An organization is planning to implement a new security control to reduce the risk of command-line and scripting attacks. They have a mix of Windows and Linux systems, and they need a control that is consistent across both platforms. Which control would be most effective?

Implement application whitelisting that allows only approved binaries to execute

Use a network-based intrusion prevention system (IPS)

Rely on user awareness training to prevent command-line attacks

Disable all command-line interpreters on all systems

A security team is implementing a mitigation strategy for payload execution. They have a limited budget and need to choose between two controls: (1) an EDR solution with behavioral detection, or (2) an application whitelisting solution. The environment has many legacy applications that are not signed. Which control is more feasible?

EDR with behavioral detection, because it does not require maintaining an allowlist of all legacy applications.

Neither control is feasible in this environment.

Both controls are equally feasible.

Application whitelisting, because it blocks all unknown executables.

During an incident response, you discover that a malicious payload injected code into a legitimate, running process (e.g., explorer.exe) using a common process injection technique. The injected code executed entirely in memory, and no malicious files were written to disk. Which mitigation would be most effective at preventing this type of attack?

Enable application whitelisting to allow only approved executables to run

Deploy an EDR solution that monitors for suspicious cross-process memory access and injection APIs

Increase the frequency of full disk scans with traditional antivirus

Disable all scripting engines on endpoints

Which security control is specifically designed to detect and respond to malicious activity at the endpoint, including payload execution?

Intrusion Prevention System (IPS)

Endpoint Detection and Response (EDR)

GIAC Defending Advanced Threats

Domain 1Objective 2

Payload Execution GDAT Practice Questions (Page 8)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36expert · hard
An organization is planning to implement a new security control to reduce the risk of command-line and scripting attacks. They have a mix of Windows and Linux systems, and they need a control that is consistent across both platforms. Which control would be most effective?
Select an answer first
37expert · hard
A security team is implementing a mitigation strategy for payload execution. They have a limited budget and need to choose between two controls: (1) an EDR solution with behavioral detection, or (2) an application whitelisting solution. The environment has many legacy applications that are not signed. Which control is more feasible?
Select an answer first
38foundation · easy
Which of the following is an example of a living-off-the-land binary (LOLBin) commonly abused by attackers for payload execution?
Select an answer first
39application · medium
During an incident response, you discover that a malicious payload injected code into a legitimate, running process (e.g., explorer.exe) using a common process injection technique. The injected code executed entirely in memory, and no malicious files were written to disk. Which mitigation would be most effective at preventing this type of attack?
Select an answer first
40foundation · easy
Which security control is specifically designed to detect and respond to malicious activity at the endpoint, including payload execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Payload Execution GDAT Practice Questions (Page 8)

Questions 36–40

An organization is planning to implement a new security control to reduce the risk of command-line and scripting attacks. They have a mix of Windows and Linux systems, and they need a control that is consistent across both platforms. Which control would be most effective?

Which of the following is an example of a living-off-the-land binary (LOLBin) commonly abused by attackers for payload execution?

Which security control is specifically designed to detect and respond to malicious activity at the endpoint, including payload execution?

Keep studying — Initial Access and Execution