A security team is investigating a breach at a government agency. The agency's network is air-gapped from the internet. The attackers left a USB drive in the parking lot, and an employee plugged it into a workstation. The USB drive contained a file that, when opened, executed a macro that decoded an encrypted payload and installed a rootkit that persists via a bootkit. Which two techniques are being used?

Email attachment and malicious link

Watering hole and drive-by download

Removable media and obfuscation via encryption

During an incident response, an analyst discovers that a malicious payload was delivered via a spear-phishing email and executed on a user's workstation. The payload created a scheduled task that runs a PowerShell script every time the user logs on. The analyst needs to recommend a control that would prevent this persistence mechanism from being established in the future.

Disable the Task Scheduler service on all workstations.

Use a host-based firewall to block outbound connections from PowerShell.

Implement application control that only allows approved executables and scripts to run.

Enable Windows Defender Credential Guard to protect credentials from being stolen.

How does malvertising facilitate payload delivery?

By creating fake social media profiles to trick users into downloading malware.

By sending unsolicited bulk emails that contain malicious links.

By compromising a website that the target organization frequently visits.

By placing malicious advertisements on legitimate websites that redirect users to exploit kits or malicious sites.

During an incident response, an analyst finds that a malicious payload was delivered via a phishing email and executed through a macro. The analyst also discovers a scheduled task that runs the payload every time the user logs on. Which two techniques are being used?

Payload delivery via email and persistence via scheduled task

Removable media and physical delivery

Drive-by download and exploit kit

Why might an attacker choose a watering hole attack over spear-phishing?

Because it can compromise multiple members of a target group without sending them any direct messages.

Because it is less likely to be detected by security tools than any other method.

Because it does not require any technical vulnerability in the target's browser or plugins.

Because it is easier to deliver a payload to a specific individual through a website than through email.

GIAC Defending Advanced Threats

Domain 1Objective 1

Payload Delivery GDAT Practice Questions (Page 1)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 1–5

1expert · hard
A security team is investigating a breach at a government agency. The agency's network is air-gapped from the internet. The attackers left a USB drive in the parking lot, and an employee plugged it into a workstation. The USB drive contained a file that, when opened, executed a macro that decoded an encrypted payload and installed a rootkit that persists via a bootkit. Which two techniques are being used?
Select an answer first
2application · medium
During an incident response, an analyst discovers that a malicious payload was delivered via a spear-phishing email and executed on a user's workstation. The payload created a scheduled task that runs a PowerShell script every time the user logs on. The analyst needs to recommend a control that would prevent this persistence mechanism from being established in the future.
Select an answer first
3foundation · easy
How does malvertising facilitate payload delivery?
Select an answer first
4application · medium
During an incident response, an analyst finds that a malicious payload was delivered via a phishing email and executed through a macro. The analyst also discovers a scheduled task that runs the payload every time the user logs on. Which two techniques are being used?
Select an answer first
5foundation · easy
Why might an attacker choose a watering hole attack over spear-phishing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Payload Delivery GDAT Practice Questions (Page 1)

Questions 1–5

How does malvertising facilitate payload delivery?

During an incident response, an analyst finds that a malicious payload was delivered via a phishing email and executed through a macro. The analyst also discovers a scheduled task that runs the payload every time the user logs on. Which two techniques are being used?

Why might an attacker choose a watering hole attack over spear-phishing?

Keep studying — Initial Access and Execution