A red team operator is setting up C2 infrastructure and wants to minimize the risk of the team server being discovered through passive DNS or certificate transparency logs. The operator also needs to maintain a reliable channel. Which approach best balances stealth and reliability?

Use a domain fronting service with a CDN and a valid certificate from a trusted CA.

Use a domain that has never been used for C2 and enable DNS pinning to avoid certificate transparency.

Use a domain that is not registered in public DNS and only accessible via a direct IP.

Use a domain with a valid certificate and rely on the fact that certificate transparency logs are not monitored by most organizations.

A red team operator needs to generate a C2 payload for a Windows target that has application whitelisting enabled, allowing only signed executables to run. The operator has a code-signing certificate that is trusted by the target. Which approach is most appropriate?

Generate an unsigned executable and use a DLL sideloading technique to run it.

Generate a PowerShell script and run it via a signed PowerShell host.

Use a macro in a signed Office document to execute the payload.

Generate a payload and sign the executable with the trusted certificate.

A penetration tester is working in an environment where outbound HTTPS is allowed but the security team uses a proxy that requires authentication. The tester needs to establish C2 traffic that can pass through the proxy without raising alerts. Which technique is most appropriate?

Use direct HTTPS connections without proxy configuration.

Use HTTP CONNECT tunneling to establish a TCP connection through the proxy to the C2 server.

Use ICMP tunneling to avoid the proxy.

Use DNS tunneling to bypass the proxy entirely.

A red team operator needs to generate a C2 payload for a Windows 10 target that will execute in memory without writing to disk. The operator has access to a Cobalt Strike team server. Which action best meets the requirement?

Generate a PowerShell script that uses a reflective DLL injection technique to load the beacon.

Use the 'HTA' attack vector to deliver a VBScript that downloads and runs the payload.

Compile a native executable with the payload embedded and use a macro to launch it.

Create an executable payload and host it on an SMB share for the target to run.

GIAC Penetration Tester (GPEN)

Domain 2Objective 4

Command and Control (C2) GPEN Practice Questions (Page 2)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 6–10

6expert · hard
A red team operator is setting up C2 infrastructure and wants to minimize the risk of the team server being discovered through passive DNS or certificate transparency logs. The operator also needs to maintain a reliable channel. Which approach best balances stealth and reliability?
Select an answer first
7expert · hard
A red team operator needs to generate a C2 payload for a Windows target that has application whitelisting enabled, allowing only signed executables to run. The operator has a code-signing certificate that is trusted by the target. Which approach is most appropriate?
Select an answer first
8application · medium
A penetration tester is working in an environment where outbound HTTPS is allowed but the security team uses a proxy that requires authentication. The tester needs to establish C2 traffic that can pass through the proxy without raising alerts. Which technique is most appropriate?
Select an answer first
9application · medium
A red team operator needs to generate a C2 payload for a Windows 10 target that will execute in memory without writing to disk. The operator has access to a Cobalt Strike team server. Which action best meets the requirement?
Select an answer first
10foundation · easy
When generating a C2 payload for a Linux target, which of the following is a valid output format?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.