GSEC Malicious Code and Exploit Mitigation — Timed 10 Questions

Question 1

Which TWO of the following methodologies are most effective for mitigating the risk of buffer overflow exploits in legacy C-based applications?

Accepted Answer

Implementing Address Space Layout Randomization (ASLR).. Buffer overflows exploit memory management flaws, allowing arbitrary code execution. Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are kernel-level security features that significantly increase the difficulty for an attacker to reliably execute shellcode. These mitigations force attackers to bypass complex memory protections, often leading to application crashes rather than successful exploitation, which is a critical defense-in-depth strategy when source code refactoring is not immediately feasible.

Answer

Enforcing strict firewall rules on outbound traffic.

Answer

Increasing the frequency of password rotations for users.

Answer

Installing additional anti-malware agents on the server.

Question 2

When analyzing a suspected piece of malicious code in a sandbox, which THREE of the following behaviors are critical to monitor to determine the intent of the malware?

Accepted Answer

Modifications to registry keys for persistence.. Effective sandbox analysis requires observation of the malware's interaction with the operating system. Monitoring registry modifications, network traffic, and file system changes provides the necessary context to determine the malware's purpose—such as establishing persistence, exfiltrating data, or self-replication. These indicators are foundational to generating high-fidelity alerts and strengthening defenses against the specific techniques employed by the analyzed code during its execution lifecycle in a controlled, isolated environment.

Answer

The color depth settings of the monitor resolution.

Answer

The total number of installed fonts on the system.

Question 3

An organization is concerned about malicious code using Domain Generation Algorithms (DGA) for command-and-control communication. Which defensive measure is most effective against this threat?

Accepted Answer

Implementing a DNS sinkhole to capture NXDOMAIN queries.. DGA malware generates thousands of pseudo-random domain names to hide its C2 infrastructure. Because the malware cycles through these domains, blacklisting individual domains is ineffective. Implementing a robust DNS monitoring and filtering solution that uses reputation-based analysis or detects high volumes of NXDOMAIN (Non-Existent Domain) responses is necessary. This approach identifies the underlying algorithm pattern rather than individual sites, allowing the network to block the malware's attempt to 'phone home' to the attacker.

Answer

Manually updating the hosts file with known malicious domains.

Answer

Disabling DNSSEC on all internal servers.

Answer

Increasing the timeout settings on local DNS resolvers.

Question 4

A security administrator is implementing a defense-in-depth strategy to mitigate the risk of exploit kits delivered via malicious advertisements (malvertising). The administrator wants to prevent drive-by download attacks that exploit vulnerabilities in browser plugins. Which TWO of the following measures are MOST effective for this specific threat? (Choose two.)

Accepted Answer

Enable automatic updates for all browser plugins and remove unused or unsupported plugins.. Ad blockers prevent malicious ads from loading, cutting off the delivery mechanism for many exploit kits. Patching and removing vulnerable plugins eliminates the software flaws that these kits target. Together, they provide a strong defense against malvertising-driven drive-by downloads. The other options are either too disruptive or not targeted to the specific threat.

Answer

Set the browser's security zone to High and prompt for ActiveX controls.

Answer

Implement a Host-based Intrusion Prevention System (HIPS) that blocks all outbound connections from browsers.

Answer

Configure the browser to disable JavaScript execution entirely.

Question 5

A security analyst is investigating a suspected malware infection on a Windows server. The analyst observes that a process named 'svchost.exe' is making anomalous network connections to an external IP address. Upon further inspection, the process is running from C:\Users\Public\ instead of the standard C:\Windows\System32\ directory. Which of the following is the MOST appropriate immediate action to mitigate the threat while preserving evidence?

Accepted Answer

Capture a memory dump of the process and the system, then terminate the process.. The order of volatility dictates that memory should be captured before terminating a process or shutting down a system. Capturing a memory dump of the suspicious process and the system preserves critical evidence like running code and network connections. Terminating the process afterward stops the immediate threat. This approach aligns with forensic best practices and incident response procedures.

