Attack Techniques GMON Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An incident response team is analyzing a breach where the attacker used a previously unknown vulnerability to gain access, then used a legitimate remote administration tool to move laterally, and finally exfiltrated data via encrypted HTTPS traffic. The team must decide where to focus their detection efforts to prevent future similar attacks. Which detection strategy would be most effective?

   • ABlock all encrypted HTTPS traffic to prevent data exfiltration
   • BDeploy a network intrusion detection system (NIDS) to detect the exploit signature
   • CMonitor for the use of the remote administration tool and unusual data transfer patterns
   • DFocus on patching the vulnerability immediately
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is analyzing a memory dump from a compromised server. The analyst suspects that the attacker used a reflective DLL injection to load a payload directly into memory without writing to disk. The analyst needs to confirm this and identify indicators for monitoring. Which approach is most effective?

   • ARun a full antivirus scan on the server.
   • BAnalyze the memory dump for suspicious memory regions and loaded modules that are not backed by files on disk.
   • CCheck the Windows event logs for process creation events.
   • DSearch the server's file system for the malicious DLL file.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is reviewing a recent intrusion where the attacker used a previously unknown exploit for a zero-day vulnerability in a public-facing application. The exploit allowed remote code execution, and the attacker then used living-off-the-land binaries (LOLBins) to move laterally. The team must decide where to focus monitoring to detect similar attacks in the future, given that signature-based detection is ineffective for zero-days. Which strategy is most effective?

   • AIncrease the frequency of vulnerability scans to identify and patch zero-day vulnerabilities faster.
   • BFocus on behavioral detection of post-exploitation activities, such as unusual process execution and lateral movement patterns.
   • CRely on threat intelligence feeds for indicators of compromise related to the zero-day.
   • DDeploy more honeypots to lure attackers away from production systems.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is analyzing an exploit that targets a vulnerability in a widely used application. The exploit is known to be used by a specific threat actor. The analyst needs to determine the best way to detect this exploit in the environment. Which approach would provide the most reliable detection?

   • AWait for the vendor to release a signature for the exploit
   • BUse the exploit's file hash to detect the malicious payload
   • CBlock the application from running
   • DMonitor for the specific behavior of the exploit, such as unusual process creation or memory access patterns
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is reviewing alerts from an endpoint detection and response (EDR) tool. The alert shows that a process spawned from a Microsoft Word document executed a PowerShell command that downloaded a payload from a URL and then ran it. Which attack technique is being used?

   • AScript-based injection
   • BCommand and control via HTTP
   • CSpear-phishing attachment
   • DMalicious macro with download and execute
   Reveal Solution Discussion Select an answer first