What is the primary purpose of using encryption in C2 traffic?

To reduce the size of the payload.

To increase the speed of the C2 channel.

To hide the content of the communication from network defenders.

To make the C2 server easier to find.

After compromising a Linux server, a penetration tester wants to use the C2 framework to escalate privileges to root. The tester has a low-privilege user account and knows the server has a vulnerable kernel. Which C2 module or technique is most appropriate?

Use a module to dump the password hash and crack it offline.

Use a local exploit suggestion module to identify and run a kernel exploit.

Use a brute-force module to guess the root password.

Use a module to add the current user to the sudoers file.

A penetration tester is comparing C2 frameworks for an engagement that requires strong post-exploitation modules, including privilege escalation and lateral movement, and the ability to generate payloads for multiple platforms. Which framework is best suited for this requirement?

A web shell uploaded to a compromised server

A custom Python script that opens a reverse shell

A penetration tester is operating in a highly monitored network where the SOC uses deep packet inspection (DPI) and machine learning to detect C2 traffic. The tester needs to exfiltrate data and maintain C2 without being detected. The network allows outbound HTTPS and DNS. Which approach is most likely to evade DPI and ML detection?

Use DNS tunneling with high query rates and long subdomains.

Use HTTPS with a valid certificate and mimic the traffic patterns of a popular cloud service, including realistic request sizes and timing.

Use ICMP tunneling with large payloads.

Use a custom protocol over a random high port.

A penetration tester needs to generate a C2 payload for a macOS target that will bypass Gatekeeper. The payload must be a signed application bundle. Which approach is most appropriate?

Use a simple shell script and change the file extension to .app.

Use a tool like Cobalt Strike to generate a signed macOS application bundle and then notarize it.

Use msfvenom to generate a raw Mach-O executable and sign it with an ad-hoc signature.

Use a ZIP file containing the payload and hope Gatekeeper does not scan it.

GIAC Penetration Tester (GPEN)

Domain 2Objective 4

Command and Control (C2) GPEN Practice Questions (Page 5)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 21–25

21foundation · easy
What is the primary purpose of using encryption in C2 traffic?
Select an answer first
22application · medium
After compromising a Linux server, a penetration tester wants to use the C2 framework to escalate privileges to root. The tester has a low-privilege user account and knows the server has a vulnerable kernel. Which C2 module or technique is most appropriate?
Select an answer first
23application · medium
A penetration tester is comparing C2 frameworks for an engagement that requires strong post-exploitation modules, including privilege escalation and lateral movement, and the ability to generate payloads for multiple platforms. Which framework is best suited for this requirement?
Select an answer first
24expert · hard
A penetration tester is operating in a highly monitored network where the SOC uses deep packet inspection (DPI) and machine learning to detect C2 traffic. The tester needs to exfiltrate data and maintain C2 without being detected. The network allows outbound HTTPS and DNS. Which approach is most likely to evade DPI and ML detection?
Select an answer first
25application · medium
A penetration tester needs to generate a C2 payload for a macOS target that will bypass Gatekeeper. The payload must be a signed application bundle. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.