A threat intelligence report describes an adversary that uses spear-phishing emails with malicious macros, then leverages PowerShell to download additional tools, and finally uses scheduled tasks for persistence. How would a security team best use this TTP information to improve their continuous monitoring?

Monitor for PowerShell execution and scheduled task creation in addition to email filtering

Create detection rules for the specific email subject lines and sender addresses

Block all PowerShell usage and disable scheduled tasks across the environment

Focus only on network traffic to known command-and-control domains

A security team is reviewing their monitoring priorities. They have limited resources and need to focus on the attack vector that is most likely to result in initial compromise of their internet-facing systems. Which attack vector should they prioritize?

Phishing emails targeting employees

Exploitation of unpatched vulnerabilities in web applications

Insider threats from disgruntled employees

Lateral movement from compromised internal hosts

GIAC Continuous Monitoring Certification

Domain 6Objective 1

Attack Techniques GMON Practice Questions (Page 7)

Part of the Attack and Exploit Analysis domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 31–35

31foundation · easy
In a continuous monitoring environment, which technique is commonly used by attackers to evade signature-based detection by altering the code of a known malware sample while preserving its functionality?
Select an answer first
32application · medium
A security team is assessing the risk of various attack vectors. They have a mix of on-premises servers and cloud workloads. Which attack vector is most relevant to both environments and should be prioritized for monitoring?
Select an answer first
33foundation · easy
Which attack vector is characterized by an attacker moving from one compromised system to another within the network?
Select an answer first
34application · medium
A threat intelligence report describes an adversary that uses spear-phishing emails with malicious macros, then leverages PowerShell to download additional tools, and finally uses scheduled tasks for persistence. How would a security team best use this TTP information to improve their continuous monitoring?
Select an answer first
35application · medium
A security team is reviewing their monitoring priorities. They have limited resources and need to focus on the attack vector that is most likely to result in initial compromise of their internet-facing systems. Which attack vector should they prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Attack Techniques GMON Practice Questions (Page 7)

Questions 31–35

In a continuous monitoring environment, which technique is commonly used by attackers to evade signature-based detection by altering the code of a known malware sample while preserving its functionality?

A security team is assessing the risk of various attack vectors. They have a mix of on-premises servers and cloud workloads. Which attack vector is most relevant to both environments and should be prioritized for monitoring?

Which attack vector is characterized by an attacker moving from one compromised system to another within the network?

A security team is reviewing their monitoring priorities. They have limited resources and need to focus on the attack vector that is most likely to result in initial compromise of their internet-facing systems. Which attack vector should they prioritize?

Keep studying — Attack and Exploit Analysis