We're so confident of our products that we provide no hassle product exchange.
GIAC GDAT Exam Overview:
| Certification Vendor: | GIAC |
|---|---|
| Exam Name: | GIAC Defending Advanced Threats (GDAT) |
| Exam Number: | GDAT |
| Exam Duration: | 120 minutes |
| Real Exam Qty: | 75 |
| Available Languages: | English |
| Passing Score: | 70% |
| Exam Format: | Proctored, Multiple choice |
| Certificate Validity Period: | 4 years |
| Related Certifications: | SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses |
| Exam Price: | $999 USD |
| Recommended Training: | SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses |
| Exam Registration: | Pearson VUE GIAC Official Registration |
| Sample Questions: | GIAC GDAT Sample Questions |
| Exam Way: | Web-based proctored exam; remote proctoring via ProctorU or onsite at Pearson VUE centers |
| Pre Condition: | No formal prerequisites; recommended training: SANS SEC599 |
| Official Syllabus URL: | https://www.giac.org/certifications/defending-advanced-threats-gdat |
GIAC GDAT Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: Administrative Access | - Privilege escalation impacts - Least privilege principles |
| Topic 2: Payload Execution | - Detection and mitigation - Execution mechanisms |
| Topic 3: Application Exploitation | - Software development lifecycle and threat modeling - Exploit mitigation techniques - Patch management |
| Topic 4: Active Directory/Domains | - Detecting attacks against domains - Common attacks against domains - Kerberos protocol - Authentication basics |
| Topic 5: Data Exfiltration | - Command and control detection - Exfiltration strategies - Deception techniques |
| Topic 6: Reconnaissance, Threat Handling, and Incident Response | - Incident response processes - Threat hunting - Reconnaissance methods |
| Topic 7: Payload Delivery | - Delivery methods - Defensive controls |
| Topic 8: Installation / Persistence | - Common persistence strategies - Protection mechanisms |
| Topic 9: Adversary Emulation | - Basic concepts - Common tools - Technical controls |
| Topic 10: Lateral Movement | - Detection and prevention controls - Movement techniques |
GIAC Defending Advanced Threats Sample Questions:
Which of the following are critical components of an effective incident response plan?
(Choose two)
Response:
- A. Root cause analysis
- B. Preparation
- C. Monitoring network latency
- D. Recovery
Correct Answer: B,D 🗳️
Your organization has noticed a significant increase in phishing attempts targeting its employees. In one instance, a user unknowingly downloaded a malicious executable file attached to an email, which led to the installation of ransomware.
What immediate steps should your security team take to contain the incident and prevent future payload delivery through email?
Response:
- A. Disconnect the infected machine from the network and initiate a ransomware recovery protocol
- B. Develop a backup and recovery plan to prevent future incidents
- C. Notify users to reset their passwords and conduct phishing awareness training
- D. Block all outbound traffic from the organization until the threat is contained
Correct Answer: A 🗳️
What is a recommended approach for removing malware persistence mechanisms?
Response:
- A. Reinstalling the operating system
- B. Performing a system format on all workstations
- C. Isolating the infected systems from the network
- D. Updating all third-party applications
Correct Answer: C 🗳️
Discuss the advantages of using steganography for data exfiltration.
Response:
- A. Requires minimal technical skill to implement
- B. Difficult to detect without awareness of the specific technique used
- C. Can transfer large volumes of data quickly
- D. Leaves no trace on network security devices
Correct Answer: B 🗳️
Your organization is conducting a threat-hunting exercise. During the process, your team identifies an unfamiliar service running on several servers, all communicating with an external IP address that has no known business function. Upon deeper investigation, the team suspects the presence of a command and control (C2) channel.
What immediate steps should your team take to mitigate the threat and secure the network?
Response:
- A. Notify all employees to change their passwords and update their access controls
- B. Isolate the affected servers and block communication to the suspicious external IP address
- C. Reboot the affected servers and restore them from backup
- D. Increase system logging on the servers and wait for more activity to gather evidence
Correct Answer: B 🗳️
Viewing page 1 out of 31 pages.
Viewing questions 1-5 out of 152 questions.
By Mamie
