What is a key advantage of memory-based payload execution from an attacker's perspective?

It avoids writing malicious files to disk, reducing the chance of detection by antivirus

It guarantees the payload will persist across system reboots

It makes the payload immune to all endpoint detection and response (EDR) tools

It ensures the payload runs with the highest system privileges

A malware sample uses a technique where it checks the system's CPU temperature and only executes its payload if the temperature is within a normal range. Which evasion technique is this?

Anti-sandboxing via environmental checks.

Living-off-the-land binary execution.

Process injection into a legitimate process.

An EDR alert shows that a benign-looking process (svchost.exe) has a memory region that is writable and executable, and contains a known malicious shellcode pattern. The process was spawned by a legitimate parent. Which detection capability is most likely to have generated this alert?

Network-based intrusion detection that monitors for command-and-control traffic.

Application whitelisting that only allows signed executables.

Memory scanning that checks for executable content in writable memory regions.

File integrity monitoring on system directories.

In the context of the attack lifecycle, what is the primary role of payload execution during the initial access and execution phase?

To exfiltrate sensitive data from the compromised system

To establish persistence by modifying system startup entries

To deliver the malicious code to the target system and run it to achieve the attacker's objective

To scan the network for other vulnerable systems to expand the attack

GIAC Defending Advanced Threats

Domain 1Objective 2

Payload Execution GDAT Practice Questions (Page 1)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 1–5

1foundation · easy
What is a key advantage of memory-based payload execution from an attacker's perspective?
Select an answer first
2application · medium
A malware sample uses a technique where it checks the system's CPU temperature and only executes its payload if the temperature is within a normal range. Which evasion technique is this?
Select an answer first
3application · medium
An EDR alert shows that a benign-looking process (svchost.exe) has a memory region that is writable and executable, and contains a known malicious shellcode pattern. The process was spawned by a legitimate parent. Which detection capability is most likely to have generated this alert?
Select an answer first
4foundation · easy
Which of the following is a common process injection technique?
Select an answer first
5foundation · easy
In the context of the attack lifecycle, what is the primary role of payload execution during the initial access and execution phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.