GSEC Malicious Code and Exploit Mitigation — All Questions With Answers

Question 1

Which TWO of the following methodologies are most effective for mitigating the risk of buffer overflow exploits in legacy C-based applications?

Accepted Answer

Implementing Address Space Layout Randomization (ASLR).. Buffer overflows exploit memory management flaws, allowing arbitrary code execution. Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are kernel-level security features that significantly increase the difficulty for an attacker to reliably execute shellcode. These mitigations force attackers to bypass complex memory protections, often leading to application crashes rather than successful exploitation, which is a critical defense-in-depth strategy when source code refactoring is not immediately feasible.

Answer

Enforcing strict firewall rules on outbound traffic.

Answer

Increasing the frequency of password rotations for users.

Answer

Installing additional anti-malware agents on the server.

Question 2

When analyzing a suspected piece of malicious code in a sandbox, which THREE of the following behaviors are critical to monitor to determine the intent of the malware?

Accepted Answer

Modifications to registry keys for persistence.. Effective sandbox analysis requires observation of the malware's interaction with the operating system. Monitoring registry modifications, network traffic, and file system changes provides the necessary context to determine the malware's purpose—such as establishing persistence, exfiltrating data, or self-replication. These indicators are foundational to generating high-fidelity alerts and strengthening defenses against the specific techniques employed by the analyzed code during its execution lifecycle in a controlled, isolated environment.

Answer

The color depth settings of the monitor resolution.

Answer

The total number of installed fonts on the system.

Question 3

An organization is concerned about malicious code using Domain Generation Algorithms (DGA) for command-and-control communication. Which defensive measure is most effective against this threat?

Accepted Answer

Implementing a DNS sinkhole to capture NXDOMAIN queries.. DGA malware generates thousands of pseudo-random domain names to hide its C2 infrastructure. Because the malware cycles through these domains, blacklisting individual domains is ineffective. Implementing a robust DNS monitoring and filtering solution that uses reputation-based analysis or detects high volumes of NXDOMAIN (Non-Existent Domain) responses is necessary. This approach identifies the underlying algorithm pattern rather than individual sites, allowing the network to block the malware's attempt to 'phone home' to the attacker.

Answer

Manually updating the hosts file with known malicious domains.

Answer

Disabling DNSSEC on all internal servers.

Answer

Increasing the timeout settings on local DNS resolvers.

Question 4

A security administrator is implementing a defense-in-depth strategy to mitigate the risk of exploit kits delivered via malicious advertisements (malvertising). The administrator wants to prevent drive-by download attacks that exploit vulnerabilities in browser plugins. Which TWO of the following measures are MOST effective for this specific threat? (Choose two.)

Accepted Answer

Enable automatic updates for all browser plugins and remove unused or unsupported plugins.. Ad blockers prevent malicious ads from loading, cutting off the delivery mechanism for many exploit kits. Patching and removing vulnerable plugins eliminates the software flaws that these kits target. Together, they provide a strong defense against malvertising-driven drive-by downloads. The other options are either too disruptive or not targeted to the specific threat.

Answer

Set the browser's security zone to High and prompt for ActiveX controls.

Answer

Implement a Host-based Intrusion Prevention System (HIPS) that blocks all outbound connections from browsers.

Answer

Configure the browser to disable JavaScript execution entirely.

Question 5

A security analyst is investigating a suspected malware infection on a Windows server. The analyst observes that a process named 'svchost.exe' is making anomalous network connections to an external IP address. Upon further inspection, the process is running from C:\Users\Public\ instead of the standard C:\Windows\System32\ directory. Which of the following is the MOST appropriate immediate action to mitigate the threat while preserving evidence?

Accepted Answer

Capture a memory dump of the process and the system, then terminate the process.. The order of volatility dictates that memory should be captured before terminating a process or shutting down a system. Capturing a memory dump of the suspicious process and the system preserves critical evidence like running code and network connections. Terminating the process afterward stops the immediate threat. This approach aligns with forensic best practices and incident response procedures.

Answer

Isolate the server from the network, then capture a memory dump.

Answer

Terminate the process and then capture a memory dump of the system.

Answer

Run a full antivirus scan on the server to remove the malware.

Question 6

An administrator identifies a suspicious process masquerading as a system service. To mitigate the risk while maintaining evidence, which action is the most appropriate first step in a professional incident response lifecycle?

