A company is deciding between two security controls to reduce credential-based initial access: enforcing multi-factor authentication (MFA) for all remote access, or implementing a passwordless authentication solution. The company has a mix of technical and non-technical users, and the budget is limited. Which approach is more practical and effective?

Conduct regular security awareness training

Implement passwordless authentication for all users

Use a password manager and enforce unique passwords

Enforce MFA for all remote access

How does spear-phishing increase the likelihood of a successful initial access attempt?

By incorporating personal details that make the message appear legitimate and relevant to the target

By using generic templates that are easy to mass-produce

By sending the email from a spoofed address that is identical to the recipient's own address

By using encryption to hide the malicious payload from antivirus software

An attacker leaves USB drives in the parking lot of a company. An employee finds one, plugs it into their workstation out of curiosity, and a malicious file executes, giving the attacker remote access. Which combination of controls would best mitigate this type of initial access?

Disable USB ports via group policy and provide training on the dangers of unknown removable media

Require complex passwords and enable screen lock after 5 minutes

Use full-disk encryption on all workstations

Install a network intrusion detection system and monitor for anomalies

GIAC Information Security Fundamentals

Domain 3Objective 2

Intrusion and Initial Access Techniques GISF Practice Questions (Page 9)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 41–45

41expert · hard
A company is deciding between two security controls to reduce credential-based initial access: enforcing multi-factor authentication (MFA) for all remote access, or implementing a passwordless authentication solution. The company has a mix of technical and non-technical users, and the budget is limited. Which approach is more practical and effective?
Select an answer first
42foundation · easy
How does spear-phishing increase the likelihood of a successful initial access attempt?
Select an answer first
43application · medium
An attacker leaves USB drives in the parking lot of a company. An employee finds one, plugs it into their workstation out of curiosity, and a malicious file executes, giving the attacker remote access. Which combination of controls would best mitigate this type of initial access?
Select an answer first
44application · medium
An employee finds a USB drive in the parking lot, plugs it into their workstation to identify the owner, and the system becomes infected with malware. Which initial access vector is this?
Select an answer first
45expert · hard
A company uses a third-party software vendor for a critical business application. The vendor's update server is compromised, and malicious code is pushed to all customers. Which phase of the intrusion lifecycle does the compromise of the vendor's server represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Intrusion and Initial Access Techniques GISF Practice Questions (Page 9)

Questions 41–45

How does spear-phishing increase the likelihood of a successful initial access attempt?

An attacker leaves USB drives in the parking lot of a company. An employee finds one, plugs it into their workstation out of curiosity, and a malicious file executes, giving the attacker remote access. Which combination of controls would best mitigate this type of initial access?

An employee finds a USB drive in the parking lot, plugs it into their workstation to identify the owner, and the system becomes infected with malware. Which initial access vector is this?

A company uses a third-party software vendor for a critical business application. The vendor's update server is compromised, and malicious code is pushed to all customers. Which phase of the intrusion lifecycle does the compromise of the vendor's server represent?

Keep studying — Threats and Defenses