Automating Offensive Workflows GASAE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization is automating offensive security tests against its own production environment. The automation must ensure that no exploitation attempts are made against hosts outside a defined IP range, and that all actions are logged for audit. Which configuration is essential?

   • AEmbed an allowlist check in the automation script that verifies each target IP is within the defined range before any action is taken.
   • BConfigure the automation tool to use a proxy that filters traffic to only allow the defined IP range.
   • CRely on the automation tool's built-in scope configuration and audit logging.
   • DUse a firewall rule that blocks all outbound traffic from the automation server except to the defined IP range.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which activity is typically part of automated post-exploitation?

   • AVulnerability scanning
   • BPort scanning
   • CPrivilege escalation
   • DOSINT gathering
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A red team is automating reconnaissance for a target that is known to have aggressive IDS/IPS. The team needs to gather detailed service information but must avoid detection. They also have a limited time window. Which approach best balances the need for detailed information with stealth?

   • ARun a full Nmap scan with all service detection scripts at once to get maximum information quickly.
   • BUse a commercial scanner that claims to be stealthy and can complete the scan in one pass.
   • CUse a combination of passive OSINT and low-and-slow active scanning, with randomized timing and multiple source IPs, coordinated by an orchestration script.
   • DUse only passive OSINT and do not perform any active scanning to avoid detection.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Why is stealth important in automated post-exploitation?

   • ATo reduce the amount of data collected
   • BTo speed up the exploitation process
   • CTo avoid detection by security monitoring systems
   • DTo ensure the target system remains online
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team is automating a series of offensive tests that must run in a specific order: recon, scanning, exploitation, and reporting. Some tests can run in parallel, but exploitation must wait for scanning to complete. The team also needs to rerun only failed steps. Which scheduling and orchestration approach is best?

   • AUse a CI/CD pipeline like Jenkins with a freestyle job that runs all steps in order and fails the entire job if any step fails.
   • BUse a workflow orchestration tool like Apache Airflow with DAGs that define dependencies, parallel tasks, and retries for failed steps.
   • CUse a bash script with trap commands to handle errors and rerun the entire script if any step fails.
   • DUse a simple cron job that runs all steps in a single shell script with sequential execution.
   Reveal Solution Discussion Select an answer first