A red team is running a covert engagement where the target is actively hunting for C2 infrastructure. The team needs to maintain stealth while ensuring that the infrastructure can be quickly decommissioned if discovered. Which strategy best balances stealth and decommissioning?

Use infrastructure that is only active during business hours

Use ephemeral infrastructure that is automatically destroyed after each operation

Use infrastructure with no logging to reduce traces

Use persistent infrastructure with long-lived domains to avoid detection

A red team is setting up TLS for their C2 infrastructure. They want to ensure that the certificate does not raise suspicion and that the encryption is strong. Which approach should they take?

Use a certificate with a weak key to reduce processing overhead.

Use a self-signed certificate to avoid any third-party involvement.

Use a certificate from a well-known CA for a domain that matches the redirector's hostname.

Use a certificate that is expired but still accepted by the target.

A red team is setting up a redirector to protect their C2 server. They want to ensure that only the target organization's IP ranges can reach the redirector, while all other traffic is forwarded to a decoy service. Which configuration should they implement?

Configure the redirector to use a round-robin load balancer between the C2 server and the decoy.

Configure the redirector to forward all traffic to the decoy service and only log the source IPs.

Configure the redirector to forward all traffic to the C2 server, and rely on the C2 server's firewall for filtering.

Configure the redirector with an allowlist of target IP ranges and forward only matching traffic to the C2 server; all other traffic goes to a decoy.

A red team is configuring a redirector to forward HTTPS traffic to their C2 server. They want to ensure that the TLS connection is not broken and that the redirector does not become a point of failure. Which configuration is best?

Use a TCP-level redirector that forwards the encrypted traffic without terminating TLS.

Use a redirector that performs SSL stripping to reduce overhead.

Use an HTTP-level redirector that terminates TLS and re-encrypts to the C2 server.

Use a redirector that only forwards HTTP traffic and ignores HTTPS.

A red team is concerned about their C2 infrastructure being discovered and taken down during an engagement. They want to implement measures to ensure continuity even if one server is compromised. Which strategy is most effective?

Use a single C2 server with a very strong firewall to prevent compromise.

Deploy multiple C2 servers in different geographic regions and use a domain fronting or redirector to rotate traffic.

Keep the C2 server's IP address secret and do not use any redirectors.

Use a C2 server that is physically located in the target's country to reduce latency.

GIAC Red Team Professional

Domain 1Objective 3

Creating the Attack Infrastructure GRTP Practice Questions (Page 1)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 1–5

1expert · hard
A red team is running a covert engagement where the target is actively hunting for C2 infrastructure. The team needs to maintain stealth while ensuring that the infrastructure can be quickly decommissioned if discovered. Which strategy best balances stealth and decommissioning?
Select an answer first
2application · medium
A red team is setting up TLS for their C2 infrastructure. They want to ensure that the certificate does not raise suspicion and that the encryption is strong. Which approach should they take?
Select an answer first
3application · medium
A red team is setting up a redirector to protect their C2 server. They want to ensure that only the target organization's IP ranges can reach the redirector, while all other traffic is forwarded to a decoy service. Which configuration should they implement?
Select an answer first
4application · medium
A red team is configuring a redirector to forward HTTPS traffic to their C2 server. They want to ensure that the TLS connection is not broken and that the redirector does not become a point of failure. Which configuration is best?
Select an answer first
5application · medium
A red team is concerned about their C2 infrastructure being discovered and taken down during an engagement. They want to implement measures to ensure continuity even if one server is compromised. Which strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.