Command and Control (C2) GPEN Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why might an attacker tunnel C2 traffic over DNS?

   • ADNS provides strong end-to-end encryption by default.
   • BDNS traffic is often allowed through firewalls and is less scrutinized.
   • CDNS is a connection-oriented protocol that guarantees delivery.
   • DDNS has unlimited data transfer rates.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of setting up a listener on a C2 server?

   • ATo block malicious traffic from reaching the C2 server.
   • BTo wait for and handle incoming connections from compromised hosts.
   • CTo encrypt the C2 server's hard drive.
   • DTo scan for open ports on the target network.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a widely used open-source C2 framework?

   • ABurp Suite
   • BNmap
   • CMetasploit
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A red team is using a C2 beacon that communicates over HTTPS. The SOC has started flagging the beacon because the TLS certificate is self-signed and the JA3 fingerprint is unusual. The team needs to continue using HTTPS and cannot change the listener IP. Which combination of changes would most effectively reduce detection?

   • ASwitch to a different C2 framework that uses a different TLS library.
   • BIncrease the beacon's jitter and sleep time to reduce the frequency of connections.
   • CUse a domain fronting service to hide the true destination.
   • DReplace the self-signed certificate with a valid certificate from a trusted CA and modify the beacon's TLS settings to mimic a common browser's JA3 fingerprint.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is using a C2 framework and notices that the target's security operations center (SOC) is flagging the beacon's HTTP traffic because of a consistent User-Agent string. The tester needs to reduce the chance of detection without changing the listener port. Which action is most effective?

   • AChange the C2 domain to a new one that is not yet blocklisted.
   • BSwitch the beacon to use DNS tunneling instead of HTTP.
   • CIncrease the beacon's sleep time to 60 seconds to generate less traffic.
   • DConfigure the beacon to use a random User-Agent from a list of common browsers for each request.
   Reveal Solution Discussion Select an answer first