What is the primary purpose of monitoring C2 infrastructure during an operation?

To track the number of compromised hosts for reporting

To detect if the infrastructure has been compromised or is being taken down

To automatically patch the C2 server's operating system

To ensure the C2 server is not overloaded with traffic

A red team needs to set up a C2 channel for an implant that is behind a firewall that only allows outbound HTTP and HTTPS. The team wants to blend in with normal web traffic. Which channel is most appropriate?

DNS tunneling to a domain the team controls.

HTTPS beaconing to a web server that mimics a legitimate application.

Raw TCP connections to the team's server on a non-standard port.

ICMP echo requests to the team's server.

A red team is using HTTPS for C2 and wants to avoid detection by network security devices that inspect TLS certificates. Which measure is most effective?

Use a valid certificate from a trusted CA for the C2 domain.

Use a self-signed certificate and disable certificate validation on the implant.

Use a certificate that matches the target's internal domain naming convention.

Use a certificate with a long expiration date to reduce renewal traffic.

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 7)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 31–35

31foundation · easy
Which C2 channel is most suitable when an implant needs to communicate through restrictive egress filtering that only allows DNS queries?
Select an answer first
32foundation · easy
What is the primary purpose of monitoring C2 infrastructure during an operation?
Select an answer first
33application · medium
A red team needs to set up a C2 channel for an implant that is behind a firewall that only allows outbound HTTP and HTTPS. The team wants to blend in with normal web traffic. Which channel is most appropriate?
Select an answer first
34application · medium
A red team is using HTTPS for C2 and wants to avoid detection by network security devices that inspect TLS certificates. Which measure is most effective?
Select an answer first
35foundation · easy
Which network protocol is commonly used for C2 communications because it is often allowed through firewalls and can blend in with normal web traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Command and Control Infrastructure GRTP Practice Questions (Page 7)

Questions 31–35

Which C2 channel is most suitable when an implant needs to communicate through restrictive egress filtering that only allows DNS queries?

What is the primary purpose of monitoring C2 infrastructure during an operation?

A red team needs to set up a C2 channel for an implant that is behind a firewall that only allows outbound HTTP and HTTPS. The team wants to blend in with normal web traffic. Which channel is most appropriate?

A red team is using HTTPS for C2 and wants to avoid detection by network security devices that inspect TLS certificates. Which measure is most effective?

Which network protocol is commonly used for C2 communications because it is often allowed through firewalls and can blend in with normal web traffic?

Keep studying — Red Team Operations and Infrastructure