Discovery and Enumeration GRTP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are assessing a Google Cloud Platform (GCP) project for exposed services. You have read-only access to the project. Which enumeration step is most effective to identify firewall rules that allow public access to VM instances?

   • AEnumerate all IAM users and roles in the project.
   • BCheck the GCP status page for service outages.
   • CUse the GCP CLI to list all firewall rules and inspect the source ranges for 0.0.0.0/0.
   • DPerform a port scan of all external IP addresses in the project.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the context of the attack lifecycle, what is the primary purpose of the discovery and enumeration phase?

   • ATo deliver the initial payload and establish a foothold on the target system
   • BTo identify and catalog potential targets, services, and vulnerabilities that can be leveraged for initial access
   • CTo maintain persistence and evade detection after a successful compromise
   • DTo exfiltrate sensitive data from the target network
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which tool is commonly used to discover hidden directories and files on a web server?

   • Anmap
   • Bgobuster
   • Cjohn
   • Dwireshark
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are in the initial access phase of a red team engagement. You have a limited time window and need to identify the most promising target for further exploitation. Which combination of actions best supports this decision?

   • AUse only passive techniques like listening to network traffic to identify hosts and services.
   • BConduct a ping sweep to find live hosts, then a targeted port scan on common ports, and finally service enumeration on open ports.
   • CPerform a broad port scan of the entire network and then manually review all results.
   • DSkip discovery and directly attempt to exploit known vulnerabilities on all hosts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a web application assessment, you need to discover hidden directories and parameters that are not linked from the main site. The application uses a JavaScript framework that loads content dynamically. Which approach is most effective for initial content discovery?

   • AUse a wordlist-based directory brute-forcing tool like gobuster against the web server, focusing on common directory names.
   • BRun a vulnerability scanner that only checks for SQL injection and XSS on the homepage.
   • CPerform a DNS zone transfer to enumerate subdomains that host the web application.
   • DManually browse the application and click every link to map the entire site.
   Reveal Solution Discussion Select an answer first