentication and has a host firewall that only allows traffic from a specific management subnet. Which technique would be most effective for the red team to use?
Select an answer first
32foundation · easy
Which of the following best describes a pass-the-hash attack?
Select an answer first
33application · medium
A SOC analyst is reviewing logs after a suspected breach. The analyst sees a series of successful logons from a single workstation to multiple servers within a few minutes, each using the same account. The logon type is 3 (network) and the source IP is the same. Which additional evidence would most strongly indicate pass-the-hash rather than normal administrative activity?
Select an answer first
34application · medium
A company is designing a network architecture to limit lateral movement. They have a tiered model where administrative access to servers is only allowed from a dedicated jump host. Which principle does this primarily implement?
Select an answer first
35expert · hard
An incident response team is investigating a suspected lateral movement campaign. They have access to Windows Security logs, network flow data, and endpoint detection and response (EDR) alerts. The team needs to identify the initial entry point and the full scope of movement. Which combination of data sources would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Lateral Movement GDAT Practice Questions (Page 7)

Questions 31–35

Which of the following best describes a pass-the-hash attack?

A company is designing a network architecture to limit lateral movement. They have a tiered model where administrative access to servers is only allowed from a dedicated jump host. Which principle does this primarily implement?

Keep studying — Post-Exploitation and Movement