Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a defensive measure to mitigate lateral movement?

   • AAllowing all outbound traffic to the internet
   • BDisabling all firewall rules
   • CImplementing network segmentation to limit communication between systems
   • DUsing the same local administrator password on all systems
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a defensive measure that can help detect post-exploitation activities?

   • ADeleting all scheduled tasks on a regular basis
   • BMonitoring for unusual use of PowerShell and other scripting tools
   • CDisabling all outbound network traffic
   • DUsing only signature-based antivirus
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is investigating a host that is using the built-in Windows tool 'wmic' to query system information and 'schtasks' to create scheduled tasks on remote systems. The team has limited visibility into command-line arguments. Which additional data source would provide the MOST useful information for detecting this activity?

   • AEnable DNS logging on the DNS server
   • BEnable command-line auditing in Windows event logs
   • CIncrease the size of the security event log
   • DDeploy a network intrusion detection system
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A threat actor has compromised a Linux server and is using `ssh`, `scp`, and `curl` to move data to an external server. The security team's EDR does not flag these activities because they are performed by legitimate system binaries. Which defensive technique would be MOST effective in detecting this behavior?

   • AIncrease logging verbosity for all services
   • BRely solely on antivirus signatures
   • CMonitor for unusual command-line usage and network connections
   • DDisable SSH and curl on all servers
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An incident responder discovers that an attacker used a compromised domain admin account to connect to multiple servers and create new local admin accounts. The attacker then used those local accounts to access other servers. Which post-exploitation technique is the attacker using, and what is the PRIMARY defensive concern?

   • ALateral movement using pass-the-hash; the concern is that local admin accounts can be used to move across the network
   • BData exfiltration using domain admin; the concern is that sensitive data is being copied
   • CPersistence via local admin accounts; the concern is that the attacker can return later
   • DVertical privilege escalation using a domain admin; the concern is that the attacker gains more privileges
   Reveal Solution Discussion Select an answer first