Post-Exploitation and Advanced Threat Techniques GISF Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst is reviewing logs from a compromised server. The analyst sees that the attacker used a legitimate remote administration tool to connect to the server, then used a script to compress and encrypt files, and finally sent the files to an external FTP server. Which post-exploitation phases are demonstrated?

   • APersistence, C2, and data exfiltration
   • BLateral movement, data staging, and data exfiltration
   • CLateral movement, data exfiltration, and persistence
   • DPrivilege escalation, data exfiltration, and C2
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst is reviewing network logs and notices that a compromised host is sending compressed data to a remote server via HTTP POST requests during business hours. The data is base64-encoded. Which indicator is MOST consistent with data exfiltration?

   • ADNS queries for internal hostnames
   • BFailed login attempts to the host
   • CInbound HTTP GET requests from the external server
   • DLarge outbound HTTP POST requests to an external server
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   An attacker modifies the Windows registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run` to point to a malicious executable. What is the attacker's primary objective?

   • ATo exfiltrate data to a remote server
   • BTo disable Windows Defender
   • CTo achieve persistence by executing the malware at every user logon
   • DTo escalate privileges to administrator
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An attacker compromises a standard user account on a workstation. The attacker then exploits a vulnerability in a service running with SYSTEM privileges to gain SYSTEM access. After that, the attacker uses the SYSTEM account to access a database server and steal records. Which two post-exploitation techniques are demonstrated?

   • APersistence, then data exfiltration
   • BVertical privilege escalation, then lateral movement
   • CHorizontal privilege escalation, then data exfiltration
   • DLateral movement, then vertical privilege escalation
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An organization has been breached by an APT that has been present for over a year. The attackers have used a combination of spear-phishing, valid credentials, and custom malware. They have established persistence via multiple mechanisms and are using encrypted C2 traffic. The organization's security team is considering a response. Which approach is MOST likely to be effective in evicting the APT?

   • ADeploy a new EDR solution and rely on it to detect and remove the malware
   • BReset all user passwords and enable multi-factor authentication
   • CImmediately disconnect all compromised systems from the network
   • DPerform a thorough investigation to identify all persistence mechanisms and C2 infrastructure before taking action
   Reveal Solution Discussion Select an answer first