Accepted Answer

Isolate the infected host from the network via switch port shutdown.. Isolating the host from the network preserves the integrity of the volatile memory and prevents command-and-control communication. In security operations, containment precedes deep analysis to ensure the adversary cannot execute further malicious actions or delete artifacts. This approach balances the need for forensic readiness with the urgent requirement to stop ongoing lateral movement or data exfiltration, adhering to standard GIAC incident response methodologies regarding host-based threat containment.

Answer

Immediately terminate the process using the task manager.

Answer

Perform a full system backup to an external network share.

Answer

Run a full scan with the local antivirus engine.

Question 7

Which security control is most effective at preventing the execution of unauthorized or malicious software by enforcing a 'deny-by-default' policy on a workstation?

Accepted Answer

Application Whitelisting (e.g., AppLocker or WDAC).. Application whitelisting (or Application Control) prevents any program from running unless it is explicitly permitted by a defined policy. This is vastly superior to blacklisting, which can only block known threats. In a professional environment, this controls the execution environment, significantly reducing the attack surface by ensuring that only vetted and approved binaries, scripts, and installers can run, effectively mitigating zero-day threats and unauthorized utility usage.

Answer

Endpoint Detection and Response (EDR) agents.

Answer

Next-Generation Antivirus (NGAV) with behavioral analysis.

Answer

Host-based Intrusion Prevention System (HIPS).

Question 8

A security analyst is concerned about Fileless Malware attacks. Which technique is most effective for detecting code that resides only in memory without writing files to the disk?

Accepted Answer

Enabling PowerShell Script Block Logging.. Fileless malware often uses legitimate tools like PowerShell or WMI to execute code in memory. To detect this, analysts must shift from file-based scanning to process-based monitoring. Logging PowerShell Script Block Logging (Event ID 4104) and capturing command-line arguments are essential. These logs provide visibility into the actual code being executed in memory, which is the only way to catch threats that bypass traditional signature-based disk scanners by living off the land.

Answer

Deploying a traditional antivirus signature update.

Answer

Scanning the hard drive for unauthorized startup files.

Answer

Performing integrity checks on system binaries.

Question 9

Which of the following describes the primary goal of using a 'Honeytoken' in an environment to mitigate malicious code and insider threats?

Accepted Answer

To serve as a decoy for detecting unauthorized access.. Honeytokens are fake credentials, files, or data entries planted in a system to act as a tripwire. Because no legitimate user or process should ever access these items, any attempt to use or read them provides a high-fidelity alert of malicious activity. This strategy is highly effective for detecting lateral movement, data exfiltration attempts, or credential harvesting by malware that is already inside the perimeter and searching for targets.

Answer

To automatically patch vulnerabilities in real-time.

Answer

To encrypt sensitive data for long-term storage.

Answer

To provide a secure sandbox for testing malware.

Question 10

Which THREE of the following are primary defensive strategies to mitigate the risk of 'Living off the Land' (LotL) attacks?

Accepted Answer

Restrict access to administrative tools via Constrained Language Mode.. LotL attacks use legitimate system tools (e.g., PowerShell, WMI, PsExec) for malicious purposes to avoid detection. Mitigation requires strict monitoring and restriction of these powerful utilities. By reducing the attack surface via restrictive policies, logging their usage, and implementing least-privilege principles, organizations can detect the abuse of these tools by an adversary, as their usage patterns will deviate significantly from the baseline behavior of legitimate system administrators and automated system management processes.

Answer

Increase the frequency of system reboots.

Answer

Disable all network logging to save disk space.

Question 11

A Windows workstation in the finance department suddenly starts launching PowerShell with an encoded command line shortly after a user opens a malicious Excel attachment. The endpoint has Microsoft Defender Antivirus enabled, but no PowerShell logging or script block logging is configured. Which action best mitigates this class of malicious code execution while preserving the ability to investigate the encoded payload?

Accepted Answer

Enable PowerShell script block logging and module logging through Group Policy, then collect the events in Windows Event Forwarding for analysis.. Encoded PowerShell commands hide the real script from casual command-line inspection, so the effective mitigation is to force PowerShell to log the de-obfuscated script blocks and module activity. Centralizing those events through Windows Event Forwarding lets analysts review the decoded payload and build detections, addressing both mitigation and evidence preservation without breaking legitimate administration.

