Command and Control Infrastructure GRTP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A red team operator is managing a C2 infrastructure with multiple redirectors and a single C2 server. The operator discovers that one of the redirectors has been identified and is being monitored by the target's security team. The operator needs to continue the operation without losing existing sessions. Which action is most appropriate?

   • AReplace the identified redirector with a new one and update the DNS record for the domain used by that redirector.
   • BKeep the identified redirector but add a firewall rule to block the target's security team IPs.
   • CChange the C2 server's IP and update all redirectors to forward to the new IP.
   • DShut down the identified redirector and rely on the C2 server's direct IP for existing sessions.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a red team engagement, the target's security team begins monitoring and blocking HTTP-based C2 traffic. The team needs to maintain communication with an implant that currently uses HTTP. Which approach is most likely to keep the C2 session alive while avoiding detection?

   • AMove the C2 server to a different IP address and continue using HTTP.
   • BSwitch the implant to use DNS tunneling for C2, encoding commands in DNS queries and responses.
   • CIncrease the frequency of HTTP beaconing to ensure the implant checks in more often before blocking takes effect.
   • DUse a different HTTP user-agent string to evade the monitoring.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A red team is designing C2 infrastructure for an engagement where the target has strong network monitoring and the team wants to minimize the risk of the true C2 server being discovered. Which architecture best achieves this?

   • AA single server that acts as both redirector and C2 server to reduce complexity.
   • BA peer-to-peer architecture where every implant is also a redirector.
   • CA flat architecture where the C2 server is directly exposed to the internet without redirectors.
   • DA tiered architecture with multiple redirectors in front of a single C2 server, each redirector forwarding to the next.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A red team needs to establish C2 for an implant on a network that only allows outbound DNS queries to the corporate DNS server. The team controls a domain and can set up a malicious DNS server. Which C2 channel is most appropriate?

   • AICMP echo requests to the team's server.
   • BRaw TCP connections to the team's server on port 53.
   • CHTTPS beaconing to a web server on the team's domain.
   • DDNS tunneling, where the implant encodes data in DNS queries and the team's DNS server responds with encoded commands.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A red team operator is designing C2 for a target that has strict egress filtering that only allows DNS and HTTPS to a set of approved domains. The operator has control of an approved domain and needs a channel that is resistant to DPI and can handle large amounts of data. Which protocol combination is most appropriate?

   • AUse DNS tunneling for all C2 traffic.
   • BUse HTTP to the approved domain with a custom User-Agent.
   • CUse HTTPS to the approved domain for primary C2, and DNS as a fallback channel.
   • DUse HTTPS to a non-approved domain that is similar to an approved one.
   Reveal Solution Discussion Select an answer first