You have gained access to a Windows server in a domain. You need to enumerate local groups and their members to identify potential privilege escalation paths. Which command or tool is most appropriate?

Use the 'net group' command to list domain groups.

Use 'whoami /groups' to list the current user's group memberships.

Query Active Directory for all computer objects.

Use the 'net localgroup' command to list local groups and their members.

You are performing an internal network assessment and need to identify hosts running a specific web application on a non-standard port (e.g., TCP 8443). You have a list of IP addresses in the subnet. Which technique is most efficient?

Use a ping sweep to identify live hosts, then manually check each host with a web browser.

Use a port scanner to perform a SYN scan on port 8443 across all IPs in the subnet.

Query the DNS server for SRV records that might indicate the web application.

Perform a full port scan on all 65535 ports for each IP.

You have compromised a Windows workstation in a domain environment. Your goal is to identify local administrator accounts and installed software that might be vulnerable. Which enumeration technique is most appropriate?

Check the ARP cache to identify other devices on the network.

Run a network port scan from the workstation to identify other hosts and their services.

Enumerate Active Directory groups using LDAP queries.

Query the local SAM database for user accounts and use WMI to list installed software.

You have obtained a low-privileged domain account during a red team exercise. Your objective is to identify potential privilege escalation paths without using tools that require administrative privileges on the domain controller. Which enumeration technique is most appropriate?

Run a full LDAP dump of the entire directory using the low-privileged account to extract all attributes, including password hashes.

Perform an SMB null session enumeration to list all domain users and groups without any credentials.

Use BloodHound with the SharpHound collector to map group memberships, sessions, and ACLs from the context of the low-privileged account.

Enumerate only the local SAM database of the domain controller using remote registry access.

GIAC Red Team Professional

Domain 2Objective 2

Discovery and Enumeration GRTP Practice Questions (Page 7)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which tool is specifically designed to enumerate Active Directory users, groups, and computers from a Linux system?
Select an answer first
32application · easy
You have gained access to a Windows server in a domain. You need to enumerate local groups and their members to identify potential privilege escalation paths. Which command or tool is most appropriate?
Select an answer first
33application · easy
You are performing an internal network assessment and need to identify hosts running a specific web application on a non-standard port (e.g., TCP 8443). You have a list of IP addresses in the subnet. Which technique is most efficient?
Select an answer first
34application · medium
You have compromised a Windows workstation in a domain environment. Your goal is to identify local administrator accounts and installed software that might be vulnerable. Which enumeration technique is most appropriate?
Select an answer first
35application · medium
You have obtained a low-privileged domain account during a red team exercise. Your objective is to identify potential privilege escalation paths without using tools that require administrative privileges on the domain controller. Which enumeration technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.