A company is planning an adversary emulation exercise. The threat intelligence indicates that the threat group typically gains initial access via phishing, but the company has a very strong email security gateway that blocks most phishing emails. The red team believes that the threat group would likely use a different initial access vector if phishing failed. The company wants to test its defenses against the threat group's most likely attack path. What should the red team do?

Skip the initial access stage and start the exercise at the post-exploitation stage

Use phishing as the initial access vector because it is the threat group's primary technique

Ask the company to disable the email security gateway during the exercise

Emulate the threat group's likely adaptive behavior by using an alternative initial access vector, such as exploiting a public-facing application

A company wants to test its security controls against a specific threat group that has been targeting its industry. The company has a limited budget and wants to focus on the most relevant attack paths. Which approach would best meet this need?

Conduct an adversary emulation exercise based on the threat group's TTPs, scoped to the most critical assets

Conduct a red team exercise with no predefined scope

Conduct a vulnerability scan and patch all identified issues

Conduct a broad penetration test covering all systems and vulnerabilities

An adversary emulation engagement has concluded. The stakeholders want a clear understanding of what was tested, what was found, and what improvements are needed. What should the final report include?

A summary of the emulated threat, techniques executed, detection outcomes, and recommendations

A detailed list of vulnerabilities exploited and their CVSS scores

A comparison of the emulation team's performance against other teams

Only the successful techniques and detected alerts

After an emulation exercise, the blue team wants to measure how well they detected the emulated techniques. They have logs from the SOC and the emulation team's activity logs. What is the best way to evaluate detection effectiveness?

Review only the alerts that were escalated to incidents

Compare the emulation team's activity logs with the SOC's alerts to identify which techniques were detected and missed

Count the total number of alerts generated during the exercise

Ask the SOC team to estimate how many techniques they think they detected

During an adversary emulation exercise, the SOC detects the red team's activity and responds by isolating the affected host. The red team had planned to use that host for lateral movement. What should the red team do?

Complain to the SOC that they should not have responded during the exercise

Stop the exercise immediately because the SOC detected the activity

Restore the host and continue as if the detection had not occurred

Adapt and continue the exercise using alternative techniques or paths, while noting the detection and response in the final report

GIAC Red Team Professional

Domain 1Objective 1

Adversary Emulation Fundamentals GRTP Practice Questions (Page 6)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 26–30

26expert · hard
A company is planning an adversary emulation exercise. The threat intelligence indicates that the threat group typically gains initial access via phishing, but the company has a very strong email security gateway that blocks most phishing emails. The red team believes that the threat group would likely use a different initial access vector if phishing failed. The company wants to test its defenses against the threat group's most likely attack path. What should the red team do?
Select an answer first
27application · medium
A company wants to test its security controls against a specific threat group that has been targeting its industry. The company has a limited budget and wants to focus on the most relevant attack paths. Which approach would best meet this need?
Select an answer first
28application · medium
An adversary emulation engagement has concluded. The stakeholders want a clear understanding of what was tested, what was found, and what improvements are needed. What should the final report include?
Select an answer first
29application · medium
After an emulation exercise, the blue team wants to measure how well they detected the emulated techniques. They have logs from the SOC and the emulation team's activity logs. What is the best way to evaluate detection effectiveness?
Select an answer first
30application · medium
During an adversary emulation exercise, the SOC detects the red team's activity and responds by isolating the affected host. The red team had planned to use that host for lateral movement. What should the red team do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.