During an Active Directory assessment, you need to identify all domain controllers and their operating system versions without using privileged credentials. Which enumeration method is most appropriate?

Use the net user /domain command to list all domain controllers.

Perform a full port scan of the entire domain subnet to find hosts with port 389 open.

Attempt to replicate the directory using the DCSync attack.

Query the domain's DNS records for service locator (SRV) records that point to domain controllers.

You have completed enumeration of a network and have a large amount of data: port scans, service banners, AD objects, and web application findings. You need to produce a report that prioritizes the most critical attack paths. Which approach is most effective?

Prioritize based on the number of open ports on each host.

Correlate service versions with known CVEs and map AD relationships to identify high-impact attack paths.

List all findings in a spreadsheet without prioritization.

Focus only on web application findings, ignoring network and AD data.

You are assessing a web application that uses a REST API. You need to discover undocumented API endpoints and understand how the application handles authentication. Which approach is most effective?

Review the JavaScript files served by the application for API endpoint references and authentication tokens.

Use a tool like Postman to manually test common API endpoints.

Perform a port scan to find other services that might be related to the API.

Run a wordlist-based directory brute-force scan against the API base path.

You have discovered an SSH service on a server. You need to determine the exact version and supported authentication methods, but you want to avoid generating too many failed login attempts that could lock out accounts. Which technique is most appropriate?

Use a wordlist to brute-force SSH credentials.

Use nmap's ssh2-enum-algos script to enumerate supported algorithms.

Connect with netcat and read the SSH banner.

Use the 'ssh -v' command to connect and observe the handshake.

During an assessment, you discover an open TCP port 3306 on a database server. You need to determine the database software and version without causing disruption. Which technique is most appropriate?

Run a full vulnerability scanner against the database server.

Perform a port scan of the server to see if other database ports are open.

Attempt to log in with default credentials to see the version in the error message.

Connect to the port and read the banner, which often includes the database version.

GIAC Red Team Professional

Domain 2Objective 2

Discovery and Enumeration GRTP Practice Questions (Page 4)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 16–20

16application · easy
During an Active Directory assessment, you need to identify all domain controllers and their operating system versions without using privileged credentials. Which enumeration method is most appropriate?
Select an answer first
17expert · hard
You have completed enumeration of a network and have a large amount of data: port scans, service banners, AD objects, and web application findings. You need to produce a report that prioritizes the most critical attack paths. Which approach is most effective?
Select an answer first
18application · medium
You are assessing a web application that uses a REST API. You need to discover undocumented API endpoints and understand how the application handles authentication. Which approach is most effective?
Select an answer first
19expert · hard
You have discovered an SSH service on a server. You need to determine the exact version and supported authentication methods, but you want to avoid generating too many failed login attempts that could lock out accounts. Which technique is most appropriate?
Select an answer first
20application · easy
During an assessment, you discover an open TCP port 3306 on a database server. You need to determine the database software and version without causing disruption. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.