Free GIAC GDAT Exam Dumps Questions & Answers

How do attackers use the autostart functionality to maintain persistence?
Response:

• A.  By adding malicious executables to system startup
• B.  By disabling firewall settings
• C.  By encrypting network communications
• D.  By periodically clearing event logs

During a routine inspection, your security team detects a spike in outbound traffic from a user's machine to an external IP address. Upon investigation, it is discovered that a PowerShell script was used to execute a payload that is now communicating with a remote server.
What immediate actions should your team take to mitigate the attack and prevent future incidents?
Response:

• A.  Disable PowerShell on all machines across the network and isolate the compromised system
• B.  Monitor all outbound traffic for the next 24 hours to gather more data on the attack
• C.  Disconnect the compromised system from the network and analyze the script to understand the payload's behavior
• D.  Reformat the affected machine and rebuild the system from a secure backup

How does application whitelisting help prevent the execution of malicious payloads?
Response:

• A.  By detecting zero-day exploits
• B.  By only allowing pre-approved applications to run
• C.  By encrypting data transmitted over the network
• D.  By monitoring outbound traffic for anomalies

What are essential components of a Kerberos-based authentication system in Active Directory?
Response:

• A.  Key Distribution Center (KDC)
• B.  Ticket Granting Ticket (TGT)
• C.  Access Control List (ACL)
• D.  Security Account Manager (SAM)

What is the primary benefit of using encryption during data exfiltration?
Response:

• A.  It prevents detection by masking the content of the exfiltrated data
• B.  It enhances system performance
• C.  It ensures compliance with GDPR regulations
• D.  It allows attackers to bypass firewalls