A security analyst notices a series of failed logon attempts to a domain controller, followed by a successful logon from an unfamiliar IP address at 3:00 AM. Later, the analyst observes the same IP address querying the domain controller for the list of domain admins. Which attack technique is the analyst most likely observing?

Brute-force attack followed by internal reconnaissance

A security operations center (SOC) is reviewing its monitoring coverage. They notice that an attacker was able to move from a compromised workstation to a domain controller using Pass-the-Hash. The SOC wants to add a detection that would have caught this lateral movement. Which monitoring control is most directly aligned with detecting Pass-the-Hash?

Monitor for changes to firewall rules on the domain controller.

Monitor for unusual processes spawning from Office applications.

Monitor for anomalous use of administrative credentials on multiple hosts.

Monitor for large outbound data transfers to external IPs.

Which attack vector is most directly associated with the use of malicious email attachments to gain initial access?

Exploitation of a software vulnerability

A security architect is designing monitoring for a hybrid environment with on-premises servers and cloud workloads. The organization has a mature SIEM but limited budget for new tools. They want to detect lateral movement using Pass-the-Hash, which is a known risk. The architect must choose a detection strategy that balances cost and effectiveness. Which approach is most cost-effective and aligned with detecting Pass-the-Hash?

Implement network segmentation to limit lateral movement paths.

Use a threat intelligence feed to block known malicious IPs.

Enable Windows event log 4624 (logon) collection and correlate for the same account logging on from multiple hosts.

Deploy an EDR solution on all endpoints to detect credential dumping and lateral movement.

A security analyst is analyzing a newly discovered exploit that targets a vulnerability in a web server. The analyst wants to understand the exploit's impact and identify indicators of compromise (IOCs) for detection. Which step should the analyst take first?

Run the exploit in a controlled sandbox environment

Disconnect the web server from the network

Search the internet for the exploit's source code

Patch the vulnerability immediately

GIAC Continuous Monitoring Certification

Domain 6Objective 1

Attack Techniques GMON Practice Questions (Page 2)

Part of the Attack and Exploit Analysis domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 6–10

6application · medium
A security analyst notices a series of failed logon attempts to a domain controller, followed by a successful logon from an unfamiliar IP address at 3:00 AM. Later, the analyst observes the same IP address querying the domain controller for the list of domain admins. Which attack technique is the analyst most likely observing?
Select an answer first
7application · medium
A security operations center (SOC) is reviewing its monitoring coverage. They notice that an attacker was able to move from a compromised workstation to a domain controller using Pass-the-Hash. The SOC wants to add a detection that would have caught this lateral movement. Which monitoring control is most directly aligned with detecting Pass-the-Hash?
Select an answer first
8foundation · easy
Which attack vector is most directly associated with the use of malicious email attachments to gain initial access?
Select an answer first
9expert · hard
A security architect is designing monitoring for a hybrid environment with on-premises servers and cloud workloads. The organization has a mature SIEM but limited budget for new tools. They want to detect lateral movement using Pass-the-Hash, which is a known risk. The architect must choose a detection strategy that balances cost and effectiveness. Which approach is most cost-effective and aligned with detecting Pass-the-Hash?
Select an answer first
10application · medium
A security analyst is analyzing a newly discovered exploit that targets a vulnerability in a web server. The analyst wants to understand the exploit's impact and identify indicators of compromise (IOCs) for detection. Which step should the analyst take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Attack Techniques GMON Practice Questions (Page 2)

Questions 6–10

Which attack vector is most directly associated with the use of malicious email attachments to gain initial access?

A security analyst is analyzing a newly discovered exploit that targets a vulnerability in a web server. The analyst wants to understand the exploit's impact and identify indicators of compromise (IOCs) for detection. Which step should the analyst take first?

Keep studying — Attack and Exploit Analysis