Attack Techniques GMON Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is a typical step in the process of analyzing an exploit?

   • AImmediately notifying law enforcement
   • BDeleting all logs related to the exploit
   • CExecuting the exploit in a controlled sandbox environment
   • DDisabling the firewall to allow the exploit to run
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which attack technique is characterized by an attacker sending a malicious email that appears to come from a trusted source to trick the recipient into revealing credentials or clicking a malicious link?

   • ASpear phishing
   • BDenial of service
   • CSQL injection
   • DMan-in-the-middle
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing logs and observes that a user account successfully authenticated to a server at 2:00 AM from an IP address in a foreign country, and then immediately attempted to access multiple shared folders. The user is based in the local office and has no history of remote access. Which attack technique is most likely being observed?

   • ASQL injection
   • BPhishing
   • CDenial of service
   • DCredential theft and reuse
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization wants to improve its detection capabilities by aligning monitoring with the MITRE ATT&CK framework. They have identified that their current monitoring focuses on initial access and execution, but they are missing visibility into persistence and lateral movement. Which monitoring improvement would best address this gap?

   • AImplement a SIEM to correlate all existing logs
   • BEnable logging for scheduled tasks, services, and remote PowerShell sessions
   • CDeploy additional honeypots to attract attackers
   • DIncrease the frequency of vulnerability scans
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During a red team exercise, the team successfully gained initial access via a vulnerable web application, then used a PowerShell script to enumerate Active Directory, and finally attempted to exfiltrate data via HTTPS. The blue team wants to improve detection at each stage. Which detection is most appropriate for the enumeration stage?

   • AMonitor for failed login attempts on the domain controller.
   • BMonitor for large outbound HTTPS traffic to a single external IP.
   • CMonitor for unusual PowerShell activity, such as script block logging and command-line arguments.
   • DMonitor for web application vulnerabilities using a vulnerability scanner.
   Reveal Solution Discussion Select an answer first