GCIH Post Exploitation Incident Analysis Quiz

1. What is a 'rootkit' in the context of post-exploitation attacks?

A toolkit for removing malware

Software that hides the attacker's presence and maintains unauthorized access

A firewall configuration tool

An antivirus scanning utility

2. Which of the following best describes 'threat hunting' in post-exploitation analysis?

Passively waiting for alerts from security tools

Proactively searching for indicators of compromise and attacker activity

Hiring external security consultants

Blocking all internet traffic

3. In incident response, what does 'containment' involve during post-exploitation phase?

Isolating affected systems to prevent further damage or spread

Notifying external law enforcement immediately

Publicly announcing the breach details

Restoring all systems from backups without analysis

4. What is 'lateral movement' in the context of post-exploitation activity?

The attacker moving to a different geographic location

The attacker moving horizontally across the network to other systems

The organization relocating its data center

Users changing their office desks

5. Which Windows Registry hive is most relevant for analyzing user activity and persistence mechanisms?

HKEY_LOCAL_MACHINE\SYSTEM

HKEY_CURRENT_USER\Software\Run

HKEY_CLASSES_ROOT

HKEY_PERFORMANCE_DATA

6. What is the primary purpose of creating a timeline during incident analysis?

To schedule future security meetings

To establish the sequence of events and identify attack progression

To document employee work schedules

To plan system maintenance windows

7. In post-exploitation analysis, what is 'privilege escalation'?

The process of promoting an employee

Gaining higher-level access rights after initial system compromise

Increasing network bandwidth

Upgrading software versions

8. Which tool is commonly used for memory forensics to analyze RAM dumps from compromised systems?

Volatility

Wireshark

Burp Suite

Metasploit

9. What does 'data exfiltration' mean in the context of post-exploitation incidents?

Removing malware from infected systems

Unauthorized transfer of sensitive data outside the organization

Restoring system backups

Updating security patches

10. When examining network traffic for post-exploitation activity, which protocol is often used for command and control (C2) communication?

DNS and HTTP/HTTPS

DHCP and ARP

STP and OSPF

NTP and SNMP

11. What is the primary goal of post-exploitation analysis in incident response?

Identify the attacker's identity and location

Determine the extent of the compromise and impact on systems

Immediately restore all systems to original state

Prevent all future attacks permanently

12. In Linux systems, which log file typically contains authentication attempts and user login information?

/var/log/auth.log

/var/log/kernel.log

/var/log/system.log

/var/log/network.log

13. What is the primary advantage of using live forensics during incident response?

It eliminates the need for physical evidence

It captures volatile data before the system is powered down

It requires no special tools or expertise

It guarantees the attacker will not return

14. Which of the following is NOT typically part of a post-exploitation indicator of compromise (IOC)?

Suspicious file hashes

Unusual network connections

System uptime duration

Malicious domain names

15. In post-exploitation analysis, what does 'persistence mechanism' refer to?

Methods used by attackers to maintain access after initial compromise

The attacker's home base infrastructure

Network monitoring tools

Encryption algorithms used in attacks

16. What is the purpose of creating a forensic image of a compromised system?

To create a backup for disaster recovery

To preserve evidence in its original state for analysis

To speed up system performance

To compress storage requirements

17. Which Windows artifact is most useful for identifying lateral movement attempts by an attacker?

Event Viewer logs and security event IDs

Desktop shortcuts

Font files

Screensaver settings

18. When analyzing compromised systems, volatile data should be collected before non-volatile data. What is an example of volatile data?

Hard drive contents

System memory (RAM) and running processes

BIOS settings

Backup tapes

19. In forensic analysis, what does the term 'chain of custody' refer to?

The physical location of evidence storage

The documented record of who handled evidence and when

The legal authority to conduct investigations

The timeline of the attack sequence

20. Which of the following is a critical first step when responding to a post-exploitation incident?

Isolate affected systems to prevent further compromise

Delete suspicious files immediately

Notify only the executive team

Restart all compromised servers