A malware analyst is examining a sample that uses a known Windows API to create a mutex named 'Global\UniqueMutex2024' and then writes a configuration file to the user's AppData folder. The analyst needs to determine if this malware is unique or part of a known family. The analyst has limited time and must choose the most efficient approach. Which approach is most efficient?

Run the malware in a sandbox and capture all network traffic.

Submit the sample to an antivirus vendor for manual analysis.

Perform a full reverse engineering of the binary to understand its functionality.

Search online threat intelligence platforms for the mutex name and configuration file path.

A SOC analyst is reviewing alerts from a SIEM and sees that a user account has been locked out after multiple failed logon attempts from a single workstation. The analyst also notices that the same workstation has been making connections to an internal file server using a different account. The analyst suspects an attacker is attempting to brute-force credentials and then use them for lateral movement. Which action is most appropriate to confirm the attack technique?

Correlate the failed logon events with the successful logon events on the file server to see if the same account was used.

Reset the password for the locked-out account.

Block the workstation's IP address at the firewall immediately.

Ignore the alert because account lockouts are common.

A security team is reviewing its monitoring strategy after a phishing attack that led to a ransomware deployment. The attack vector was a malicious macro in an Excel spreadsheet. The team wants to improve detection of similar attacks in the future. Which control is most directly aligned with detecting this attack vector?

Implement network segmentation to isolate the finance department.

Monitor for large outbound data transfers.

Enable macro security settings and monitor for Office applications spawning PowerShell.

Deploy a web application firewall (WAF) in front of the email gateway.

A malware analyst is analyzing a sample that, when executed, modifies the Windows registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to point to a malicious executable. The analyst wants to determine the malware's persistence mechanism and identify a detection opportunity. Which detection is most effective for this persistence mechanism?

Monitor for unusual network connections to external IPs.

Monitor for new user accounts being created.

Monitor registry key modifications to autorun locations.

Monitor for high CPU usage on the endpoint.

When aligning detection strategies with attack techniques, which approach is best suited for detecting an attacker who is using a known malware family?

Signature-based detection using malware hashes

Network traffic baseline analysis

GIAC Continuous Monitoring Certification

Domain 6Objective 1

Attack Techniques GMON Practice Questions (Page 1)

Part of the Attack and Exploit Analysis domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 1–5

1expert · hard
A malware analyst is examining a sample that uses a known Windows API to create a mutex named 'Global\UniqueMutex2024' and then writes a configuration file to the user's AppData folder. The analyst needs to determine if this malware is unique or part of a known family. The analyst has limited time and must choose the most efficient approach. Which approach is most efficient?
Select an answer first
2expert · hard
A SOC analyst is reviewing alerts from a SIEM and sees that a user account has been locked out after multiple failed logon attempts from a single workstation. The analyst also notices that the same workstation has been making connections to an internal file server using a different account. The analyst suspects an attacker is attempting to brute-force credentials and then use them for lateral movement. Which action is most appropriate to confirm the attack technique?
Select an answer first
3application · medium
A security team is reviewing its monitoring strategy after a phishing attack that led to a ransomware deployment. The attack vector was a malicious macro in an Excel spreadsheet. The team wants to improve detection of similar attacks in the future. Which control is most directly aligned with detecting this attack vector?
Select an answer first
4application · medium
A malware analyst is analyzing a sample that, when executed, modifies the Windows registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to point to a malicious executable. The analyst wants to determine the malware's persistence mechanism and identify a detection opportunity. Which detection is most effective for this persistence mechanism?
Select an answer first
5foundation · easy
When aligning detection strategies with attack techniques, which approach is best suited for detecting an attacker who is using a known malware family?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Attack Techniques GMON Practice Questions (Page 1)

Questions 1–5

When aligning detection strategies with attack techniques, which approach is best suited for detecting an attacker who is using a known malware family?

Keep studying — Attack and Exploit Analysis