Which of the following is a common goal of the post-exploitation phase?

Establishing persistence to maintain access across reboots

Exploiting a vulnerability to gain initial access

Encrypting network traffic with TLS

Discovering open ports on external systems

In the context of a cyber intrusion, what is the primary purpose of the post-exploitation phase?

To maintain access, escalate privileges, and achieve the attacker's objectives after initial compromise

To identify and scan for vulnerable services on the target network

To deliver the initial payload to the victim system

To patch vulnerabilities and harden the compromised system

In the context of network intrusion, what is lateral movement?

The process of moving from one compromised system to another within the network

The act of sending phishing emails to external targets

The process of covering tracks by deleting logs

The initial exploitation of a vulnerability to gain access

Which of the following best describes an Advanced Persistent Threat (APT)?

A well-resourced adversary that conducts prolonged, targeted attacks to achieve specific objectives

A type of malware that replicates itself across networks

A denial-of-service attack that uses multiple compromised systems

A vulnerability that is exploited within 24 hours of discovery

A security analyst notices that a compromised Windows workstation re-establishes a network connection to an external IP address every time the user logs in, even after the malware binary is removed. The connection is initiated by a scheduled task that runs a PowerShell script. Which persistence mechanism is the attacker most likely using?

Scheduled task with logon trigger

Windows service with auto-start

GIAC Information Security Fundamentals

Domain 3Objective 3

Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 3)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 11–15

11foundation · easy
Which of the following is a common goal of the post-exploitation phase?
Select an answer first
12foundation · easy
In the context of a cyber intrusion, what is the primary purpose of the post-exploitation phase?
Select an answer first
13foundation · easy
In the context of network intrusion, what is lateral movement?
Select an answer first
14foundation · easy
Which of the following best describes an Advanced Persistent Threat (APT)?
Select an answer first
15application · medium
A security analyst notices that a compromised Windows workstation re-establishes a network connection to an external IP address every time the user logs in, even after the malware binary is removed. The connection is initiated by a scheduled task that runs a PowerShell script. Which persistence mechanism is the attacker most likely using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.