A red team is running a long-term engagement. They have a redirector and a C2 server. The redirector's IP has been flagged by the target's threat intel, and the team needs to continue operations without losing existing implant sessions. Which action best balances operational security and session continuity?

Tear down all current infrastructure and rebuild from scratch with new domains and IPs.

Keep the same redirector but change the C2 server's IP address.

Stand up a new redirector, update the C2 server to accept connections from the new redirector, and have implants switch to the new redirector's domain.

Switch all implants to use a different protocol, such as DNS, without changing the redirector.

Which practice is most effective for protecting C2 traffic from network-based detection?

Using a static IP address for the C2 server

Sending traffic in plaintext to avoid suspicion

What is a common advantage of using HTTPS for C2 communications over plain HTTP?

HTTPS uses a different port that is never blocked

HTTPS is easier to implement than HTTP

HTTPS provides encryption that hides the content of C2 traffic

In a tiered C2 architecture, what is the primary purpose of placing redirectors in front of the C2 server?

To hide the true IP address of the C2 server from the target network

To increase the bandwidth available to the C2 server

To encrypt all C2 traffic end-to-end

To provide a backup C2 server in case the primary fails

A red team is designing C2 infrastructure for an engagement where the target has a mature security operations center (SOC) that actively hunts for C2 traffic. The team wants to minimize the chance of detection while maintaining reliable communication. Which architecture is most appropriate?

Use a single server that acts as both redirector and C2 server to reduce complexity.

Use multiple redirectors with different IPs and domains, and rotate them periodically.

Use a peer-to-peer architecture where implants relay traffic for each other.

Use a single, stable redirector with a well-known domain to blend in.

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 2)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 6–10

6expert · hard
A red team is running a long-term engagement. They have a redirector and a C2 server. The redirector's IP has been flagged by the target's threat intel, and the team needs to continue operations without losing existing implant sessions. Which action best balances operational security and session continuity?
Select an answer first
7foundation · easy
Which practice is most effective for protecting C2 traffic from network-based detection?
Select an answer first
8foundation · easy
What is a common advantage of using HTTPS for C2 communications over plain HTTP?
Select an answer first
9foundation · easy
In a tiered C2 architecture, what is the primary purpose of placing redirectors in front of the C2 server?
Select an answer first
10expert · hard
A red team is designing C2 infrastructure for an engagement where the target has a mature security operations center (SOC) that actively hunts for C2 traffic. The team wants to minimize the chance of detection while maintaining reliable communication. Which architecture is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.