A red team is using a redirector to forward HTTPS traffic to a C2 server. The target's security team has started blocking traffic to known redirector IPs. The team wants to maintain the same C2 server and minimize disruption. Which approach is most effective?

Deploy a new redirector on a different IP and update the C2 server to accept traffic from it, then have implants switch to the new redirector.

Use the same redirector but change the C2 server's domain name.

Change the C2 server's IP address and update the redirector to forward to the new IP.

Switch to a different protocol, such as DNS, without changing the redirector.

A red team is using HTTP for C2 and wants to encrypt the payload data to prevent network monitoring from reading commands. Which approach is most appropriate?

Use plaintext HTTP and rely on the obscurity of the URL.

Encrypt the C2 payload data with a symmetric key embedded in the implant.

Use HTTP with a custom header to hide the data.

Use HTTP but compress the data before sending.

What is the recommended first step when decommissioning C2 infrastructure at the end of an operation?

Immediately power off the C2 server

Disconnect all implants from the C2 server

Delete all logs from the C2 server

A red team needs to establish a C2 channel for an implant that is on a network with deep packet inspection (DPI) that can identify known C2 protocols. Which channel is most likely to evade DPI?

HTTPS to a legitimate-looking website that the team controls, using standard web traffic patterns.

DNS tunneling with high query volume.

HTTP with a custom user-agent and unusual URL patterns.

Raw TCP connections to a non-standard port.

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 5)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 21–25

21expert · hard
A red team is using a redirector to forward HTTPS traffic to a C2 server. The target's security team has started blocking traffic to known redirector IPs. The team wants to maintain the same C2 server and minimize disruption. Which approach is most effective?
Select an answer first
22foundation · easy
Which type of redirector is commonly used to forward HTTPS C2 traffic to a hidden C2 server?
Select an answer first
23application · medium
A red team is using HTTP for C2 and wants to encrypt the payload data to prevent network monitoring from reading commands. Which approach is most appropriate?
Select an answer first
24foundation · easy
What is the recommended first step when decommissioning C2 infrastructure at the end of an operation?
Select an answer first
25application · medium
A red team needs to establish a C2 channel for an implant that is on a network with deep packet inspection (DPI) that can identify known C2 protocols. Which channel is most likely to evade DPI?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.