A company has just experienced a malware outbreak. The incident response team has identified the malware and is now working to contain the spread. Which action is most consistent with the containment phase?

Delete the malware from all infected systems.

Isolate infected systems from the network.

Conduct a lessons-learned meeting.

A penetration tester has compromised a web server and gained a low-privileged shell. The tester's objective is to access a database on an internal server. The tester has discovered that the web server has a scheduled task that runs as SYSTEM, but the tester cannot modify it due to permissions. The tester also has captured the NTLM hash of a service account that has access to the database server. Which approach best achieves the objective while minimizing detection?

Disable the firewall on the web server to allow direct RDP to the database server

Use the captured hash to authenticate to the database server via pass-the-hash

Attempt to modify the scheduled task to run a reverse shell as SYSTEM

Exfiltrate the hash to an external server for offline cracking

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 2

Forensics & Post-Exploitation GFACT Practice Questions (Page 2)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 6–10

6application · medium
A company has just experienced a malware outbreak. The incident response team has identified the malware and is now working to contain the spread. Which action is most consistent with the containment phase?
Select an answer first
7application · medium
After containing a malware outbreak, an organization wants to ensure the same attack cannot reoccur. The incident response team has identified a scheduled task that reinstalls the malware every hour. Which phase of incident response directly addresses removing this persistence mechanism?
Select an answer first
8expert · hard
A penetration tester has compromised a web server and gained a low-privileged shell. The tester's objective is to access a database on an internal server. The tester has discovered that the web server has a scheduled task that runs as SYSTEM, but the tester cannot modify it due to permissions. The tester also has captured the NTLM hash of a service account that has access to the database server. Which approach best achieves the objective while minimizing detection?
Select an answer first
9foundation · easy
Which incident response phase involves reviewing the incident to identify what was done well and what could be improved, and updating policies and procedures accordingly?
Select an answer first
10foundation · easy
In the incident response lifecycle, which phase involves actions taken to stop the spread of an incident and limit the damage while the investigation continues?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Forensics & Post-Exploitation GFACT Practice Questions (Page 2)

Questions 6–10

A company has just experienced a malware outbreak. The incident response team has identified the malware and is now working to contain the spread. Which action is most consistent with the containment phase?

After containing a malware outbreak, an organization wants to ensure the same attack cannot reoccur. The incident response team has identified a scheduled task that reinstalls the malware every hour. Which phase of incident response directly addresses removing this persistence mechanism?

Which incident response phase involves reviewing the incident to identify what was done well and what could be improved, and updating policies and procedures accordingly?

In the incident response lifecycle, which phase involves actions taken to stop the spread of an incident and limit the damage while the investigation continues?

Keep studying — Offensive Security and Defense