Which technique is associated with privilege escalation?

Domain generation algorithms (DGAs)

An analyst sees a series of events: a workstation makes an SMB connection to a server, then a process on the server runs mimikatz, and then the server makes an SMB connection to a domain controller. Which attack chain is this?

Command and control, credential dumping, and data exfiltration.

Lateral movement to the server, credential dumping, then lateral movement to the DC.

Initial access via SMB, privilege escalation via mimikatz, lateral movement to the domain controller.

Persistence, privilege escalation, and defense evasion.

A security team is investigating a workstation that is making DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.example.com', 'd4e5f6.example.com', and so on. The queries occur at irregular intervals. The team suspects domain generation algorithm (DGA) traffic. Which detection approach is most appropriate to confirm this suspicion?

Check the workstation's hosts file for any entries pointing to the domain

Analyze the DNS query patterns for high entropy in the subdomain labels and compare against known DGA algorithms

Block the domain at the firewall and observe if the workstation attempts to resolve a different domain

Enable verbose logging on the DNS server and look for any query that returns a non-existent domain (NXDOMAIN) response

A security team is struggling to detect modern attacks because attackers are using legitimate administrative tools like PowerShell and WMI to perform malicious actions. The team's current detection rules are signature-based and focus on known malware. Which improvement would most enhance the team's ability to detect these attacks?

Implement behavioral analytics that baseline normal administrative activity and alert on anomalies

Deploy a network firewall that blocks all outbound traffic from endpoints

Disable PowerShell and WMI across all endpoints to prevent their misuse

Increase the frequency of signature updates for the antivirus product

GIAC Enterprise Incident Responder

Domain 3Objective 1

Detecting Modern Attacks GEIR Practice Questions (Page 2)

Part of the Modern Attack Detection domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 6–10

6foundation · easy
Which technique is associated with privilege escalation?
Select an answer first
7application · medium
An analyst sees a series of events: a workstation makes an SMB connection to a server, then a process on the server runs mimikatz, and then the server makes an SMB connection to a domain controller. Which attack chain is this?
Select an answer first
8application · medium
A security team is investigating a workstation that is making DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.example.com', 'd4e5f6.example.com', and so on. The queries occur at irregular intervals. The team suspects domain generation algorithm (DGA) traffic. Which detection approach is most appropriate to confirm this suspicion?
Select an answer first
9application · medium
A security team is struggling to detect modern attacks because attackers are using legitimate administrative tools like PowerShell and WMI to perform malicious actions. The team's current detection rules are signature-based and focus on known malware. Which improvement would most enhance the team's ability to detect these attacks?
Select an answer first
10foundation · easy
Which of the following is a common persistence mechanism used by attackers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Detecting Modern Attacks GEIR Practice Questions (Page 2)

Questions 6–10

Which technique is associated with privilege escalation?

An analyst sees a series of events: a workstation makes an SMB connection to a server, then a process on the server runs mimikatz, and then the server makes an SMB connection to a domain controller. Which attack chain is this?

Which of the following is a common persistence mechanism used by attackers?

Keep studying — Modern Attack Detection