Which operational security measure helps prevent the C2 server from being identified by domain reputation or sinkholing?

Rotating domains and using domain fronting

Hosting the C2 server on a well-known cloud provider

Using a single, long-lived domain

Using a domain that is similar to a legitimate service

A red team operator is configuring a redirector for HTTPS C2 traffic. The operator wants to ensure that the redirector can handle multiple concurrent sessions and that the C2 server's IP is not exposed. Which configuration is most appropriate?

Use socat to forward TCP 443 to the C2 server, and keep the C2 server on a public IP.

Use iptables DNAT on the redirector to forward TCP 443 to the C2 server, and keep the C2 server on a private IP.

Use a reverse proxy like nginx to forward HTTPS traffic to the C2 server, and keep the C2 server on a public IP.

Use iptables DNAT to forward TCP 443 to the C2 server, but use a public IP for the C2 server.

A red team is managing C2 infrastructure and needs to take down a redirector that has been compromised by the target's defenders. The team wants to minimize the impact on ongoing operations. Which action is most appropriate?

Switch all implants to use a different protocol, such as DNS, without changing the redirector.

Keep the compromised redirector running but change the C2 server's IP.

Deploy a new redirector, update the C2 server to accept traffic from it, and redirect implants to the new redirector.

Immediately shut down the compromised redirector and wait for implants to reconnect to the C2 server directly.

What is the main operational security benefit of using a redirector in a C2 infrastructure?

It reduces the amount of data sent to the C2 server

It hides the C2 server's IP address from the target network

GIAC Red Team Professional

Domain 1Objective 4

Command and Control Infrastructure GRTP Practice Questions (Page 8)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 36–39

36foundation · easy
Which operational security measure helps prevent the C2 server from being identified by domain reputation or sinkholing?
Select an answer first
37application · medium
A red team operator is configuring a redirector for HTTPS C2 traffic. The operator wants to ensure that the redirector can handle multiple concurrent sessions and that the C2 server's IP is not exposed. Which configuration is most appropriate?
Select an answer first
38expert · hard
A red team is managing C2 infrastructure and needs to take down a redirector that has been compromised by the target's defenders. The team wants to minimize the impact on ongoing operations. Which action is most appropriate?
Select an answer first
39foundation · easy
What is the main operational security benefit of using a redirector in a C2 infrastructure?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.