Answer

Configure AppLocker default rules to allow only administrators to run PowerShell scripts in the environment.

Answer

Disable the Windows Script Host on all workstations by setting the Enabled registry value under WSH settings to 0.

Answer

Add the finance department's subnet to the Microsoft Defender Antivirus network inspection exclusion list.

Question 12

A security engineer is hardening a fleet of Windows servers that run a legacy business application. The application vendor requires that the servers retain the ability to run unsigned macros for compatibility. Which mitigation strategy best reduces the risk of malicious macro-based code execution while maintaining the application's required functionality?

Accepted Answer

Implement Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.. Because the vendor insists on unsigned macros, the control must target what macros do after they run rather than whether they are trusted. Attack Surface Reduction rules that block Office child process creation and process injection stop the common execution chain used by macro malware while leaving legitimate macro logic intact, achieving the required balance between compatibility and risk reduction.

Answer

Enable Microsoft Defender Application Guard for Office and open all macro-enabled documents in the isolated container.

Answer

Add all internal file servers to the Trusted Locations list so macros in documents from those locations run without security prompts.

Answer

Set the Trust Center macro notification setting to Disable all macros without notification for all Office applications on the servers.

Question 13

A security analyst at a financial firm discovers that a user's workstation is executing a malicious macro embedded in a Microsoft Word document. The macro is attempting to download a second-stage payload from a remote server. The analyst wants to prevent this specific type of attack from succeeding on other workstations while allowing legitimate macros to run. Which of the following is the MOST effective mitigation?

Accepted Answer

Enable Microsoft Office's 'Block macros from running in Office files from the Internet' policy via Group Policy.. The 'Block macros from running in Office files from the Internet' policy is specifically designed to mitigate macro-based malware delivered via email or web downloads. It uses Mark-of-the-Web to identify files from untrusted sources and blocks macro execution while allowing macros in trusted local files. This balances security with usability, making it the most effective targeted mitigation for the described attack.

Answer

Disable all macros without notification in the Trust Center settings for all Office applications.

Answer

Deploy a web proxy that blocks all outbound traffic to unknown domains to prevent payload download.

Answer

Implement an application whitelist that only allows signed Microsoft Office executables to run.

Question 14

A penetration tester is examining a Windows 10 system and discovers that a recent exploit leveraged a use-after-free vulnerability in a widely used PDF reader application. The exploit successfully achieved code execution. Which of the following mitigation technologies, when enabled, would have made this exploitation significantly more difficult by randomizing the memory locations of key data structures?

Accepted Answer

Address Space Layout Randomization (ASLR). ASLR is the mitigation that randomizes memory addresses, making it harder for an attacker to predict where to find or place code and data. In a use-after-free scenario, the attacker often needs to control the contents of a freed object and then trigger its reuse; ASLR forces the attacker to first leak a memory address to bypass randomization, adding a significant hurdle. DEP, CFG, and SEHOP address different exploitation techniques and do not provide the same randomization benefit.

Answer

Control Flow Guard (CFG)

Answer

Data Execution Prevention (DEP)

Answer

Structured Exception Handling Overwrite Protection (SEHOP)

Question 15

A medium-sized company's Windows workstations are being infected by malicious macro documents delivered as .docm email attachments. Employees routinely open these attachments because the macros appear to come from a trusted internal sender. The security team wants to stop the macro execution with the least disruption to legitimate business macros, which are used only by the finance department. Which mitigation should the team implement first?

Accepted Answer

Use Group Policy to set the Microsoft Office macro notification setting to 'Disable all macros except digitally signed macros' and distribute a trusted publisher certificate to finance.. The correct control is a Group Policy macro setting that disables unsigned macros while allowing digitally signed macros, with a trusted publisher certificate deployed to finance. This blocks the malicious macro execution path for nearly all users, preserves the legitimate finance macros, and requires no changes to email flow or third-party tools. It is the least disruptive, targeted mitigation for macro-borne malware in a Windows Office environment.

Answer

Enable Microsoft Defender Application Guard for Office to open untrusted documents in an isolated container.

Answer

Configure an email gateway rule to strip all .docm attachments and quarantine them for administrator review.

Answer

Deploy an endpoint detection and response agent and create a detection rule that alerts when WINWORD.EXE spawns a child process.

