Discovery and Enumeration GRTP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   You are conducting a red team exercise where the client has requested minimal network noise. You need to identify live hosts and enumerate SMB services on a large internal subnet. The client has provided a list of IP addresses that are known to be in use, but you suspect there are additional hosts. Which strategy best balances stealth and completeness?

   • APerform a full TCP connect scan on all ports for the entire subnet, then follow up with service enumeration on open ports.
   • BUse the provided IP list and perform a SYN scan on port 445 only for those hosts.
   • CUse passive network monitoring to observe SMB traffic and identify hosts, then perform targeted SYN scans on port 445 for those hosts.
   • DRun a ping sweep with ICMP echo requests, then scan all TCP ports on responding hosts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When analyzing enumeration data, which factor is most important for prioritizing targets?

   • AThe number of open ports on the host
   • BThe potential impact and ease of exploitation of the identified services
   • CThe alphabetical order of the hostnames
   • DThe IP address range of the target
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You have discovered an open SMB port on a Windows server during an engagement. You need to gather information about the operating system version, available shares, and whether null session access is permitted. Which tool or command sequence is most appropriate for this task?

   • AUse netcat to connect to port 445 and manually read the banner.
   • BRun a full port scan to find other open ports and assume the OS is Windows based on the open port.
   • CUse nmap with the smb-os-discovery script and smb-enum-shares script.
   • DUse the enum4linux tool to enumerate users and groups only.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After performing network discovery and service enumeration, you have a list of hosts, open ports, and service banners. Your next step is to prioritize targets for exploitation. Which approach is most effective?

   • APrioritize hosts that are running outdated or vulnerable service versions identified from banners.
   • BPrioritize hosts with the most open ports, regardless of service version.
   • CPrioritize hosts that respond to ping, as they are likely easier to exploit.
   • DPrioritize hosts based on their IP address order in the subnet.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are enumerating an Active Directory environment and want to find all domain controllers, their operating system versions, and whether any have weak SMB signing configurations. Which tool or command is most effective?

   • AUse the 'net group "Domain Controllers" /domain' command.
   • BUse the 'nltest /dclist:domain' command.
   • CUse Nmap with the smb-security-mode script against the domain controllers.
   • DUse PowerShell's Get-ADDomainController to list all DCs.
   Reveal Solution Discussion Select an answer first