Payload Delivery GDAT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user receives an email with a link that appears to go to a legitimate file-sharing site. When clicked, the link downloads a JavaScript file that, when executed, runs a PowerShell command to download and run a remote payload. Which delivery mechanism and obfuscation technique are being used?

   • AMalicious link and script-based obfuscation
   • BEmail attachment and encryption
   • CDrive-by download and exploit kit
   • DRemovable media and polymorphism
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is analyzing a malicious document that contains a macro. The macro uses a polymorphic generator to create a new instance of the payload each time it runs. The payload is then executed via a scheduled task. Which two techniques are being used?

   • ARemovable media and physical delivery
   • BWatering hole and malvertising
   • CEmail attachment and exploit kit
   • DPolymorphic obfuscation and persistence via scheduled task
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A non-profit organization that advocates for a specific political cause has been targeted by a watering hole attack. The attackers compromised a website that the organization's staff frequently visits to research legislation. The website now contains a hidden iframe that loads an exploit kit. The organization wants to detect if any of its staff have been compromised. Which of the following actions would be most effective?

   • ACheck for the presence of known indicators of compromise (IOCs) such as specific registry keys or files associated with the exploit kit.
   • BUse endpoint detection and response (EDR) to hunt for suspicious processes, network connections, and other behaviors that indicate exploitation.
   • CReview web proxy logs to identify which staff members visited the compromised website during the time of the attack.
   • DRun a full antivirus scan on all staff workstations.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of payload delivery via removable media?

   • AAn attacker compromises a website that employees visit to deliver malware.
   • BAn attacker leaves a USB drive in a parking lot, and an employee picks it up and plugs it into a company computer.
   • CAn attacker sends a phishing email with a link to a malicious website.
   • DAn attacker uses a malicious advertisement to redirect users to an exploit kit.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a polymorphic payload?

   • AA payload that is encrypted with a fixed key and stored in a file.
   • BA payload that is split into multiple parts and reassembled at runtime.
   • CA payload that is encoded using Base64 to hide it from plain-text detection.
   • DA payload that changes its code signature each time it is downloaded or executed, while maintaining the same functionality.
   Reveal Solution Discussion Select an answer first