You are assessing a hybrid environment with both on-premises servers and AWS resources. You have credentials for the on-premises domain and read-only IAM credentials for AWS. You need to identify potential pivot points between the two environments. Which enumeration approach is most effective?

Enumerate only AWS resources using the IAM credentials, ignoring on-premises.

Search for hardcoded AWS keys in on-premises file shares.

Port scan the on-premises network and the AWS VPC IP ranges to find open services.

Enumerate on-premises AD for trust relationships and AWS IAM roles that are assumed by on-premises identities.

GIAC Red Team Professional

Domain 2Objective 2

Discovery and Enumeration GRTP Practice Questions (Page 5)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
Which Windows command is used to list all local user accounts on a host?
Select an answer first
22foundation · easy
Which tool is commonly used to perform a ping sweep to identify active hosts on a network?
Select an answer first
23foundation · easy
Which command on a Linux target would display the operating system version and kernel information?
Select an answer first
24expert · hard
You are assessing a hybrid environment with both on-premises servers and AWS resources. You have credentials for the on-premises domain and read-only IAM credentials for AWS. You need to identify potential pivot points between the two environments. Which enumeration approach is most effective?
Select an answer first
25foundation · easy
Which Azure CLI command is used to list all virtual machines in a resource group?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Discovery and Enumeration GRTP Practice Questions (Page 5)

Questions 21–25

Which Windows command is used to list all local user accounts on a host?

Which tool is commonly used to perform a ping sweep to identify active hosts on a network?

Which command on a Linux target would display the operating system version and kernel information?

You are assessing a hybrid environment with both on-premises servers and AWS resources. You have credentials for the on-premises domain and read-only IAM credentials for AWS. You need to identify potential pivot points between the two environments. Which enumeration approach is most effective?

Which Azure CLI command is used to list all virtual machines in a resource group?

Keep studying — Initial Access and Discovery