A security analyst is reviewing a compromised system. The analyst finds that the attacker used a remote access trojan (RAT) to gain initial access, then exploited a local privilege escalation vulnerability to gain admin rights, and finally installed a service that runs the RAT every time the system boots. Which three concepts are demonstrated by this attack chain?

Reconnaissance, weaponization, and delivery

Initial access, privilege escalation, and persistence

Exploitation, installation, and command and control

Credential harvesting, lateral movement, and exfiltration

A penetration tester is performing an assessment. The tester first scans the network to identify open ports and services, then researches known vulnerabilities for those services, and finally attempts to exploit a vulnerability to gain access. Which methodology is the tester following?

Installation, command and control, actions on objectives

Privilege escalation, persistence, exfiltration

Reconnaissance, weaponization, delivery

Enumeration, vulnerability analysis, exploitation

A security team is designing a defense-in-depth strategy for a critical application. They have limited budget and must choose between implementing a network intrusion detection system (IDS) or a host-based intrusion prevention system (HIPS). The application is known to have a high rate of false positives with signature-based detection. Which approach is more appropriate given the constraint?

Implement neither and rely on patching

Implement both IDS and HIPS to maximize coverage

Implement the HIPS because it can block malicious activity at the host level

Implement the IDS because it will not block legitimate traffic and can be tuned to reduce false positives

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 1

Exploitation & Mitigation GFACT Practice Questions (Page 7)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 31–35

31foundation · easy
An attacker modifies the Windows registry to automatically run a malicious program every time a user logs in. This is an example of which persistence mechanism?
Select an answer first
32expert · medium
A security analyst is reviewing a compromised system. The analyst finds that the attacker used a remote access trojan (RAT) to gain initial access, then exploited a local privilege escalation vulnerability to gain admin rights, and finally installed a service that runs the RAT every time the system boots. Which three concepts are demonstrated by this attack chain?
Select an answer first
33foundation · easy
After an attacker has enumerated a target and identified several potential weaknesses, what is the next step in a systematic exploitation methodology?
Select an answer first
34application · medium
A penetration tester is performing an assessment. The tester first scans the network to identify open ports and services, then researches known vulnerabilities for those services, and finally attempts to exploit a vulnerability to gain access. Which methodology is the tester following?
Select an answer first
35expert · hard
A security team is designing a defense-in-depth strategy for a critical application. They have limited budget and must choose between implementing a network intrusion detection system (IDS) or a host-based intrusion prevention system (HIPS). The application is known to have a high rate of false positives with signature-based detection. Which approach is more appropriate given the constraint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Exploitation & Mitigation GFACT Practice Questions (Page 7)

Questions 31–35

An attacker modifies the Windows registry to automatically run a malicious program every time a user logs in. This is an example of which persistence mechanism?

After an attacker has enumerated a target and identified several potential weaknesses, what is the next step in a systematic exploitation methodology?

A penetration tester is performing an assessment. The tester first scans the network to identify open ports and services, then researches known vulnerabilities for those services, and finally attempts to exploit a vulnerability to gain access. Which methodology is the tester following?

Keep studying — Offensive Security and Defense