Discovery and Enumeration GRTP Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   You are performing a cloud penetration test on a multi-account AWS environment. You have been given read-only credentials for one account. You need to identify resources in other accounts that may be accessible from this account via cross-account roles or resource policies. Which approach is most effective?

   • AUse the AWS CLI to list all S3 buckets in all accounts by guessing bucket names.
   • BEnumerate IAM roles in the current account and check for trust policies that allow access from other accounts.
   • CPerform a port scan of all AWS IP ranges to find resources in other accounts.
   • DEnumerate all users in the current account and check their permissions for cross-account actions.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an internal red team engagement, you are asked to identify live hosts and services on a /24 subnet without triggering IDS alerts. The client has strict rules of engagement that prohibit aggressive scanning. Which approach best balances stealth with the need to enumerate open ports and service versions?

   • AScan only the top 100 ports with a full connect scan and no version detection to avoid any service banners.
   • BRun a full TCP connect scan on all 65535 ports with service version detection (-sV) for every host.
   • CUse a UDP scan on all ports for every host in the subnet, assuming most services are UDP-based.
   • DPerform an ICMP ping sweep to identify live hosts, then run a SYN scan on common ports with service version detection only on responsive ports.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   You are conducting a red team engagement where the client has asked you to minimize the chance of detection by network monitoring. You need to identify live hosts and open ports on a large subnet, but you only have a short window of time. Which strategy best balances stealth and efficiency?

   • AUse a tool like masscan to scan all ports on all IPs at a high rate.
   • BUse a ping sweep to find live hosts, then a SYN scan on common ports, and finally service version detection on open ports.
   • CUse a UDP scan on all ports for every IP, assuming most services are UDP.
   • DPerform a full TCP connect scan on all ports for every IP in the subnet.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   You have a low-privileged domain account and need to identify the most efficient attack path to Domain Admin. You have access to a network share that contains a large amount of user data. Which approach is most effective?

   • AEnumerate all local admin groups on every machine using remote WMI queries.
   • BSearch the network share for files containing passwords or sensitive information.
   • CEnumerate all AD objects using BloodHound and analyze for shortest paths to high-value groups.
   • DPerform a password spraying attack against all domain users using a small list of common passwords.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of a port scan during network discovery?

   • ATo determine the operating system of the target host
   • BTo enumerate user accounts on the target host
   • CTo identify which TCP or UDP ports are open on a target host
   • DTo identify the MAC address of the target host
   Reveal Solution Discussion Select an answer first