Payload Execution GDAT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is evaluating their EDR solution's ability to detect process injection. They know that the EDR uses user-mode API hooks to monitor calls like WriteProcessMemory. An attacker is using a technique that bypasses these hooks by making direct system calls. Which additional control would be most effective at detecting this technique?

   • AIncrease the frequency of full disk scans
   • BEnable kernel-level ETW (Event Tracing for Windows) for process and thread creation
   • CDisable all scripting engines
   • DUse a network firewall to block outbound connections
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a memory-based execution technique?

   • AInstalling a rootkit that modifies system drivers
   • BRunning a PowerShell script that downloads and executes a payload directly in memory
   • CUsing a macro to write a VBScript file to disk and execute it
   • DDropping a malicious executable to the Startup folder
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is deploying an EDR solution that uses behavioral detection. They want to reduce the risk of attackers using PowerShell to execute obfuscated payloads. Which configuration is most effective?

   • ABlock all outbound network traffic from workstations.
   • BUse a traditional antivirus that only scans files on disk.
   • CDisable PowerShell execution policy for all users.
   • DEnable script block logging and AMSI (Antimalware Scan Interface) for PowerShell.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing an alert about a process that injected code into another process and then executed it. The injected code was loaded from memory and never touched the disk. Which EDR detection technique would be most effective at identifying this behavior?

   • AMonitor for API calls such as OpenProcess, VirtualAllocEx, and WriteProcessMemory
   • BMonitor for unusual network connections
   • CMonitor for new files created in the system directory
   • DMonitor for changes to the Windows registry
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is investigating a process injection alert. The alert shows that a benign process has a memory region that is writable and executable, but the EDR did not flag it as malicious because the memory content did not match known signatures. Which additional detection method would be most effective?

   • AMonitor for the sequence of Windows API calls used in process injection (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
   • BDisable the process that was injected into.
   • CIncrease the frequency of file scans on the system.
   • DBlock all outbound network traffic from the host.
   Reveal Solution Discussion Select an answer first