A security analyst notices repeated failed login attempts against a public-facing web application, followed by a successful login from the same IP and then a series of requests to a rarely used administrative endpoint. The analyst wants to detect this pattern earlier in the exploit lifecycle. Which monitoring approach would best achieve this?

Correlate authentication logs with web application firewall (WAF) alerts to flag successful logins followed by access to sensitive endpoints.

Increase the password complexity policy to make brute-force attacks less likely to succeed.

Block the IP address after the first failed login attempt.

Enable verbose logging on the application server to capture all request parameters.

A company wants to reduce the risk of exploit execution on its endpoints. Which combination of measures is most effective?

Monitor logs and conduct regular backups.

Use a firewall and network segmentation.

Enable DEP and ASLR, and keep software patched.

Disable user accounts and require complex passwords.

After successfully exploiting a vulnerability on a server, an attacker wants to maintain access even after a reboot. Which post-exploitation technique is most appropriate for this goal?

Create a new local user account with administrative privileges.

Clear the event logs to hide traces.

Kill the antivirus process to avoid detection.

Exfiltrate sensitive data to an external server.

A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability in a web application that is no longer supported by the vendor. The application is business-critical and cannot be replaced immediately. Which mitigation should the analyst recommend first?

Implement a web application firewall (WAF) rule to block known exploit patterns.

Disable the application until a replacement can be deployed.

Apply a vendor patch from a third-party source.

Increase logging on the application server.

GIAC Continuous Monitoring Certification

Domain 6Objective 2

Exploit Methodology and Analysis GMON Practice Questions (Page 7)

Part of the Attack and Exploit Analysis domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 31–35

31application · medium
An incident responder is analyzing a compromised workstation and finds that the attacker used a legitimate remote administration tool to connect to other workstations on the network. Which post-exploitation technique does this represent?
Select an answer first
32application · medium
A security analyst notices repeated failed login attempts against a public-facing web application, followed by a successful login from the same IP and then a series of requests to a rarely used administrative endpoint. The analyst wants to detect this pattern earlier in the exploit lifecycle. Which monitoring approach would best achieve this?
Select an answer first
33application · medium
A company wants to reduce the risk of exploit execution on its endpoints. Which combination of measures is most effective?
Select an answer first
34application · medium
After successfully exploiting a vulnerability on a server, an attacker wants to maintain access even after a reboot. Which post-exploitation technique is most appropriate for this goal?
Select an answer first
35application · medium
A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability in a web application that is no longer supported by the vendor. The application is business-critical and cannot be replaced immediately. Which mitigation should the analyst recommend first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Exploit Methodology and Analysis GMON Practice Questions (Page 7)

Questions 31–35

An incident responder is analyzing a compromised workstation and finds that the attacker used a legitimate remote administration tool to connect to other workstations on the network. Which post-exploitation technique does this represent?

A company wants to reduce the risk of exploit execution on its endpoints. Which combination of measures is most effective?

After successfully exploiting a vulnerability on a server, an attacker wants to maintain access even after a reboot. Which post-exploitation technique is most appropriate for this goal?

A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability in a web application that is no longer supported by the vendor. The application is business-critical and cannot be replaced immediately. Which mitigation should the analyst recommend first?

Keep studying — Attack and Exploit Analysis