You are assessing an AWS environment for misconfigurations. You have been provided read-only IAM credentials. Which enumeration step is most effective to identify publicly exposed storage resources?

Enumerate IAM users and roles to find credentials that might have access to S3.

Use the AWS CLI to list all S3 buckets and check their ACLs and bucket policies for public access.

Check the AWS Health Dashboard for service outages that might affect S3.

Perform a port scan of the AWS IP ranges to find S3 endpoints.

You have gained initial access to a Linux host in a DMZ. You need to enumerate the host to find locally stored credentials, other users, and installed software that could help you pivot. Which set of commands is most appropriate?

Run 'ps aux' and 'netstat -tulpn' to see running processes and open ports.

Run 'cat /etc/passwd', 'ls -la /home', and 'dpkg -l'.

Run 'ifconfig' and 'route' to understand the network configuration.

Run 'find / -name *.conf' to locate configuration files.

GIAC Red Team Professional

Domain 2Objective 2

Discovery and Enumeration GRTP Practice Questions (Page 1)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which protocol is specifically used to enumerate SMB shares and users on a Windows host?
Select an answer first
2foundation · easy
Which AWS CLI command is used to list all S3 buckets in an AWS account?
Select an answer first
3application · medium
You are assessing an AWS environment for misconfigurations. You have been provided read-only IAM credentials. Which enumeration step is most effective to identify publicly exposed storage resources?
Select an answer first
4foundation · easy
Which command is used to connect to an SSH service and retrieve its banner to determine the version?
Select an answer first
5application · medium
You have gained initial access to a Linux host in a DMZ. You need to enumerate the host to find locally stored credentials, other users, and installed software that could help you pivot. Which set of commands is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Discovery and Enumeration GRTP Practice Questions (Page 1)

Questions 1–5

Which protocol is specifically used to enumerate SMB shares and users on a Windows host?

Which AWS CLI command is used to list all S3 buckets in an AWS account?

You are assessing an AWS environment for misconfigurations. You have been provided read-only IAM credentials. Which enumeration step is most effective to identify publicly exposed storage resources?

Which command is used to connect to an SSH service and retrieve its banner to determine the version?

You have gained initial access to a Linux host in a DMZ. You need to enumerate the host to find locally stored credentials, other users, and installed software that could help you pivot. Which set of commands is most appropriate?

Keep studying — Initial Access and Discovery