Payload Delivery GDAT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is analyzing a malicious document that contains a VBA macro. The macro decodes a base64-encoded string and then executes the decoded content using PowerShell. What is the primary purpose of the base64 encoding in this attack?

   • ATo evade signature-based detection
   • BTo compress the payload for faster delivery
   • CTo ensure the payload runs with elevated privileges
   • DTo make the payload compatible with all operating systems
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security architect is designing defenses for a financial services firm that has a high-risk profile. The firm's employees frequently visit financial news websites, and the firm has already implemented web filtering, browser patching, and endpoint antivirus. The architect is considering adding a control to specifically address the risk of exploit kits delivered via malvertising and watering holes. The firm has a limited budget and cannot implement all possible controls. Which control would provide the most comprehensive protection against both malvertising and watering hole attacks?

   • AImplement a strict allowlist of websites that employees are permitted to visit.
   • BDeploy an intrusion prevention system (IPS) that inspects all web traffic for exploit signatures.
   • CDeploy a cloud-based web isolation solution that renders all web content in a remote browser.
   • DIncrease the frequency of browser and plugin patching to weekly.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is investigating a breach at a non-profit organization. The attackers compromised a website that the organization's staff frequently visits. The website now serves a malicious script that exploits a browser vulnerability. The payload is encoded with base64 and then executed via PowerShell. The payload also creates a registry run key for persistence. Which two techniques are being used?

   • AMalvertising and exploit kit
   • BWatering hole and obfuscation via encoding
   • CEmail attachment and macro
   • DRemovable media and physical delivery
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary role of an exploit kit in payload delivery?

   • ATo create malicious USB drives that automatically execute when inserted into a computer.
   • BTo encrypt a payload so that it is not detected by antivirus software.
   • CTo automatically scan a visitor's browser and plugins for known vulnerabilities and then deliver a payload that exploits one of them.
   • DTo send phishing emails that trick users into downloading a malicious attachment.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a common method used to execute a payload on a target system?

   • APlacing the payload in a folder and waiting for the user to find it.
   • BSending the payload to the target's printer.
   • CUsing a macro in a document that runs when the user opens the file.
   • DRenaming the payload to a system file name.
   Reveal Solution Discussion Select an answer first