Which of the following is a common method for obtaining a TLS certificate for a red team domain?

Generating a self-signed certificate and installing it on the target system

Creating a certificate with the same private key as the target's existing certificate

Using a certificate embedded in the C2 framework's source code

Using a certificate from a public Certificate Authority (CA) via ACME/Let's Encrypt

Why is it important to maintain documentation of the attack infrastructure during its lifecycle?

To ensure the infrastructure is reused in future engagements

To provide a record for the engagement report and facilitate troubleshooting

To satisfy legal requirements for public disclosure

To share the infrastructure details with the target's defenders in real time

After a red team engagement concludes, the team must decommission the attack infrastructure. Which action is most important to ensure that the infrastructure cannot be used by others or traced back to the team?

Only delete the C2 server but keep redirectors active

Shut down all VPS instances and delete the domains

Change all passwords and leave the infrastructure running for future engagements

Remove the TLS certificates but keep the domains registered

During an engagement, the red team needs to hide the true IP of their C2 server from the target's network defenders. They have a VPS and a domain. Which setup provides the most effective source obfuscation while maintaining reliable HTTPS communication?

Set up a redirector on the same VPS as the C2 server

Configure the domain to point to a CDN, and use the CDN as a redirector to the VPS

Use a free dynamic DNS service that points to the VPS

Point the domain directly to the VPS IP and use a self-signed certificate

When provisioning a domain for attack infrastructure, which of the following is a best practice?

Registering the domain with WHOIS privacy protection to hide registration details

Hosting the domain's DNS on the same server as the C2 to simplify management

Using a domain that has been previously used in other engagements to save time

Using a domain name that closely resembles a legitimate company to avoid suspicion

GIAC Red Team Professional

Domain 1Objective 3

Creating the Attack Infrastructure GRTP Practice Questions (Page 2)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 6–10

6foundation · easy
Which of the following is a common method for obtaining a TLS certificate for a red team domain?
Select an answer first
7foundation · easy
Why is it important to maintain documentation of the attack infrastructure during its lifecycle?
Select an answer first
8application · medium
After a red team engagement concludes, the team must decommission the attack infrastructure. Which action is most important to ensure that the infrastructure cannot be used by others or traced back to the team?
Select an answer first
9application · medium
During an engagement, the red team needs to hide the true IP of their C2 server from the target's network defenders. They have a VPS and a domain. Which setup provides the most effective source obfuscation while maintaining reliable HTTPS communication?
Select an answer first
10foundation · easy
When provisioning a domain for attack infrastructure, which of the following is a best practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.