A red team is provisioning domains for an engagement. They want to avoid association with the red team and ensure the domains are not easily taken down by the target's incident response. Which domain and hosting strategy is most appropriate?

Use a domain that is already blacklisted to avoid detection.

Use a free subdomain from a public service to avoid registration costs.

Register a domain using the red team's real company name to establish legitimacy.

Register a domain with privacy protection and use a hosting provider that is resistant to abuse complaints.

What is a key OPSEC consideration when setting up attack infrastructure?

Using the same infrastructure for multiple simultaneous engagements to save resources

Sharing infrastructure details with all team members via public channels

Ensuring that infrastructure components are not linked to the red team's real identity

Placing all infrastructure in a single cloud provider for easier management

A red team is planning an engagement against a target that has a mature security operations center (SOC) and uses threat intelligence feeds. The team needs to select C2 infrastructure that is unlikely to be flagged by these feeds. Which planning decision is most appropriate?

Use a domain that is similar to a legitimate service but with a different TLD

Use a hosting provider that is known for hosting malicious content

Use a domain that has been previously reported as malicious

Use a domain and hosting provider that are not commonly associated with malicious activity

The red team is deploying a C2 server that will be accessed through a redirector. They need to ensure that traffic between the redirector and the C2 server is encrypted and that the C2 server's identity is verified. Which TLS configuration should they implement?

Use the same certificate on both the redirector and the C2 server

Use a valid certificate on the redirector and a separate valid certificate on the C2 server

Use no encryption between the redirector and the C2 server

Use a self-signed certificate on the redirector and a valid certificate on the C2 server

A red team is planning an engagement against a target that uses egress filtering that only allows HTTPS traffic to well-known domains. The team needs to maintain stealth and avoid burning infrastructure if the target detects the C2 traffic. Which approach best aligns with the planning phase?

Use a domain that mimics a common SaaS provider and host the C2 behind a redirector that forwards HTTPS traffic to a VPS.

Use a direct connection from the C2 server to the target without any redirectors to minimize latency.

Use a free dynamic DNS service and host the C2 on a home connection to reduce cost.

Use a dedicated IP and domain that clearly identifies the red team to avoid legal issues.

GIAC Red Team Professional

Domain 1Objective 3

Creating the Attack Infrastructure GRTP Practice Questions (Page 5)

Part of the Red Team Operations and Infrastructure domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~27–46 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 21–25

21application · medium
A red team is provisioning domains for an engagement. They want to avoid association with the red team and ensure the domains are not easily taken down by the target's incident response. Which domain and hosting strategy is most appropriate?
Select an answer first
22foundation · easy
What is a key OPSEC consideration when setting up attack infrastructure?
Select an answer first
23expert · hard
A red team is planning an engagement against a target that has a mature security operations center (SOC) and uses threat intelligence feeds. The team needs to select C2 infrastructure that is unlikely to be flagged by these feeds. Which planning decision is most appropriate?
Select an answer first
24application · medium
The red team is deploying a C2 server that will be accessed through a redirector. They need to ensure that traffic between the redirector and the C2 server is encrypted and that the C2 server's identity is verified. Which TLS configuration should they implement?
Select an answer first
25application · medium
A red team is planning an engagement against a target that uses egress filtering that only allows HTTPS traffic to well-known domains. The team needs to maintain stealth and avoid burning infrastructure if the target detects the C2 traffic. Which approach best aligns with the planning phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.