Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An organization discovers that an attacker has maintained access to their network for over a year. The attacker used a custom backdoor that communicates over HTTPS to a domain that mimics a legitimate software update service. The backdoor is installed in the firmware of a network device. Which APT characteristic is MOST clearly demonstrated?

   • APrivilege escalation to gain administrative control
   • BLateral movement through the network device
   • CPersistence and stealth through firmware implant and disguised C2
   • DData exfiltration of sensitive information
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices a Windows workstation that periodically runs a scheduled task named 'OneDrive Sync' that executes a PowerShell script stored in the user's Startup folder. The script is obfuscated and downloads a small executable from a file-sharing site. The analyst also sees that the workstation connects to a remote IP on port 443 using the built-in Windows BITSAdmin tool. Which combination of post-exploitation techniques is the attacker most likely using?

   • APersistence via scheduled task, living off the land with PowerShell and BITSAdmin, and C2 over HTTPS
   • BLateral movement via scheduled task, persistence through PowerShell, and data exfiltration over HTTPS
   • CPrivilege escalation via scheduled task, lateral movement with PowerShell, and data exfiltration over BITSAdmin
   • DInitial exploitation via a file-sharing site, persistence through the Startup folder, and C2 using BITSAdmin
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common persistence mechanism used by attackers to maintain access to a compromised system?

   • ADeleting system event logs
   • BSending phishing emails to other users
   • CScanning the network for open ports
   • DCreating a scheduled task that runs a malicious script
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a forensic investigation, you find that a compromised host is making periodic DNS queries to a domain that resolves to an IP address that also hosts a web server. The host is sending small amounts of data encoded in DNS queries. Which type of command and control channel is being used?

   • AICMP-based C2
   • BSocial media-based C2
   • CDNS tunneling
   • DHTTP-based C2
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An incident responder is analyzing a compromised server. The attacker has already gained initial access, established persistence, and moved laterally to a database server. The responder needs to determine the attacker's primary goal. Which activity would MOST clearly indicate the goal of data exfiltration?

   • AInstalling a keylogger
   • BDownloading a large archive of customer records
   • CDeleting system logs
   • DCreating a new user account
   Reveal Solution Discussion Select an answer first