Discovery and Enumeration GRTP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are enumerating a web application and notice that the server responds with different status codes for different paths (e.g., 200 for /admin, 403 for /admin/config). You need to determine which paths are accessible without authentication. Which technique is most effective?

   • APerform a port scan of the web server to find other services.
   • BUse a directory brute-forcing tool with a wordlist to automate requests and filter by status code.
   • CCheck the web server's error logs for previously accessed paths.
   • DUse a tool like curl to manually request each path and observe the status code.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which statement best describes the difference between discovery and enumeration in the context of initial access?

   • ADiscovery is performed only on external networks, while enumeration is performed only on internal networks
   • BDiscovery uses only passive techniques, while enumeration uses only active techniques
   • CDiscovery is a post-exploitation activity, while enumeration is a pre-exploitation activity
   • DDiscovery identifies active hosts and services, while enumeration extracts detailed information from those services
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of documenting enumeration findings during a red team engagement?

   • ATo provide a reference for planning subsequent attack steps and prioritizing targets
   • BTo share the findings with the target organization's customers
   • CTo automatically patch vulnerabilities discovered during enumeration
   • DTo create a backup of the target's data
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which PowerShell cmdlet is used to query Active Directory for all user objects?

   • AGet-ADUser
   • BGet-Service
   • CGet-Process
   • DGet-Item
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You have obtained a low-privileged domain user account in an Active Directory environment. Your objective is to identify potential privilege escalation paths by discovering domain admins, their group memberships, and any accounts with 'Do not require Kerberos pre-authentication' enabled. Which approach is most efficient?

   • ARun BloodHound to collect and visualize relationships between users, groups, and computers.
   • BPerform an LDAP query to find all accounts with adminCount=1.
   • CUse net user /domain to list all users and manually check each account's attributes.
   • DEnumerate SMB shares on the domain controller to find group policy files.
   Reveal Solution Discussion Select an answer first