A penetration tester gains initial access to a Windows workstation as a standard user. The tester discovers that the 'Windows Update' service runs with SYSTEM privileges and has a weak file permission that allows the current user to modify its executable. Which action would best demonstrate a privilege escalation technique while also establishing persistence?

Add the current user to the local Administrators group using the net localgroup command.

Use a credential harvesting tool to capture the password of an administrator account.

Replace the service executable with a payload that runs a reverse shell when the service starts, and set the service to start automatically.

Run a kernel exploit that targets a known vulnerability in the Windows kernel.

A system administrator notices that a user's workstation has a new scheduled task that runs a PowerShell script every time the user logs on. The script downloads and executes a binary from an external IP address. Which two concepts best describe what the administrator has discovered?

Persistence mechanism and potential backdoor

Reconnaissance and weaponization

Privilege escalation and credential harvesting

A penetration tester has gained access to a Linux server as the 'www-data' user. The tester needs to escalate to root to complete the assessment. The server has a misconfigured sudoers file that allows 'www-data' to run '/bin/less' as root without a password. However, the tester also needs to maintain access after the assessment. Which action would best achieve both goals?

Use 'sudo less' to read a root-owned file and then use the '!' command inside less to spawn a root shell.

Use 'sudo su' to switch to the root user directly.

Add the 'www-data' user to the 'sudo' group using the 'usermod' command.

Run a kernel exploit that targets a known vulnerability in the Linux kernel.

What is the core idea behind defense in depth?

Using multiple layers of security controls so that if one fails, others still provide protection

Placing all security controls at the network perimeter

Using the strongest possible encryption for all data

Relying on a single, comprehensive security solution

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 1

Exploitation & Mitigation GFACT Practice Questions (Page 2)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 6–10

6application · medium
A penetration tester gains initial access to a Windows workstation as a standard user. The tester discovers that the 'Windows Update' service runs with SYSTEM privileges and has a weak file permission that allows the current user to modify its executable. Which action would best demonstrate a privilege escalation technique while also establishing persistence?
Select an answer first
7application · medium
A system administrator notices that a user's workstation has a new scheduled task that runs a PowerShell script every time the user logs on. The script downloads and executes a binary from an external IP address. Which two concepts best describe what the administrator has discovered?
Select an answer first
8expert · hard
A penetration tester has gained access to a Linux server as the 'www-data' user. The tester needs to escalate to root to complete the assessment. The server has a misconfigured sudoers file that allows 'www-data' to run '/bin/less' as root without a password. However, the tester also needs to maintain access after the assessment. Which action would best achieve both goals?
Select an answer first
9foundation · easy
What is the core idea behind defense in depth?
Select an answer first
10application · medium
A security architect is designing a network to protect a database containing sensitive customer information. The design includes a firewall at the perimeter, an intrusion detection system (IDS) on the internal network, and database access controls. Which security principle does this design exemplify?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Exploitation & Mitigation GFACT Practice Questions (Page 2)

Questions 6–10

A system administrator notices that a user's workstation has a new scheduled task that runs a PowerShell script every time the user logs on. The script downloads and executes a binary from an external IP address. Which two concepts best describe what the administrator has discovered?

What is the core idea behind defense in depth?

Keep studying — Offensive Security and Defense