Which of the following is an example of an anti-sandboxing technique used during payload execution?

Delaying execution until the system has been idle for a certain period

Encrypting the payload with a hardcoded key

Running the payload as a Windows service

Using a valid code-signing certificate to sign the payload

A red team operator needs to execute a payload on a target that has an EDR with strong behavioral detection. The payload must run without writing to disk and must avoid triggering EDR alerts. Which approach is most likely to succeed?

Use a scheduled task to run a script from a network share.

Use a simple PowerShell download-and-execute script.

Write the payload to the Windows Temp folder and execute it.

Use a reflective DLL injection technique that loads the payload into memory and executes it from within a legitimate process.

A red team operator needs to execute a payload on a target Windows host without writing any files to disk. The payload must run in the context of the current user and avoid triggering file-based detection. Which approach best meets these requirements?

Use a PowerShell script that downloads and invokes the payload directly in memory.

Drop a DLL to the user's AppData folder and use rundll32.exe to execute it.

Schedule a task that runs a compiled executable from a network share.

Use a macro in a Word document that writes a VBS script to the temp folder and executes it.

Which statement best describes payload execution in the context of initial access?

It is the act of running malicious code on a target system to achieve a specific objective

It is the process of delivering a malicious file to the target via email or web download

It is the process of hiding malicious code within legitimate files to avoid detection

It is the method used to communicate with the attacker's command-and-control server

What is the primary purpose of process injection in the context of payload execution?

To bypass application whitelisting by running the payload as a service

To increase the speed of payload execution by using multiple CPU cores

To execute malicious code within the address space of a legitimate process to evade detection

To ensure the payload persists across reboots by injecting into a startup process

GIAC Defending Advanced Threats

Domain 1Objective 2

Payload Execution GDAT Practice Questions (Page 4)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 16–20

16foundation · easy
Which of the following is an example of an anti-sandboxing technique used during payload execution?
Select an answer first
17expert · hard
A red team operator needs to execute a payload on a target that has an EDR with strong behavioral detection. The payload must run without writing to disk and must avoid triggering EDR alerts. Which approach is most likely to succeed?
Select an answer first
18application · medium
A red team operator needs to execute a payload on a target Windows host without writing any files to disk. The payload must run in the context of the current user and avoid triggering file-based detection. Which approach best meets these requirements?
Select an answer first
19foundation · easy
Which statement best describes payload execution in the context of initial access?
Select an answer first
20foundation · easy
What is the primary purpose of process injection in the context of payload execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.