A security analyst discovers that a workstation has been running a cryptocurrency miner for several weeks. The analyst needs to preserve evidence, determine how the miner was installed, and identify any persistence mechanisms before removing it. Which sequence of actions best aligns with the incident response phases?

Disconnect the workstation, reimage the hard drive, and then review firewall logs to determine how the miner was installed.

Immediately delete the miner executable and associated registry keys, then document the actions taken in the incident report.

Run a full antivirus scan, remove detected threats, and then restore the system from the last known good backup.

Isolate the workstation from the network, capture a memory image, then analyze the disk image with forensic tools to identify the persistence mechanism before eradication.

An incident responder is analyzing a memory dump from a compromised server. The responder suspects a rootkit is hiding processes. Which tool and technique would best confirm the presence of a hidden process?

Use Volatility to list processes and compare with the system's process table

Use Wireshark to capture network traffic from the server

Use Autopsy to analyze the disk image for malicious files

Use Nmap to scan the server for open ports

An attacker has compromised a low-privileged user account on a Windows domain. The attacker's objective is to access sensitive data on a database server. Which sequence of actions best aligns with post-exploitation goals?

Exfiltrate data from the current workstation only

Disable the firewall on the workstation

Escalate privileges, then move laterally to the database server

Delete all logs to avoid detection

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 2

Forensics & Post-Exploitation GFACT Practice Questions (Page 1)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 1–5

1application · medium
A security analyst discovers that a workstation has been running a cryptocurrency miner for several weeks. The analyst needs to preserve evidence, determine how the miner was installed, and identify any persistence mechanisms before removing it. Which sequence of actions best aligns with the incident response phases?
Select an answer first
2expert · hard
An incident responder is analyzing a memory dump from a compromised server. The responder suspects a rootkit is hiding processes. Which tool and technique would best confirm the presence of a hidden process?
Select an answer first
3application · medium
A security analyst notices unusual DNS queries from a compromised server to an external domain, with long subdomain labels containing encoded data. The analyst suspects data exfiltration. Which forensic tool would best help confirm this by examining the memory of the compromised server?
Select an answer first
4application · medium
An attacker has compromised a low-privileged user account on a Windows domain. The attacker's objective is to access sensitive data on a database server. Which sequence of actions best aligns with post-exploitation goals?
Select an answer first
5foundation · easy
A forensic analyst needs to examine the memory (RAM) of a compromised system to identify running processes and network connections at the time of the incident. Which tool is specifically designed for memory forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Forensics & Post-Exploitation GFACT Practice Questions (Page 1)

Questions 1–5

An incident responder is analyzing a memory dump from a compromised server. The responder suspects a rootkit is hiding processes. Which tool and technique would best confirm the presence of a hidden process?

A security analyst notices unusual DNS queries from a compromised server to an external domain, with long subdomain labels containing encoded data. The analyst suspects data exfiltration. Which forensic tool would best help confirm this by examining the memory of the compromised server?

An attacker has compromised a low-privileged user account on a Windows domain. The attacker's objective is to access sensitive data on a database server. Which sequence of actions best aligns with post-exploitation goals?

A forensic analyst needs to examine the memory (RAM) of a compromised system to identify running processes and network connections at the time of the incident. Which tool is specifically designed for memory forensics?

Keep studying — Offensive Security and Defense