A red teamer needs to deliver a payload that will establish a C2 session back to a team-controlled server. The target environment is a Windows network with strict egress filtering that only allows outbound HTTPS to a list of approved domains. Which payload configuration is most likely to succeed?

A compiled executable that opens a raw TCP connection to the C2 server on port 4444.

A script that uses FTP to upload files to a server the team controls.

A PowerShell script that makes HTTPS requests to a domain the team controls that is on the approved list.

A macro that uses HTTP to connect to an IP address directly, bypassing DNS.

What is the primary purpose of a C2 payload?

To establish a communication session with the C2 server

To patch vulnerabilities on the target system

To encrypt the target's files for ransom

To perform reconnaissance on the target network

A red team is selecting a C2 protocol for an implant that needs to communicate through a network that allows only DNS and HTTP. The team wants to minimize the chance of detection by network monitoring. Which protocol choice is most appropriate?

ICMP echo requests to the team's server.

HTTPS beaconing to a web server on a team-controlled domain.

DNS tunneling, encoding C2 data in DNS queries and responses.

Raw TCP connections to the team's server on port 53.

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 3)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 11–15

11application · medium
A red teamer needs to deliver a payload that will establish a C2 session back to a team-controlled server. The target environment is a Windows network with strict egress filtering that only allows outbound HTTPS to a list of approved domains. Which payload configuration is most likely to succeed?
Select an answer first
12foundation · easy
What is the primary purpose of a C2 payload?
Select an answer first
13foundation · easy
Which technique is commonly used in C2 payloads to maintain persistence on a compromised host?
Select an answer first
14foundation · easy
Which component of a command and control (C2) infrastructure is typically the server that receives connections from compromised hosts and issues commands to them?
Select an answer first
15application · medium
A red team is selecting a C2 protocol for an implant that needs to communicate through a network that allows only DNS and HTTP. The team wants to minimize the chance of detection by network monitoring. Which protocol choice is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Command and Control Infrastructure GRTP Practice Questions (Page 3)

Questions 11–15

A red teamer needs to deliver a payload that will establish a C2 session back to a team-controlled server. The target environment is a Windows network with strict egress filtering that only allows outbound HTTPS to a list of approved domains. Which payload configuration is most likely to succeed?

What is the primary purpose of a C2 payload?

Which technique is commonly used in C2 payloads to maintain persistence on a compromised host?

Which component of a command and control (C2) infrastructure is typically the server that receives connections from compromised hosts and issues commands to them?

A red team is selecting a C2 protocol for an implant that needs to communicate through a network that allows only DNS and HTTP. The team wants to minimize the chance of detection by network monitoring. Which protocol choice is most appropriate?

Keep studying — Red Team Operations and Infrastructure