Question 16

A security analyst is reviewing an incident where a user's browser was exploited by a drive-by download. The analyst wants to confirm whether the exploit achieved code execution and established persistence. Which artifact should the analyst examine first to determine if a new service was created for persistence on the Windows host?

Accepted Answer

The System event log for event ID 7045 Service Control Manager entries.. The System event log entry with ID 7045 is generated by the Service Control Manager whenever a new service is installed on Windows. It captures the service name, binary path, start type, and account, which lets the analyst confirm both installation and the persistence mechanism. Unlike process creation auditing, 7045 is enabled by default and directly answers whether a service was created, making it the correct first artifact to examine.

Answer

The Application event log for Windows Error Reporting crash entries.

Answer

The browser's cache folder for recently downloaded JavaScript files.

Answer

The Windows Security event log for event ID 4688 process creation.

Question 17

A penetration tester is assessing a web application and finds that user input is reflected into an HTML page without encoding. The tester wants to demonstrate that an attacker could steal a victim's session cookie by injecting a script that sends the cookie to an external server. Which mitigation, when implemented by the developers, most directly prevents this specific cookie theft even if the input reflection remains?

Accepted Answer

Set the session cookie with the HttpOnly attribute.. The HttpOnly attribute makes the session cookie inaccessible to client-side scripts, so a reflected script injection cannot read or exfiltrate it. This directly counters the described attack even though the reflection vulnerability remains. While output encoding would fix the root cause and a strict Content Security Policy would reduce script execution, the question asks for the most direct prevention of cookie theft given the reflection, and HttpOnly is that control.

Answer

Add the Secure attribute to the session cookie.

Answer

Enable Content Security Policy with a strict script-src directive.

Answer

Implement output encoding for all user-supplied data.

Question 18

A small business owner is concerned about ransomware encrypting critical files on a shared network drive. The owner wants a solution that can restore files quickly after an attack without paying the ransom. Which of the following is the MOST effective control to achieve this?

Accepted Answer

Implement a regular backup strategy that includes offline and offsite copies.. A robust backup strategy with offline and offsite copies is the most effective way to recover from ransomware. It ensures that a clean copy of data is available regardless of the attack's success. While other controls can help prevent or limit damage, only backups provide a reliable restoration path without paying the ransom.

Answer

Deploy antivirus software with real-time scanning on all endpoints.

Answer

Configure the network drive to be read-only for all users.

Answer

Enable file versioning on the shared network drive.

Question 19

A Linux web server was compromised through a vulnerable PHP application. The attacker uploaded a web shell and is now using it to run commands. An incident responder needs to determine how the attacker is maintaining access after reboots. Which artifact should the responder check first to identify a persistent mechanism on this Linux host?

Accepted Answer

The crontab entries for all users and the /etc/cron.* directories.. On Linux, cron jobs are a primary persistence mechanism because they run on a schedule and survive reboots. An attacker with web shell access often adds a crontab entry or a file in /etc/cron.d that re-downloads a payload or opens a reverse shell. Checking all user crontabs and the system cron directories is therefore the most direct first step to identify how access is maintained, ahead of logs that only show activity rather than configuration.

Answer

The /etc/passwd file for accounts with UID 0.

Answer

The Apache access log for POST requests to the vulnerable PHP script.

Answer

The /var/log/auth.log file for failed SSH login attempts.

Question 20

A security team is hardening a fleet of Windows 10 workstations against exploit techniques used by malicious code. The team wants to enable operating system features that make it harder for an attacker to execute arbitrary code in memory and to bypass address space randomization. Which two features should the team enable? (Choose two.)

Accepted Answer

Address Space Layout Randomization (ASLR) with system-wide mandatory enforcement.. Data Execution Prevention and system-wide mandatory Address Space Layout Randomization are the two operating system features that directly raise the bar for memory-corruption exploits. DEP prevents execution of code from data pages, defeating simple shellcode placement, while mandatory ASLR randomizes memory layout so attackers cannot rely on fixed addresses. Together they force attackers to find information leaks or other bypasses, which is the intended hardening posture for the workstation fleet.

Answer

Control Flow Guard (CFG) configured only for applications that opt in.

Answer

Structured Exception Handling Overwrite Protection (SEHOP) in audit-only mode.

Answer

Windows Defender Application Control (WDAC) in audit mode.