What does the term 'living off the land' refer to in the context of cyber attacks?

Physically accessing a system to install malware

Using only open-source hacking tools

Using legitimate system tools and built-in features to carry out malicious activities

Relying on social engineering to gain credentials

A company wants to improve detection of attackers who use legitimate tools like PowerShell and WMI for post-exploitation. They currently only collect Windows Security event logs. Which additional data source would MOST improve visibility into these activities?

Increase the size of the security event log

Enable PowerShell script block logging and WMI activity auditing

Enable DNS debug logging on the internal DNS server

Deploy a host-based firewall that blocks PowerShell

A security analyst is investigating a compromised host that is communicating with an external server. The analyst notices that the host is making DNS queries for a domain that is not used by the organization, and the queries contain random-looking subdomains. The analyst suspects DNS tunneling. Which defensive measure would be MOST effective in detecting this activity?

Use a public DNS service for all internal queries

Block all DNS queries to external servers

Monitor DNS query patterns for anomalies such as high volume or random subdomains

Disable recursive DNS resolution

A security team is reviewing a compromised Linux server. They find a modified system service that starts a reverse shell on boot. The service is disguised as a legitimate system daemon. Which post-exploitation technique is the attacker using?

Lateral movement via the system service

Persistence via a modified system service

Privilege escalation via the reverse shell

Data exfiltration via the reverse shell

GIAC Information Security Fundamentals

Domain 3Objective 3

Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 8)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 36–40

36foundation · easy
What does the term 'living off the land' refer to in the context of cyber attacks?
Select an answer first
37application · medium
A company wants to improve detection of attackers who use legitimate tools like PowerShell and WMI for post-exploitation. They currently only collect Windows Security event logs. Which additional data source would MOST improve visibility into these activities?
Select an answer first
38foundation · easy
Which of the following protocols is commonly abused for command and control (C2) communication?
Select an answer first
39expert · hard
A security analyst is investigating a compromised host that is communicating with an external server. The analyst notices that the host is making DNS queries for a domain that is not used by the organization, and the queries contain random-looking subdomains. The analyst suspects DNS tunneling. Which defensive measure would be MOST effective in detecting this activity?
Select an answer first
40application · medium
A security team is reviewing a compromised Linux server. They find a modified system service that starts a reverse shell on boot. The service is disguised as a legitimate system daemon. Which post-exploitation technique is the attacker using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 8)

Questions 36–40

What does the term 'living off the land' refer to in the context of cyber attacks?

A company wants to improve detection of attackers who use legitimate tools like PowerShell and WMI for post-exploitation. They currently only collect Windows Security event logs. Which additional data source would MOST improve visibility into these activities?

Which of the following protocols is commonly abused for command and control (C2) communication?

A security team is reviewing a compromised Linux server. They find a modified system service that starts a reverse shell on boot. The service is disguised as a legitimate system daemon. Which post-exploitation technique is the attacker using?

Keep studying — Threats and Defenses