What is the final step in the lifecycle of attack infrastructure for a red team engagement?

Transferring infrastructure to the client for their use

Decommissioning all infrastructure and removing any traces

Deploying additional payloads to maintain persistence

Documenting the infrastructure in a public report

Which of the following is a common technique to increase the resilience of attack infrastructure against takedown?

Using a single, high-performance server for all C2 operations

Registering the domain with the red team's real name to avoid suspicion

Implementing multiple redirectors and fast-flux DNS to rotate IP addresses

Disabling logging on all infrastructure to reduce evidence

Which of the following is a common reason to choose a commercial C2 framework over an open-source one?

Commercial frameworks do not require any configuration

Commercial frameworks are immune to detection by antivirus software

Commercial frameworks are always more stealthy than open-source ones

Commercial frameworks provide dedicated support and regular updates

A red team is running a long-term engagement. They have a set of domains and VPS instances. Mid-engagement, one of their domains is sinkholed. They need to maintain operations while minimizing the risk of losing more infrastructure. Which action is most appropriate?

Register a new domain with the same hosting provider

Switch to a pre-staged backup domain and rotate all redirectors

Immediately decommission all infrastructure to avoid further loss

Continue using the sinkholed domain and hope it recovers

Which of the following is a key requirement to document when planning attack infrastructure for a red team engagement?

The brand of hardware used for the team's laptops

The personal preferences of the red team lead

The approved target list and authorized attack vectors

The physical location of every team member

GIAC Red Team Professional

Domain 1Objective 3

Creating the Attack Infrastructure GRTP Practice Questions (Page 4)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 16–20

16foundation · easy
What is the final step in the lifecycle of attack infrastructure for a red team engagement?
Select an answer first
17foundation · easy
Which of the following is a common technique to increase the resilience of attack infrastructure against takedown?
Select an answer first
18foundation · easy
Which of the following is a common reason to choose a commercial C2 framework over an open-source one?
Select an answer first
19expert · hard
A red team is running a long-term engagement. They have a set of domains and VPS instances. Mid-engagement, one of their domains is sinkholed. They need to maintain operations while minimizing the risk of losing more infrastructure. Which action is most appropriate?
Select an answer first
20foundation · easy
Which of the following is a key requirement to document when planning attack infrastructure for a red team engagement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.