An assessor is setting up a C2 listener for a client engagement and needs to ensure that the listener is not easily discoverable by network scans. The assessor has control over the firewall and the C2 server. Which configuration is most effective?

Configure the listener to only accept connections from specific source IP ranges and use a non-standard port.

Disable the firewall and use a random high port.

Use a standard port like 443 and rely on TLS to hide the traffic.

Use a domain name that is not associated with the assessment and point it to the listener.

Which operational security measure helps protect C2 infrastructure from being taken down?

Disabling encryption on C2 traffic.

Using default C2 server settings.

Using the same IP address for all C2 servers.

Using multiple fallback C2 domains.

A penetration tester has gained access to a Windows domain controller and wants to use the C2 framework to achieve persistence. The tester needs a method that survives reboots and is not easily detected by standard AV/EDR. The tester also wants to avoid creating new services or scheduled tasks. Which persistence mechanism is most appropriate?

Use a WMI event subscription to run the payload when the system starts.

Add a registry run key that executes the payload at logon.

Install a service that runs the C2 payload at startup.

Use a scheduled task that runs at system startup.

A penetration tester needs to generate a C2 payload for a Linux target that has no internet access but can reach an internal C2 server. The payload must be a standalone executable that does not require a runtime like Python or Java. Which approach is most appropriate?

Create a Python script that connects back to the C2 server.

Generate a compiled ELF binary using a C2 framework like Metasploit or Cobalt Strike.

Use a Bash script with netcat to establish a reverse shell.

Use a Java JAR file that runs on the target's JVM.

Which technique is used to obfuscate C2 traffic to evade detection?

Using plaintext HTTP without any encoding.

Disabling all encryption on the C2 channel.

Sending traffic to a well-known security vendor's IP.

GIAC Penetration Tester (GPEN)

Domain 2Objective 4

Command and Control (C2) GPEN Practice Questions (Page 4)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 16–20

16application · medium
An assessor is setting up a C2 listener for a client engagement and needs to ensure that the listener is not easily discoverable by network scans. The assessor has control over the firewall and the C2 server. Which configuration is most effective?
Select an answer first
17foundation · easy
Which operational security measure helps protect C2 infrastructure from being taken down?
Select an answer first
18expert · hard
A penetration tester has gained access to a Windows domain controller and wants to use the C2 framework to achieve persistence. The tester needs a method that survives reboots and is not easily detected by standard AV/EDR. The tester also wants to avoid creating new services or scheduled tasks. Which persistence mechanism is most appropriate?
Select an answer first
19application · medium
A penetration tester needs to generate a C2 payload for a Linux target that has no internet access but can reach an internal C2 server. The payload must be a standalone executable that does not require a runtime like Python or Java. Which approach is most appropriate?
Select an answer first
20foundation · easy
Which technique is used to obfuscate C2 traffic to evade detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.