What does a web application technology fingerprinting tool like WhatWeb primarily identify?

The passwords of administrative users

The IP addresses of all users who visited the site

The database schema used by the application

The web server software, frameworks, and plugins used by the application

You have obtained a low-privileged domain user account. You need to identify a path to domain admin, but you have limited time and want to avoid actions that might lock the account or trigger alerts. Which approach is most effective?

Use the 'net user' command to enumerate all users and manually check group memberships.

Enumerate all SMB shares on the domain controller to find scripts that contain credentials.

Perform a full LDAP dump of all AD objects and analyze offline.

Run BloodHound with a targeted collection method that only queries necessary AD attributes.

You have gained initial access to a Windows host in a corporate environment. You need to enumerate local users, groups, and installed software to find potential privilege escalation vectors, but you want to minimize the number of commands executed to avoid detection by EDR. Which approach is most efficient?

Use the 'wmic' command to query installed software only.

Use the 'net user' command multiple times to list all users and groups.

Use a tool like Seatbelt to run a comprehensive host enumeration.

Run a single PowerShell script that collects user, group, and software information in one go.

You are assessing a web application that uses a content delivery network (CDN) in front of the origin server. You need to enumerate the application's directories and parameters without being blocked by the CDN's rate limiting. Which approach is most effective?

Analyze the JavaScript files and source maps for endpoint references.

Perform a full port scan on the CDN's IP range to find the origin server directly.

Use a distributed scanning approach with multiple IPs to bypass rate limits.

Use a slow and low directory brute-force scan with random delays and a small wordlist.

GIAC Red Team Professional

Domain 2Objective 2

Discovery and Enumeration GRTP Practice Questions (Page 9)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 41–44

41foundation · easy
What does a web application technology fingerprinting tool like WhatWeb primarily identify?
Select an answer first
42expert · hard
You have obtained a low-privileged domain user account. You need to identify a path to domain admin, but you have limited time and want to avoid actions that might lock the account or trigger alerts. Which approach is most effective?
Select an answer first
43expert · hard
You have gained initial access to a Windows host in a corporate environment. You need to enumerate local users, groups, and installed software to find potential privilege escalation vectors, but you want to minimize the number of commands executed to avoid detection by EDR. Which approach is most efficient?
Select an answer first
44expert · hard
You are assessing a web application that uses a content delivery network (CDN) in front of the origin server. You need to enumerate the application's directories and parameters without being blocked by the CDN's rate limiting. Which approach is most effective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.