A penetration tester has compromised a domain controller and wants to ensure continued access to the domain even if the initial compromise is discovered. Which post-exploitation action would best achieve this goal?

Disable security logging on the domain controller.

Install a keylogger on the domain controller.

Create a golden ticket to forge Kerberos tickets for any user.

Exfiltrate the Active Directory database.

During incident response, a team has identified a compromised server and needs to preserve evidence while containing the incident. The server is critical to production and cannot be taken offline. Which action best balances evidence preservation and business continuity?

Create a forensic image of the server's memory and disk while it is still running

Reboot the server to clear any malicious processes

Disconnect the server from the network but keep it running

Immediately shut down the server to prevent further damage

A red team operator has compromised a Linux server that is part of a Kubernetes cluster. The operator wants to maintain access to the server and also use it to move laterally to other containers in the cluster. Which persistence mechanism would be most effective for this scenario?

Create a Kubernetes service account token and use it to access the Kubernetes API.

Install a backdoor in the container image and redeploy the pod.

Create a cron job that runs a reverse shell every minute.

Add an SSH key to the server's authorized_keys file.

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 2

Forensics & Post-Exploitation GFACT Practice Questions (Page 5)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 21–25

21application · medium
A penetration tester has compromised a domain controller and wants to ensure continued access to the domain even if the initial compromise is discovered. Which post-exploitation action would best achieve this goal?
Select an answer first
22application · medium
A security administrator discovers a new Windows service on a server that was not installed by IT. The service runs with SYSTEM privileges and automatically starts at boot. Which post-exploitation goal does this service most likely support?
Select an answer first
23foundation · easy
Which of the following is a common persistence mechanism that allows an attacker to execute code at scheduled times on a compromised system?
Select an answer first
24expert · hard
During incident response, a team has identified a compromised server and needs to preserve evidence while containing the incident. The server is critical to production and cannot be taken offline. Which action best balances evidence preservation and business continuity?
Select an answer first
25expert · hard
A red team operator has compromised a Linux server that is part of a Kubernetes cluster. The operator wants to maintain access to the server and also use it to move laterally to other containers in the cluster. Which persistence mechanism would be most effective for this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Forensics & Post-Exploitation GFACT Practice Questions (Page 5)

Questions 21–25

A penetration tester has compromised a domain controller and wants to ensure continued access to the domain even if the initial compromise is discovered. Which post-exploitation action would best achieve this goal?

A security administrator discovers a new Windows service on a server that was not installed by IT. The service runs with SYSTEM privileges and automatically starts at boot. Which post-exploitation goal does this service most likely support?

Which of the following is a common persistence mechanism that allows an attacker to execute code at scheduled times on a compromised system?

During incident response, a team has identified a compromised server and needs to preserve evidence while containing the incident. The server is critical to production and cannot be taken offline. Which action best balances evidence preservation and business continuity?

A red team operator has compromised a Linux server that is part of a Kubernetes cluster. The operator wants to maintain access to the server and also use it to move laterally to other containers in the cluster. Which persistence mechanism would be most effective for this scenario?

Keep studying — Offensive Security and Defense