A penetration tester is using a C2 beacon that communicates over DNS. The client's security team has implemented a DNS sinkhole that blocks known malicious domains. The tester needs to maintain the C2 channel without being blocked. Which technique is most effective?

Use a domain that is not yet blocklisted and rotate it frequently.

Use a domain generation algorithm (DGA) to create new domains periodically.

Use a DNS tunnel that encodes data in TXT records and uses a domain that is not blocklisted.

Use a legitimate domain that the tester controls and host the C2 on a subdomain.

A penetration tester is running a C2 server for a long-term engagement. The tester wants to minimize the risk of the C2 server being taken down by the target's incident response team. Which operational security measure is most effective?

Use a single domain name and IP address for the C2 server and avoid changing them.

Use a free dynamic DNS service to point to the C2 server.

Use multiple domain names and IP addresses, and rotate them periodically.

Use a well-known cloud provider and a static IP address to appear legitimate.

A penetration tester needs to deliver a C2 payload to a Windows 10 workstation that has Windows Defender enabled. The payload must execute in memory without writing to disk to avoid static detection. Which tool and technique combination is most appropriate?

Use Metasploit's msfvenom to generate a PowerShell script that downloads and executes a reflective DLL in memory.

Use Cobalt Strike's artifact kit to create a DLL and place it in the startup folder for persistence.

Use Empire to generate a macro-enabled Office document that drops a payload to the temp folder.

Use Veil to generate a standalone executable and upload it to the target via SMB.

GIAC Penetration Tester (GPEN)

Domain 2Objective 4

Command and Control (C2) GPEN Practice Questions (Page 7)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 31–35

31expert · hard
A penetration tester is using a C2 beacon that communicates over DNS. The client's security team has implemented a DNS sinkhole that blocks known malicious domains. The tester needs to maintain the C2 channel without being blocked. Which technique is most effective?
Select an answer first
32foundation · easy
Which of the following is a core component of a Command and Control (C2) framework?
Select an answer first
33foundation · easy
Which C2 module would an attacker use to move from one compromised host to another on the same network?
Select an answer first
34application · medium
A penetration tester is running a C2 server for a long-term engagement. The tester wants to minimize the risk of the C2 server being taken down by the target's incident response team. Which operational security measure is most effective?
Select an answer first
35application · medium
A penetration tester needs to deliver a C2 payload to a Windows 10 workstation that has Windows Defender enabled. The payload must execute in memory without writing to disk to avoid static detection. Which tool and technique combination is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Command and Control (C2) GPEN Practice Questions (Page 7)

Questions 31–35

A penetration tester is using a C2 beacon that communicates over DNS. The client's security team has implemented a DNS sinkhole that blocks known malicious domains. The tester needs to maintain the C2 channel without being blocked. Which technique is most effective?

Which of the following is a core component of a Command and Control (C2) framework?

Which C2 module would an attacker use to move from one compromised host to another on the same network?

A penetration tester is running a C2 server for a long-term engagement. The tester wants to minimize the risk of the C2 server being taken down by the target's incident response team. Which operational security measure is most effective?

A penetration tester needs to deliver a C2 payload to a Windows 10 workstation that has Windows Defender enabled. The payload must execute in memory without writing to disk to avoid static detection. Which tool and technique combination is most appropriate?

Keep studying — Exploitation and Post-Exploitation