A security team is developing a playbook for responding to a confirmed intrusion. The playbook must prioritize actions that limit the attacker's ability to achieve their post-exploitation goals. Which action should be performed FIRST?

Rebuild the compromised host from a known-good image

Isolate the compromised host from the network

Collect forensic images from the compromised host

Change all domain user passwords

A security analyst sees that an attacker on a compromised host is using the built-in Windows tool 'net.exe' to enumerate domain groups and 'psexec' to execute commands on other hosts. Which post-exploitation technique is the attacker using, and why is it difficult to detect?

Command and control, because these tools can create C2 channels

Living off the land, because these are legitimate administrative tools that may not be blocked

Data exfiltration, because these tools can transfer data

Privilege escalation, because these tools can grant admin rights

A system administrator finds a new local user account on a server that they did not create. The account is a member of the Administrators group. The administrator also notices a scheduled task that runs a script to create the account again if it is deleted. Which post-exploitation technique is the attacker using?

Persistence via a backdoor account and scheduled task

Lateral movement via the scheduled task

Data exfiltration via the script

Privilege escalation via the Administrators group

GIAC Information Security Fundamentals

Domain 3Objective 3

Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 11)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 51–53

51application · medium
A security team is developing a playbook for responding to a confirmed intrusion. The playbook must prioritize actions that limit the attacker's ability to achieve their post-exploitation goals. Which action should be performed FIRST?
Select an answer first
52application · medium
A security analyst sees that an attacker on a compromised host is using the built-in Windows tool 'net.exe' to enumerate domain groups and 'psexec' to execute commands on other hosts. Which post-exploitation technique is the attacker using, and why is it difficult to detect?
Select an answer first
53application · medium
A system administrator finds a new local user account on a server that they did not create. The account is a member of the Administrators group. The administrator also notices a scheduled task that runs a script to create the account again if it is deleted. Which post-exploitation technique is the attacker using?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 11)

Questions 51–53

A security team is developing a playbook for responding to a confirmed intrusion. The playbook must prioritize actions that limit the attacker's ability to achieve their post-exploitation goals. Which action should be performed FIRST?

A security analyst sees that an attacker on a compromised host is using the built-in Windows tool 'net.exe' to enumerate domain groups and 'psexec' to execute commands on other hosts. Which post-exploitation technique is the attacker using, and why is it difficult to detect?

Keep studying — Threats and Defenses