A penetration tester successfully compromised a Windows domain-joined workstation using a phishing email. The tester wants to maintain access to the workstation even after the user changes their password, and also wants to use the compromised workstation to access other systems in the domain. Which post-exploitation action best achieves both goals?

Dump the user's password hash and use pass-the-hash to authenticate to other systems, while also creating a scheduled task that re-establishes the reverse shell.

Extract the Kerberos ticket-granting ticket (TGT) from memory, then use it to request service tickets for other systems, and also modify the user's registry Run key to re-run the payload at logon.

Install a service that runs a reverse shell as SYSTEM, and then use the service account's token to authenticate to other systems via SMB.

Create a new local user account and add it to the Administrators group, then use that account to RDP to other workstations.

A security analyst is called to a workstation where a user reported unusual pop-ups and slow performance. The analyst must preserve evidence while determining whether the system is compromised. Which action best aligns with the identification and containment phases of incident response?

Image the RAM and disk, then disconnect the system from the network

Immediately shut down the power to prevent further damage

Reboot the system to clear any malicious processes, then run an antivirus scan

Run a full forensic analysis on the live system before taking any action

A penetration tester has gained initial access to a low-privileged user account on a Windows domain. The tester's mission is to access sensitive files on a file server. Which post-exploitation goal should the tester prioritize first?

Escalate privileges to gain administrative rights on the current machine.

Establish persistence by creating a new user account.

Move laterally to the file server using the current user's credentials.

Exfiltrate any data accessible with the current user account.

A security analyst observes a compromised server sending large amounts of data to an external IP address over HTTPS. The data appears to be encrypted and is being sent in small chunks over time. Which data exfiltration technique is being used?

HTTP POST over encrypted connection

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 2

Forensics & Post-Exploitation GFACT Practice Questions (Page 4)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 16–20

16application · hard
A penetration tester successfully compromised a Windows domain-joined workstation using a phishing email. The tester wants to maintain access to the workstation even after the user changes their password, and also wants to use the compromised workstation to access other systems in the domain. Which post-exploitation action best achieves both goals?
Select an answer first
17application · medium
A security analyst is called to a workstation where a user reported unusual pop-ups and slow performance. The analyst must preserve evidence while determining whether the system is compromised. Which action best aligns with the identification and containment phases of incident response?
Select an answer first
18application · medium
A penetration tester has gained initial access to a low-privileged user account on a Windows domain. The tester's mission is to access sensitive files on a file server. Which post-exploitation goal should the tester prioritize first?
Select an answer first
19foundation · easy
During post-exploitation, an attacker gains access to a standard user account but needs administrative rights to achieve their mission. Which post-exploitation goal does this describe?
Select an answer first
20application · medium
A security analyst observes a compromised server sending large amounts of data to an external IP address over HTTPS. The data appears to be encrypted and is being sent in small chunks over time. Which data exfiltration technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Forensics & Post-Exploitation GFACT Practice Questions (Page 4)

Questions 16–20

A security analyst is called to a workstation where a user reported unusual pop-ups and slow performance. The analyst must preserve evidence while determining whether the system is compromised. Which action best aligns with the identification and containment phases of incident response?

A penetration tester has gained initial access to a low-privileged user account on a Windows domain. The tester's mission is to access sensitive files on a file server. Which post-exploitation goal should the tester prioritize first?

During post-exploitation, an attacker gains access to a standard user account but needs administrative rights to achieve their mission. Which post-exploitation goal does this describe?

A security analyst observes a compromised server sending large amounts of data to an external IP address over HTTPS. The data appears to be encrypted and is being sent in small chunks over time. Which data exfiltration technique is being used?

Keep studying — Offensive Security and Defense