Automating Offensive Workflows GASAE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After compromising a Windows machine in a red team exercise, an operator needs to automate privilege escalation and lateral movement to a domain controller. The operator wants to use native Windows tools to avoid detection and ensure the automation runs only during a specific maintenance window. Which approach is most appropriate?

   • AUse a PowerShell script that checks the current time, uses scheduled tasks to run privilege escalation commands, and uses WinRM to move laterally, with logging to a local file.
   • BWrite a batch script that runs commands sequentially without any time checks, using PsExec for lateral movement.
   • CManually run a series of commands in an RDP session and use remote desktop to move to the domain controller.
   • DUse a Metasploit payload that automatically escalates privileges and pivots to the domain controller using a meterpreter session.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration testing team is automating exploitation of a web application in a staging environment. They need to run a series of exploit modules against a specific target, but only if the target is confirmed vulnerable to a prerequisite condition. They also need to stop the entire pipeline if any exploit causes the target to become unresponsive. Which approach best satisfies these requirements?

   • AUse an orchestration tool that defines a conditional task to check the prerequisite, then runs the exploit modules only if the check passes, with a health-check task after each exploit that aborts the pipeline on failure.
   • BWrite a single script that runs all exploit modules sequentially without any pre-checks, and rely on timeouts to recover.
   • CRun all exploits in parallel and use a monitoring dashboard to manually stop the pipeline if issues arise.
   • DManually verify the prerequisite and then run a pre-built exploit script that includes all modules.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a fundamental ethical requirement before running automated offensive security workflows?

   • AKeeping the workflow secret from all parties
   • BObtaining explicit written authorization from the target organization
   • CEnsuring the workflow runs as fast as possible
   • DUsing only open-source tools
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During an authorized red team exercise, an operator needs to automate post-exploitation actions on a compromised Linux host. The actions include privilege escalation via sudo misconfiguration, lateral movement using SSH keys, and data exfiltration over HTTPS. The operator wants to minimize the chance of detection and ensure the workflow stops if any step fails. Which approach best satisfies these requirements?

   • AManually run each command in a terminal and copy output to a local machine using SCP.
   • BWrite a single bash script that runs all commands sequentially without checking exit codes, using netcat to send data to a listener.
   • CUse a Metasploit multi-handler to run a series of post-exploitation modules and then use the 'download' command to pull files.
   • DUse an orchestration tool like Ansible to run a playbook that attempts privilege escalation, then uses SSH to move laterally, and finally exfiltrates data with curl, with error handling that halts on failure.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A red team is automating a phishing simulation that includes a payload download. The team wants to ensure the automation does not accidentally target employees outside the authorized scope and that it stops immediately if a target is not on the approved list. What is the best way to implement this safety control?

   • ARely on the phishing framework's built-in campaign settings to limit the number of emails sent per hour.
   • BSend a test email to a small group first, then expand to the full directory if no issues are reported.
   • CUse a random sample of email addresses from the corporate directory to make the simulation more realistic.
   • DBefore sending each phishing email, check the recipient's address against an allowlist of approved targets stored in a database, and abort the campaign if a mismatch is found.
   Reveal Solution Discussion Select an answer first