Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company wants to reduce the risk of attackers using legitimate tools for post-exploitation. They have a mature security team and want a control that is effective but does not disrupt normal administrative work. Which control would BEST meet this requirement?

   • ADisable all command-line tools on user workstations
   • BRequire all administrative tasks to be performed from a dedicated jump host
   • CMonitor only for known malware signatures
   • DImplement application whitelisting that allows only approved administrative tools
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a common tactic used by advanced persistent threats (APTs)?

   • AUsing only phishing as the initial access vector
   • BLaunching a single, loud attack to maximize disruption
   • CUsing custom malware and living-off-the-land techniques to avoid detection
   • DRelying solely on publicly available exploit kits
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security team is investigating a possible data breach. They notice that a server has been sending large amounts of data to a file-sharing website using the built-in 'certutil' tool. The data is encrypted and the traffic is over HTTPS. The team has limited resources and must choose one control to implement. Which control would be MOST effective at detecting this specific exfiltration?

   • AIncrease logging on the file-sharing website
   • BMonitor outbound traffic for large transfers to file-sharing domains
   • CBlock all use of certutil on servers
   • DRequire data loss prevention (DLP) to inspect all HTTPS traffic
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A helpdesk account was compromised. The attacker used that account to access a file share containing HR records, which the helpdesk account was not authorized to read. The attacker then used the same account to connect to a database server and run a query that returned customer PII. Which type of privilege escalation did the attacker perform?

   • ALateral movement
   • BHorizontal privilege escalation
   • CPersistence establishment
   • DVertical privilege escalation
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An organization has been compromised by an APT that has maintained access for several months. The attackers have used valid credentials, modified scheduled tasks, and communicated with an external server using HTTPS on port 443. Which combination of indicators is MOST consistent with an APT?

   • AUse of custom malware with no persistence and unencrypted C2
   • BReliance on a single compromised account and no lateral movement
   • CUse of valid credentials, persistence mechanisms, and encrypted C2 traffic
   • DRapid exploitation of a single vulnerability and immediate data destruction
   Reveal Solution Discussion Select an answer first