We're so confident of our products that we provide no hassle product exchange.
GIAC GDAT Exam Overview:
| Certification Vendor: | GIAC (SANS Institute) |
|---|---|
| Exam Name: | GIAC Defending Advanced Threats |
| Exam Number: | GDAT |
| Passing Score: | 70% |
| Available Languages: | English |
| Exam Duration: | 180 minutes |
| Exam Format: | Scenario-based Questions, Multiple Choice |
| Certificate Validity Period: | 4 Years |
| Related Certifications: | GREM GCFE GCFA |
| Exam Price: | $1,299 |
| Real Exam Qty: | 115 |
| Sample Questions: | GIAC GDAT Sample Questions |
| Exam Way: | Proctored Exam at Pearson VUE Centers |
| Pre Condition: | Recommended completion of SANS SEC699 course or equivalent experience |
| Official Syllabus URL: | https://www.giac.org/certifications/defending-advanced-threats |
GIAC GDAT Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Detection and Containment | 15-20% | - Host-Based Detection - Advanced Persistent Threat (APT) Tactics - Network-Based Detection - Indicator of Compromise (IOC) Development |
| Topic 2: Host Forensics | 25-30% | - File System Forensics - Memory Forensics - Event Log Analysis - Registry Analysis - Timeline Analysis |
| Topic 3: Advanced Malware Analysis | 30-35% | - Dynamic Analysis and Behavioral Analysis - Assembly Language and Disassembly Fundamentals - Memory Forensics for Malware Detection - Static Analysis Techniques - Malware Evasion and Anti-Analysis Techniques |
| Topic 4: Incident Response and Preparation | 20-25% | - Lessons Learned and Communication - Containment, Eradication, and Recovery - Analysis and Triage - IR Planning and Preparation |
GIAC Defending Advanced Threats Sample Questions:
During a routine inspection, your security team detects a spike in outbound traffic from a user's machine to an external IP address. Upon investigation, it is discovered that a PowerShell script was used to execute a payload that is now communicating with a remote server.
What immediate actions should your team take to mitigate the attack and prevent future incidents?
Response:
- A. Monitor all outbound traffic for the next 24 hours to gather more data on the attack
- B. Reformat the affected machine and rebuild the system from a secure backup
- C. Disconnect the compromised system from the network and analyze the script to understand the payload's behavior
- D. Disable PowerShell on all machines across the network and isolate the compromised system
Correct Answer: C 🗳️
In the context of access controls, which mechanism is primarily used to enforce least privilege?
Response:
- A. Biometric authentication
- B. Data encryption
- C. User role definitions
- D. Password complexity requirements
Correct Answer: C 🗳️
Which method can be used by attackers to move laterally using native network administration tools?
Response:
- A. SMTP
- B. SSH
- C. PowerShell
- D. FTP
Correct Answer: C 🗳️
Which of the following are techniques used by malware for maintaining persistence?
(Choose Two)
Response:
- A. Encrypting all files on the hard drive
- B. Writing scripts in the startup folder
- C. Installing new services
- D. Frequent system reboots
Correct Answer: B,C 🗳️
Select the methods that can help in detecting Golden Ticket attacks on Active Directory environments.
Response:
- A. Monitoring for unusual Kerberos ticket lifetimes
- B. Analyzing anomalies in account logins from multiple locations
- C. Regularly updating antivirus definitions
- D. Inspecting the integrity of the Active Directory database
Correct Answer: A,B 🗳️
Viewing page 1 out of 31 pages.
Viewing questions 1-5 out of 152 questions.
By Mona
