A small business wants to protect its network from ransomware. They currently have only a firewall and antivirus on each workstation. Which additional control would best illustrate the principle of defense in depth by addressing a gap that the existing controls do not cover?

Increase the frequency of antivirus signature updates.

Disable the firewall to improve network performance.

Implement application whitelisting on workstations to prevent unauthorized executables from running.

Replace the firewall with a more expensive model that has the same features.

A company wants to protect its internal network from advanced persistent threats. They have implemented firewalls, intrusion detection systems, and antivirus. Which additional control would most effectively add a layer of defense that specifically addresses the persistence mechanisms attackers often use?

Increase the frequency of full disk backups.

Implement endpoint detection and response (EDR) with behavioral monitoring.

Use a stronger encryption algorithm for VPN connections.

Disable the guest account on all workstations.

During a red team exercise, the team sends a spear-phishing email with a malicious attachment. After the attachment is opened, it installs a backdoor that allows the team to remotely access the system. Which two stages of the Cyber Kill Chain are directly demonstrated by this activity?

Installation and Command and Control

A security analyst is mapping an attack to the exploit lifecycle. The attacker first performed a port scan, then sent a phishing email with a malicious attachment, and later used a scheduled task to maintain access. Which three stages of the lifecycle are demonstrated in order?

Reconnaissance, weaponization, and delivery

Reconnaissance, delivery, and installation

Exploitation, installation, and command and control

Weaponization, exploitation, and command and control

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 1

Exploitation & Mitigation GFACT Practice Questions (Page 8)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A small business wants to protect its network from ransomware. They currently have only a firewall and antivirus on each workstation. Which additional control would best illustrate the principle of defense in depth by addressing a gap that the existing controls do not cover?
Select an answer first
37application · medium
A penetration tester is assessing a web application. After discovering that the application uses a vulnerable version of a third-party library, the tester crafts an exploit to take advantage of the known vulnerability. Which phase of the attacker methodology does the tester's action represent?
Select an answer first
38application · medium
A company wants to protect its internal network from advanced persistent threats. They have implemented firewalls, intrusion detection systems, and antivirus. Which additional control would most effectively add a layer of defense that specifically addresses the persistence mechanisms attackers often use?
Select an answer first
39application · medium
During a red team exercise, the team sends a spear-phishing email with a malicious attachment. After the attachment is opened, it installs a backdoor that allows the team to remotely access the system. Which two stages of the Cyber Kill Chain are directly demonstrated by this activity?
Select an answer first
40expert · medium
A security analyst is mapping an attack to the exploit lifecycle. The attacker first performed a port scan, then sent a phishing email with a malicious attachment, and later used a scheduled task to maintain access. Which three stages of the lifecycle are demonstrated in order?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Exploitation & Mitigation GFACT Practice Questions (Page 8)

Questions 36–40

A small business wants to protect its network from ransomware. They currently have only a firewall and antivirus on each workstation. Which additional control would best illustrate the principle of defense in depth by addressing a gap that the existing controls do not cover?

A penetration tester is assessing a web application. After discovering that the application uses a vulnerable version of a third-party library, the tester crafts an exploit to take advantage of the known vulnerability. Which phase of the attacker methodology does the tester's action represent?

During a red team exercise, the team sends a spear-phishing email with a malicious attachment. After the attachment is opened, it installs a backdoor that allows the team to remotely access the system. Which two stages of the Cyber Kill Chain are directly demonstrated by this activity?

A security analyst is mapping an attack to the exploit lifecycle. The attacker first performed a port scan, then sent a phishing email with a malicious attachment, and later used a scheduled task to maintain access. Which three stages of the lifecycle are demonstrated in order?

Keep studying — Offensive Security and Defense