Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team notices a server that frequently sends large volumes of data to a cloud storage service using the built-in 'curl' utility. The data is compressed and encrypted before transmission. The server has no business need to use cloud storage. Which defensive measure would MOST directly detect this activity?

   • ADisable the curl utility on all servers
   • BIncrease the frequency of full disk backups
   • CReview local authentication logs for failed logins
   • DMonitor outbound network traffic for unusual volumes and destinations
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that a compromised host sends a small HTTP request to a remote server every 60 seconds. The response contains an encrypted payload that the host executes. The analyst also sees that the host uses the same HTTP request to send small amounts of data back. Which post-exploitation technique is the attacker using?

   • ACommand and control via HTTP beaconing
   • BPersistence via scheduled HTTP requests
   • CLateral movement via HTTP requests
   • DData exfiltration via HTTP tunneling
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is investigating a suspected APT. The analyst finds that a compromised host makes periodic DNS queries to a domain that resolves to different IP addresses, and the host sends small amounts of data encoded in the DNS queries. The organization has strict egress filtering that only allows DNS and HTTPS outbound. Which C2 channel is the attacker using, and why is it effective in this environment?

   • AHTTPS beaconing, because it uses the allowed HTTPS port and blends with web traffic
   • BICMP tunneling, because ICMP is often allowed and can carry data
   • CPeer-to-peer C2, because it uses multiple IP addresses to avoid detection
   • DDNS tunneling, because DNS traffic is typically allowed and may not be deeply inspected
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a common data exfiltration method?

   • AUploading stolen files to a cloud storage service
   • BEncrypting the hard drive with ransomware
   • CDeleting system files to cause a crash
   • DScanning for open ports on the internal network
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst notices that a compromised host is sending data to a cloud storage service via HTTPS, but the volume is low and the traffic appears to be normal web traffic. The analyst suspects that the attacker is using a covert channel. Which technique would be MOST effective in detecting this type of exfiltration?

   • ARely on the cloud provider's logs to detect exfiltration
   • BInspect the content of HTTPS traffic using a proxy
   • CBlock all HTTPS traffic to cloud storage services
   • DMonitor for unusual patterns in HTTPS traffic, such as periodic bursts or data sent to non-approved cloud services
   Reveal Solution Discussion Select an answer first