An incident responder discovers that an attacker used a compromised service account to create a service on a remote server and execute a payload. Which lateral movement technique is this?

WMI event subscription for persistence

Pass-the-ticket to access the server's file share

DCOM remote execution via MMC20.Application

Remote service execution via SCM (Service Control Manager)

Which of the following is a primary method for detecting lateral movement?

Scanning for open ports on all internal systems

Reviewing authentication logs for successful logons from unusual source hosts or at unusual times

Monitoring for unusual authentication patterns, such as multiple failed logins from a single source

Analyzing network traffic for connections to known malicious IP addresses

GIAC Defending Advanced Threats

Domain 2Objective 2

Lateral Movement GDAT Practice Questions (Page 9)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 41–42

41application · medium
An incident responder discovers that an attacker used a compromised service account to create a service on a remote server and execute a payload. Which lateral movement technique is this?
Select an answer first
42foundation · easy
Which of the following is a primary method for detecting lateral movement?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Lateral Movement GDAT Practice Questions (Page 9)

Questions 41–42

An incident responder discovers that an attacker used a compromised service account to create a service on a remote server and execute a payload. Which lateral movement technique is this?

Which of the following is a primary method for detecting lateral movement?

Keep studying — Post-Exploitation and Movement