GIAC Defending Advanced Threats - GDAT Exam Questions [2026]

QUESTION NO: 1
What is the main objective of threat hunting in cybersecurity?
Response:

A. To deploy antivirus solutions B. To proactively search for and mitigate potential threats C. To monitor network traffic passively D. To respond to data breaches

Correct Answer: B

QUESTION NO: 2
In the context of lateral movement, what is the function of using pass-the-ticket (PtT) techniques?
Response:

A. To impersonate legitimate users B. To encrypt data being exfiltrated C. To maintain persistence in the network D. To escalate privileges on the target system

Correct Answer: A

QUESTION NO: 3
How do attackers use the autostart functionality to maintain persistence?
Response:

A. By encrypting network communications B. By disabling firewall settings C. By adding malicious executables to system startup D. By periodically clearing event logs

Correct Answer: C

QUESTION NO: 4
Which of the following are effective preventive measures against payload delivery via malicious email attachments?
(Choose Two)
Response:

A. Implementing strong spam filters B. Regularly updating firewall rules C. Enforcing strict password policies D. Scanning attachments with antivirus software

Correct Answer: A,D

QUESTION NO: 5
Which of the following is a key objective of threat hunting in cybersecurity?
Response:

A. To monitor system performance and optimize resource allocation B. To proactively search for threats that may bypass traditional detection systems C. To block all inbound network traffic during an attack D. To passively observe network traffic without taking action

Correct Answer: B

QUESTION NO: 6
Select the methods that can help in detecting Golden Ticket attacks on Active Directory environments.
Response:

A. Monitoring for unusual Kerberos ticket lifetimes B. Analyzing anomalies in account logins from multiple locations C. Regularly updating antivirus definitions D. Inspecting the integrity of the Active Directory database

Correct Answer: A,B

QUESTION NO: 7
What are key indicators of lateral movement within a network?
(Choose Three)
Response:

A. Spike in database read operations B. Anomalies in account logins C. Frequent changes in file permissions D. Unusual outbound traffic patterns

Correct Answer: B,C,D

QUESTION NO: 8
What role does role-based access control (RBAC) play in adhering to the least privilege principle?
Response:

A. It automatically escalates user permissions when systems are underutilized. B. It ensures that all users have the same baseline access for simplicity. C. It assigns user permissions based on the specific roles within an organization. D. It restricts user access based solely on seniority within the company.

Correct Answer: C

QUESTION NO: 9
What is a recommended approach for removing malware persistence mechanisms?
Response:

A. Isolating the infected systems from the network B. Updating all third-party applications C. Performing a system format on all workstations D. Reinstalling the operating system

Correct Answer: A

QUESTION NO: 10
A common framework that outlines various tactics and techniques used by adversaries and is often utilized in adversary emulation is the _________.
Response:

A. MITRE ATT&CK framework B. OSI model C. ISO 27001 standard D. TCP/IP model

Correct Answer: A

QUESTION NO: 11
What is the primary purpose of using a rootkit in malware installation?
Response:

A. To hide the presence of malware from security tools and users B. To encrypt files on the target system C. To increase the system's performance D. To enable remote access to the target network

Correct Answer: A

QUESTION NO: 12
Which of the following are key benefits of applying the principle of least privilege within an organization?
(Choose two)
Response:

A. Increases user productivity B. Minimizes administrative overhead C. Limits the impact of compromised accounts D. Reduces the attack surface

Correct Answer: C,D