Answer

Isolate the server from the network, then capture a memory dump.

Answer

Terminate the process and then capture a memory dump of the system.

Answer

Run a full antivirus scan on the server to remove the malware.

Question 6

An administrator identifies a suspicious process masquerading as a system service. To mitigate the risk while maintaining evidence, which action is the most appropriate first step in a professional incident response lifecycle?

Accepted Answer

Isolate the infected host from the network via switch port shutdown.. Isolating the host from the network preserves the integrity of the volatile memory and prevents command-and-control communication. In security operations, containment precedes deep analysis to ensure the adversary cannot execute further malicious actions or delete artifacts. This approach balances the need for forensic readiness with the urgent requirement to stop ongoing lateral movement or data exfiltration, adhering to standard GIAC incident response methodologies regarding host-based threat containment.

Answer

Immediately terminate the process using the task manager.

Answer

Perform a full system backup to an external network share.

Answer

Run a full scan with the local antivirus engine.

Question 7

Which security control is most effective at preventing the execution of unauthorized or malicious software by enforcing a 'deny-by-default' policy on a workstation?

Accepted Answer

Application Whitelisting (e.g., AppLocker or WDAC).. Application whitelisting (or Application Control) prevents any program from running unless it is explicitly permitted by a defined policy. This is vastly superior to blacklisting, which can only block known threats. In a professional environment, this controls the execution environment, significantly reducing the attack surface by ensuring that only vetted and approved binaries, scripts, and installers can run, effectively mitigating zero-day threats and unauthorized utility usage.

Answer

Endpoint Detection and Response (EDR) agents.

Answer

Next-Generation Antivirus (NGAV) with behavioral analysis.

Answer

Host-based Intrusion Prevention System (HIPS).

Question 8

A security analyst is concerned about Fileless Malware attacks. Which technique is most effective for detecting code that resides only in memory without writing files to the disk?

Accepted Answer

Enabling PowerShell Script Block Logging.. Fileless malware often uses legitimate tools like PowerShell or WMI to execute code in memory. To detect this, analysts must shift from file-based scanning to process-based monitoring. Logging PowerShell Script Block Logging (Event ID 4104) and capturing command-line arguments are essential. These logs provide visibility into the actual code being executed in memory, which is the only way to catch threats that bypass traditional signature-based disk scanners by living off the land.

Answer

Deploying a traditional antivirus signature update.

Answer

Scanning the hard drive for unauthorized startup files.

Answer

Performing integrity checks on system binaries.

Question 9

Which of the following describes the primary goal of using a 'Honeytoken' in an environment to mitigate malicious code and insider threats?

Accepted Answer

To serve as a decoy for detecting unauthorized access.. Honeytokens are fake credentials, files, or data entries planted in a system to act as a tripwire. Because no legitimate user or process should ever access these items, any attempt to use or read them provides a high-fidelity alert of malicious activity. This strategy is highly effective for detecting lateral movement, data exfiltration attempts, or credential harvesting by malware that is already inside the perimeter and searching for targets.

Answer

To automatically patch vulnerabilities in real-time.

Answer

To encrypt sensitive data for long-term storage.

Answer

To provide a secure sandbox for testing malware.

Question 10

Which THREE of the following are primary defensive strategies to mitigate the risk of 'Living off the Land' (LotL) attacks?

Accepted Answer

Restrict access to administrative tools via Constrained Language Mode.. LotL attacks use legitimate system tools (e.g., PowerShell, WMI, PsExec) for malicious purposes to avoid detection. Mitigation requires strict monitoring and restriction of these powerful utilities. By reducing the attack surface via restrictive policies, logging their usage, and implementing least-privilege principles, organizations can detect the abuse of these tools by an adversary, as their usage patterns will deviate significantly from the baseline behavior of legitimate system administrators and automated system management processes.

Answer

Increase the frequency of system reboots.

Answer

Disable all network logging to save disk space.