An incident responder is investigating a compromised Windows server. The attacker has established persistence via a registry Run key and a scheduled task. The responder needs to remove the persistence without disrupting legitimate services. Which approach is most appropriate?

Reboot the server and hope the persistence does not reoccur

Disconnect the server from the network and continue normal operations

Delete the scheduled task but leave the registry Run key

Remove the registry Run key and disable the scheduled task, then verify no other persistence mechanisms exist

GIAC Foundational Cybersecurity Technologies

Domain 6Objective 2

Forensics & Post-Exploitation GFACT Practice Questions (Page 8)

Part of the Offensive Security and Defense domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 36–38

36foundation · easy
An attacker wants to exfiltrate data from a network that only allows DNS traffic to leave. Which technique could be used to transfer data out?
Select an answer first
37application · medium
An incident responder needs to analyze a disk image from a compromised Linux server to recover deleted files and examine file system metadata. Which tool is best suited for this task?
Select an answer first
38expert · hard
An incident responder is investigating a compromised Windows server. The attacker has established persistence via a registry Run key and a scheduled task. The responder needs to remove the persistence without disrupting legitimate services. Which approach is most appropriate?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Forensics & Post-Exploitation GFACT Practice Questions (Page 8)

Questions 36–38

An attacker wants to exfiltrate data from a network that only allows DNS traffic to leave. Which technique could be used to transfer data out?

An incident responder needs to analyze a disk image from a compromised Linux server to recover deleted files and examine file system metadata. Which tool is best suited for this task?

An incident responder is investigating a compromised Windows server. The attacker has established persistence via a registry Run key and a scheduled task. The responder needs to remove the persistence without disrupting legitimate services. Which approach is most appropriate?

Keep studying — Offensive Security and Defense