Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A forensic analyst discovers that a compromised Windows system has a new service named 'Windows Update Service' that runs a binary located in the user's AppData folder. The service is configured to start automatically. Which persistence mechanism is being used?

   • AWindows service
   • BScheduled task
   • CRegistry Run key
   • DWMI event subscription
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of an attacker 'living off the land'?

   • AExploiting a buffer overflow in a web server
   • BUsing a USB drive to infect a system
   • CUsing PowerShell to download and execute a payload in memory
   • DUploading a custom backdoor executable to the target
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An incident responder is investigating a breach. The attacker used a compromised service account to access a file server and then used the same account to access a database server. The service account has different permissions on each server. Which post-exploitation technique is the attacker using, and what is the PRIMARY defensive recommendation?

   • AData exfiltration using a service account; the recommendation is to block outbound traffic
   • BVertical privilege escalation using a service account; the recommendation is to rotate the account password
   • CLateral movement using a compromised service account; the recommendation is to enforce least privilege and monitor service account usage
   • DPersistence using a service account; the recommendation is to disable the account
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is an indicator of data exfiltration?

   • AA new user account being created
   • BA sudden decrease in CPU usage
   • CA large volume of data being sent to an external IP address during off-hours
   • DAn increase in failed login attempts
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is investigating a series of suspicious activities on their network. They notice that an attacker is using `powershell.exe` to download and execute a script from a remote server, and then using `schtasks.exe` to create a scheduled task. The team's security tools do not flag these activities because the binaries are legitimate. Which defensive strategy would be MOST effective in detecting this living-off-the-land behavior?

   • ABlock all PowerShell execution
   • BRely on antivirus signatures for PowerShell scripts
   • CMonitor PowerShell script block logging and command-line arguments
   • DDisable scheduled tasks
   Reveal Solution Discussion Select an answer first