Which of the following is a common persistence mechanism used by attackers to maintain access to a compromised system?

Performing a port scan of the internal network

Using a packet sniffer to capture network traffic

Creating a scheduled task that runs a malicious script

After a malware infection, a system continues to reconnect to a command-and-control server even after the original malware executable is removed. The analyst suspects persistence. Which of the following is a common persistence mechanism that would cause this behavior?

A scheduled task that re-downloads and executes the malware

A temporary file in the user's temp directory

A browser extension that is not malicious

A firewall rule that blocks outbound traffic

A penetration tester is conducting an assessment of a network. The tester has completed the enumeration phase and identified several potential vulnerabilities, including an outdated FTP server and a misconfigured SMB share. The tester must decide which vulnerability to exploit first to gain a foothold. Which factor should most influence the decision?

The ease of hiding the attack from the client's monitoring systems.

The likelihood of success and the potential impact of the exploit.

The number of open ports on the target.

The time of day when the target is least active.

In a systematic exploitation methodology, what is the primary purpose of enumeration?

To automatically exploit identified vulnerabilities without manual verification

To passively observe network traffic without interacting with the target

To remove traces of the attack from system logs and files

To actively query systems and services to identify valid usernames, shares, and other exploitable details

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 1

Exploitation & Mitigation GFACT Practice Questions (Page 1)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1foundation · easy
Which of the following is a common persistence mechanism used by attackers to maintain access to a compromised system?
Select an answer first
2application · medium
After a malware infection, a system continues to reconnect to a command-and-control server even after the original malware executable is removed. The analyst suspects persistence. Which of the following is a common persistence mechanism that would cause this behavior?
Select an answer first
3expert · hard
A penetration tester is conducting an assessment of a network. The tester has completed the enumeration phase and identified several potential vulnerabilities, including an outdated FTP server and a misconfigured SMB share. The tester must decide which vulnerability to exploit first to gain a foothold. Which factor should most influence the decision?
Select an answer first
4foundation · easy
In a systematic exploitation methodology, what is the primary purpose of enumeration?
Select an answer first
5expert · medium
An incident responder is cleaning up a compromised Linux server. The malware has been removed, but the responder finds that the attacker created a new user account with UID 0 and added an SSH key to the root user's authorized_keys file. Which persistence mechanism is the attacker using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Exploitation & Mitigation GFACT Practice Questions (Page 1)

Questions 1–5

Which of the following is a common persistence mechanism used by attackers to maintain access to a compromised system?

After a malware infection, a system continues to reconnect to a command-and-control server even after the original malware executable is removed. The analyst suspects persistence. Which of the following is a common persistence mechanism that would cause this behavior?

In a systematic exploitation methodology, what is the primary purpose of enumeration?

An incident responder is cleaning up a compromised Linux server. The malware has been removed, but the responder finds that the attacker created a new user account with UID 0 and added an SSH key to the root user's authorized_keys file. Which persistence mechanism is the attacker using?

Keep studying — Offensive Security and Defense