Lateral Movement GDAT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is reviewing Windows event logs for signs of lateral movement. The analyst sees a large number of Event ID 4624 (successful logon) with Logon Type 3 (network) from a single workstation to many servers. Which additional log would be most useful to determine if the attacker is using pass-the-hash?

   • AEvent ID 4648 (explicit credentials logon)
   • BEvent ID 4688 (process creation) on the source workstation
   • CEvent ID 4624 with Logon Type 3 and the same account name
   • DEvent ID 4768 (Kerberos ticket granting ticket request)
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst observes a series of successful authentication events from a compromised workstation to multiple servers using a service account that has never been used from that workstation before. The analyst suspects lateral movement. Which technique is most consistent with this observation?

   • AGolden ticket forgery using the KRBTGT hash
   • BPass-the-hash using the service account's NTLM hash
   • CSkeleton key injection on a domain controller
   • DKerberoasting to request service tickets for the service account
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is investigating a potential lateral movement incident. The analyst sees a large number of failed logon attempts followed by a successful logon on a server. The successful logon used a different account than the failed attempts. Which technique does this pattern suggest?

   • APassword spraying
   • BPass-the-ticket
   • CRemote service execution
   • DPass-the-hash
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the context of post-exploitation, what is the primary purpose of lateral movement?

   • ATo exfiltrate data from the compromised host to an external server
   • BTo move from the initial foothold to other systems within the network to expand access and achieve objectives
   • CTo establish persistence by creating scheduled tasks on the compromised host
   • DTo escalate privileges on the initially compromised host
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How does the principle of least privilege help mitigate lateral movement?

   • AIt limits the accounts and credentials an attacker can compromise and use to access other systems
   • BIt ensures that all users have administrative rights to perform their tasks efficiently
   • CIt requires all network traffic to be encrypted
   • DIt prevents attackers from exploiting vulnerabilities in software
   Reveal Solution Discussion Select an answer first