An organization is concerned about attackers using command-line tools like cmd.exe and PowerShell to execute payloads. They want to implement a control that reduces the risk without breaking legitimate administrative scripts. Which control would be most appropriate?

Block all outbound network connections from command-line tools

Use file hashing to block known malicious command-line tools

Disable cmd.exe on all workstations

Enable Constrained Language Mode for PowerShell

A security analyst is investigating a compromised host where the attacker used a reflective DLL injection technique to load a payload into a legitimate process. The payload was never written to disk. Which forensic artifact would be most useful for confirming this activity?

File system timeline of recently modified files

Memory dump of the compromised process

Network flow logs from the host

Windows event logs for process creation

A malware sample uses a sleep timer that is longer than the typical sandbox analysis window and only executes its payload after the timer expires. Which evasion technique is this?

Living-off-the-land execution using a trusted binary.

Process injection into a legitimate process.

Anti-sandboxing via time-based evasion.

Obfuscation of the payload using encryption.

A security analyst notices that a legitimate Windows binary (e.g., certutil.exe) is being used to decode a base64-encoded file and then execute it. Which technique is the attacker using?

Process injection into a legitimate process.

Living-off-the-land binary (LOLBin) execution.

Memory-only execution without writing to disk.

Anti-sandboxing via delayed execution.

What is the primary goal of obfuscation as an evasion strategy during payload execution?

To make the payload run faster on the target system

To hide the malicious nature of the code from security tools that rely on signatures or heuristics

To ensure the payload is compatible with all versions of Windows

To reduce the size of the payload for easier delivery

GIAC Defending Advanced Threats

Domain 1Objective 2

Payload Execution GDAT Practice Questions (Page 7)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31application · medium
An organization is concerned about attackers using command-line tools like cmd.exe and PowerShell to execute payloads. They want to implement a control that reduces the risk without breaking legitimate administrative scripts. Which control would be most appropriate?
Select an answer first
32application · medium
A security analyst is investigating a compromised host where the attacker used a reflective DLL injection technique to load a payload into a legitimate process. The payload was never written to disk. Which forensic artifact would be most useful for confirming this activity?
Select an answer first
33application · medium
A malware sample uses a sleep timer that is longer than the typical sandbox analysis window and only executes its payload after the timer expires. Which evasion technique is this?
Select an answer first
34application · medium
A security analyst notices that a legitimate Windows binary (e.g., certutil.exe) is being used to decode a base64-encoded file and then execute it. Which technique is the attacker using?
Select an answer first
35foundation · easy
What is the primary goal of obfuscation as an evasion strategy during payload execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.