A security team is investigating a memory-only attack. The EDR detected the attack because it monitored for the use of VirtualAllocEx and WriteProcessMemory APIs. However, the attacker used a technique that avoids these APIs by using a different method to allocate and write memory. Which technique could the attacker have used?

Using a scheduled task to run a malicious executable.

Using the Native API (NtAllocateVirtualMemory and NtWriteVirtualMemory) directly.

Using a macro in a Word document to write a file to disk.

Using a simple PowerShell script to download and execute a payload.

What is the primary purpose of application whitelisting as a mitigation strategy for payload execution?

To monitor user activity and log all executed commands

To block network traffic from known malicious IP addresses

To encrypt all files on the system to prevent data theft

To allow only approved applications to run on a system, blocking unauthorized executables

A company's security team wants to prevent attackers from using living-off-the-land binaries (LOLBins) like mshta.exe and wscript.exe to execute malicious scripts. They have an application whitelisting solution. Which policy is most effective?

Allow all signed Microsoft binaries to execute.

Block execution of known LOLBins unless they are explicitly required by a business process.

Set the execution policy to Restricted for all users.

Monitor network traffic for suspicious script downloads.

A security team is reviewing a suspicious document that uses macros to execute a payload. The macro contains obfuscated strings and uses a sleep function to delay execution, likely to evade automated analysis. Which mitigation would be most effective at preventing this attack?

Increase the timeout for sandbox analysis

Block all inbound email attachments

Disable macros in Office documents via Group Policy

Use a network firewall to block outbound connections

Which of the following is a common scripting technique used for payload execution?

Running a PowerShell script that downloads and executes a remote payload

Compiling a C++ program and running it on the target

Exploiting a buffer overflow in a network service

Using a USB rubber ducky to inject keystrokes

GIAC Defending Advanced Threats

Domain 1Objective 2

Payload Execution GDAT Practice Questions (Page 6)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 26–30

26expert · hard
A security team is investigating a memory-only attack. The EDR detected the attack because it monitored for the use of VirtualAllocEx and WriteProcessMemory APIs. However, the attacker used a technique that avoids these APIs by using a different method to allocate and write memory. Which technique could the attacker have used?
Select an answer first
27foundation · easy
What is the primary purpose of application whitelisting as a mitigation strategy for payload execution?
Select an answer first
28application · medium
A company's security team wants to prevent attackers from using living-off-the-land binaries (LOLBins) like mshta.exe and wscript.exe to execute malicious scripts. They have an application whitelisting solution. Which policy is most effective?
Select an answer first
29application · medium
A security team is reviewing a suspicious document that uses macros to execute a payload. The macro contains obfuscated strings and uses a sleep function to delay execution, likely to evade automated analysis. Which mitigation would be most effective at preventing this attack?
Select an answer first
30foundation · easy
Which of the following is a common scripting technique used for payload execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.