A security analyst is reviewing logs from a web server that was compromised. The attacker first scanned the server for open ports, then used a known vulnerability in the web application to upload a web shell, and finally used the shell to run commands and download a remote access trojan. Which two stages of the exploit lifecycle are most directly demonstrated by the upload of the web shell and the download of the trojan?

Delivery and command and control

Reconnaissance and weaponization

A security analyst is investigating a compromised Linux server. The attacker gained access as a low-privileged user and then exploited a misconfigured sudoers file to run commands as root. Which technique did the attacker use?

Kernel vulnerability exploitation

A security analyst is investigating a compromised Windows server. The analyst finds a registry key under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. The analyst also finds that the executable is configured to run as SYSTEM. Which two concepts are most directly demonstrated by this finding?

Command and control and exfiltration

Persistence and privilege escalation

Reconnaissance and weaponization

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 1

Exploitation & Mitigation GFACT Practice Questions (Page 5)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21foundation · easy
Which type of tool is specifically designed to deliver a remote shell or control interface to an attacker after a system is compromised?
Select an answer first
22application · medium
A security analyst is reviewing logs from a web server that was compromised. The attacker first scanned the server for open ports, then used a known vulnerability in the web application to upload a web shell, and finally used the shell to run commands and download a remote access trojan. Which two stages of the exploit lifecycle are most directly demonstrated by the upload of the web shell and the download of the trojan?
Select an answer first
23foundation · easy
Which tool category is used by attackers to automate the process of exploiting known vulnerabilities and delivering payloads?
Select an answer first
24application · medium
A security analyst is investigating a compromised Linux server. The attacker gained access as a low-privileged user and then exploited a misconfigured sudoers file to run commands as root. Which technique did the attacker use?
Select an answer first
25expert · medium
A security analyst is investigating a compromised Windows server. The analyst finds a registry key under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. The analyst also finds that the executable is configured to run as SYSTEM. Which two concepts are most directly demonstrated by this finding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Exploitation & Mitigation GFACT Practice Questions (Page 5)

Questions 21–25

Which type of tool is specifically designed to deliver a remote shell or control interface to an attacker after a system is compromised?

Which tool category is used by attackers to automate the process of exploiting known vulnerabilities and delivering payloads?

A security analyst is investigating a compromised Linux server. The attacker gained access as a low-privileged user and then exploited a misconfigured sudoers file to run commands as root. Which technique did the attacker use?

Keep studying — Offensive Security and Defense