Payload Delivery GDAT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating a breach where users were infected after visiting a popular website. The website displayed ads that redirected to a malicious page that exploited a browser vulnerability. The payload was encrypted and then executed in memory, with no file written to disk. The payload also created a scheduled task for persistence. Which two techniques are being used?

   • AWatering hole and persistence via service
   • BMalvertising and fileless execution
   • CEmail attachment and macro
   • DRemovable media and physical delivery
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of establishing persistence on a compromised system?

   • ATo make the payload undetectable by network monitoring.
   • BTo ensure the attacker can maintain access to the system across reboots and logoff events.
   • CTo hide the payload from antivirus software.
   • DTo increase the speed of the payload's execution.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is investigating a breach where users were infected after visiting a popular online forum. The forum had been compromised with a malicious script that exploited a browser vulnerability. The script delivered a payload that was encrypted with a custom algorithm. Which two techniques are being used?

   • AWatering hole and obfuscation via encryption
   • BMalvertising and exploit kit
   • CRemovable media and physical delivery
   • DEmail attachment and macro
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A defense contractor discovers that a niche industry forum frequently visited by its engineers has been compromised. The forum now serves a malicious script that exploits a known browser vulnerability. Which attack technique is being used?

   • AWatering hole attack
   • BDrive-by download via malicious link
   • CMalvertising
   • DPhishing via email
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is responding to an incident where a user clicked a malicious link in a phishing email. The link downloaded a JavaScript file that, when executed, created a new Windows service to run a malicious binary. The team wants to prevent this type of persistence from being established in the future. Which control would be most effective?

   • AUse application control to block the execution of the JavaScript file and the malicious binary.
   • BMonitor for new service creation using Windows Event Logs and alert on suspicious service names.
   • CDisable the Windows Service Control Manager (SCM) to prevent service creation.
   • DEnable Windows Service Hardening to restrict the permissions of services.
   Reveal Solution Discussion Select an answer first