A red team is using a redirector to forward C2 traffic to a server. The redirector is a simple TCP forwarder. The team wants to add a layer of obfuscation so that the C2 server's IP is not revealed if the redirector is compromised. Which modification is most effective?

Add a firewall rule on the redirector to only allow traffic from the target's IP range.

Use a redirector that only forwards DNS queries to the C2 server.

Use the same TCP forwarder but change the C2 server's port.

Replace the TCP forwarder with an HTTPS reverse proxy that terminates TLS and forwards decrypted traffic to the C2 server.

A red team is setting up C2 infrastructure for an engagement where the target network allows outbound HTTPS but blocks non-standard ports. The team wants to protect the true C2 server's IP from being exposed if the redirector is discovered. Which configuration best meets these requirements?

Configure the C2 server to listen on port 443 and have the redirector forward all TCP traffic to it without source filtering.

Use a redirector that only forwards DNS queries to the C2 server, since DNS is always allowed outbound.

Deploy a redirector that forwards HTTPS traffic to the C2 server, and configure the C2 server to only accept connections from the redirector's IP.

Place the C2 server on the same host as the redirector to simplify the infrastructure and avoid IP exposure.

A red teamer needs to deploy a payload that will establish a C2 session and avoid static signature-based detection by antivirus. Which approach is most effective?

Use a well-known payload that is already on the target system.

Use a payload that connects to the C2 server only once.

Use a polymorphic payload that changes its signature each time it is generated.

Use a payload that is stored in plaintext on disk.

A red team operator is designing a C2 infrastructure for a long-term operation. The operator wants to ensure that if one component is discovered, the rest of the infrastructure remains hidden. Which architecture best achieves this?

A C2 server with a direct public IP and no redirector

A single C2 server with multiple domains pointing to it

Multiple redirectors in different geographic regions, each forwarding to the same C2 server

A single redirector in front of a single C2 server

A red team operator is designing C2 for a network that allows outbound DNS queries to any external server but only allows HTTP/HTTPS to a shortlist of approved domains. The operator needs a channel that will work reliably and blend in with normal traffic. Which protocol should the operator choose?

HTTP to a domain not on the approved list

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 4)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 16–20

16expert · hard
A red team is using a redirector to forward C2 traffic to a server. The redirector is a simple TCP forwarder. The team wants to add a layer of obfuscation so that the C2 server's IP is not revealed if the redirector is compromised. Which modification is most effective?
Select an answer first
17application · medium
A red team is setting up C2 infrastructure for an engagement where the target network allows outbound HTTPS but blocks non-standard ports. The team wants to protect the true C2 server's IP from being exposed if the redirector is discovered. Which configuration best meets these requirements?
Select an answer first
18application · medium
A red teamer needs to deploy a payload that will establish a C2 session and avoid static signature-based detection by antivirus. Which approach is most effective?
Select an answer first
19application · medium
A red team operator is designing a C2 infrastructure for a long-term operation. The operator wants to ensure that if one component is discovered, the rest of the infrastructure remains hidden. Which architecture best achieves this?
Select an answer first
20application · medium
A red team operator is designing C2 for a network that allows outbound DNS queries to any external server but only allows HTTP/HTTPS to a shortlist of approved domains. The operator needs a channel that will work reliably and blend in with normal traffic. Which protocol should the operator choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.