A red team operator is setting up C2 for a target environment that uses deep packet inspection (DPI) to inspect all outbound traffic. The operator needs to choose a protocol that will be resistant to DPI and still allow reliable communication. Which protocol choice is most appropriate?

HTTP with a custom User-Agent string

HTTPS with a valid certificate on a domain that is not flagged

DNS tunneling with a public DNS resolver

A red team operator is managing a C2 infrastructure that uses a redirector to forward traffic to a C2 server. The operator notices that the redirector is being scanned heavily by security tools and suspects it has been identified. The operator needs to maintain the operation without losing the existing sessions. What is the best course of action?

Keep the redirector and add a firewall rule to block the scanning IPs.

Spin up a new redirector and update the DNS record to point to the new redirector, while keeping the C2 server the same.

Immediately shut down the redirector and rely on the C2 server's direct IP for existing sessions.

Change the C2 server's IP and update the redirector to forward to the new IP.

A red team is managing C2 infrastructure for a long-term engagement. The team notices that the redirector is receiving an increasing number of scans and probes from the target network. The team wants to reduce the risk of the redirector being compromised while maintaining C2 operations. Which action is most appropriate?

Replace the redirector with a new one on a different IP and update the C2 server to accept traffic from it.

Move the C2 server to a different hosting provider without changing the redirector.

Shut down the redirector and have implants connect directly to the C2 server.

Keep the redirector but add more aggressive firewall rules to block the scans.

A red teamer needs to create a payload that will establish a C2 session and survive a reboot of the target machine. The target is a Windows workstation. Which approach is most appropriate?

Use a payload that only runs in memory and does not write to disk.

Use a payload that connects to the C2 server only once and then exits.

Use a payload that requires manual execution by the user each time.

Create a scheduled task that runs the payload at logon or system startup.

When selecting a C2 protocol, which factor is most important for evading network detection?

The protocol's support for bidirectional communication

The protocol's similarity to legitimate traffic in the target environment

The protocol's speed of data transfer

The protocol's ability to encrypt data

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 1)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 1–5

1application · medium
A red team operator is setting up C2 for a target environment that uses deep packet inspection (DPI) to inspect all outbound traffic. The operator needs to choose a protocol that will be resistant to DPI and still allow reliable communication. Which protocol choice is most appropriate?
Select an answer first
2application · medium
A red team operator is managing a C2 infrastructure that uses a redirector to forward traffic to a C2 server. The operator notices that the redirector is being scanned heavily by security tools and suspects it has been identified. The operator needs to maintain the operation without losing the existing sessions. What is the best course of action?
Select an answer first
3expert · hard
A red team is managing C2 infrastructure for a long-term engagement. The team notices that the redirector is receiving an increasing number of scans and probes from the target network. The team wants to reduce the risk of the redirector being compromised while maintaining C2 operations. Which action is most appropriate?
Select an answer first
4application · medium
A red teamer needs to create a payload that will establish a C2 session and survive a reboot of the target machine. The target is a Windows workstation. Which approach is most appropriate?
Select an answer first
5foundation · easy
When selecting a C2 protocol, which factor is most important for evading network detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.