Exploit Methodology and Analysis GMON Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing a newly discovered vulnerability in a web application. The analyst needs to determine the most efficient way to understand the exploit lifecycle from discovery to post-exploitation for this specific vulnerability. Which approach best aligns with the exploit lifecycle stages?

   • APatch the vulnerability immediately without further analysis to reduce risk.
   • BSearch for existing exploit code and immediately test it in a sandbox to confirm impact.
   • CReview only the vendor's advisory and assume the exploit's impact is as described.
   • DAnalyze the vulnerability, develop a proof-of-concept, execute it in a controlled environment, and then assess post-exploitation actions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is crafting an exploit for a client-side vulnerability. The goal is to deliver a payload that executes when a user opens a malicious document. Which delivery mechanism is most appropriate for this scenario?

   • AExploit a network service directly without user interaction.
   • BEmbed the payload in a macro-enabled Office document and send it via email.
   • CHost the payload on a web server and wait for the user to browse to it.
   • DUse a USB drop attack to physically deliver the payload.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After compromising a web server, an attacker is observed using the built-in 'wget' command to download a script from an external server and then executing it. The security team wants to detect this type of activity in the future. Which monitoring control would be most effective?

   • ABlock all outbound traffic from the server to the internet.
   • BEnable command-line auditing on the server to log all executed commands.
   • CDeploy a network intrusion detection system (NIDS) to monitor for the specific script's signature.
   • DUse file integrity monitoring to detect changes to the web server's files.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An incident responder discovers that an attacker has established persistence on a compromised host. The responder needs to remove the persistence while preserving evidence for forensic analysis. Which action is most appropriate?

   • ARebuild the host from a known-good image.
   • BDisconnect the host from the network and then remove persistence.
   • CTake a memory image and then remove the persistence mechanism.
   • DImmediately delete the persistence mechanism to stop the attacker.
   Reveal Solution Discussion Select an answer first
6. 10application · hard

   A penetration tester is crafting an exploit for a web application that uses a parameterized query to prevent SQL injection. The tester wants to find a way to bypass this control. Which technique should the tester consider?

   • ALook for second-order SQL injection vulnerabilities where user input is stored and later used in a query.
   • BUse an out-of-band technique to exfiltrate data without using SQL injection.
   • CSend the payload in a different HTTP header to bypass the parameterized query.
   • DUse a more complex SQL injection payload that is not blocked by parameterized queries.
   Reveal Solution Discussion Select an answer first