You have a low-privilege shell on a Linux host. Enumeration shows that the `/etc/passwd` file is world-writable. What is the most effective way to escalate privileges?

Use `crontab -e` to add a cron job that runs as root.

Use `chmod` to make `/bin/bash` SUID.

Use `sudo -l` to check for sudo rights and run a command as root.

Add a new user with UID 0 to `/etc/passwd` and switch to that user.

Which privilege abuse technique involves creating or modifying a scheduled task to run a malicious binary with elevated privileges?

Service misconfiguration exploitation

You have a shell as a user in the `Developers` group on a Windows host. You find that the `Developers` group has `SeDebugPrivilege` enabled. What is the most effective way to escalate privileges?

Use `runas /user:Administrator` to launch a command as Administrator.

Use `net localgroup administrators` to add yourself to the Administrators group.

Use `mimikatz` to inject a token from a process running as SYSTEM.

Use `sc create` to create a new service running as SYSTEM.

During a red team engagement, you gain initial access to a Windows workstation as a standard domain user. You need to identify potential privilege escalation paths without triggering EDR alerts. Which approach best balances stealth and effectiveness for enumerating privileges?

Use `secretsdump.py` against the local SAM to extract password hashes for offline cracking.

Run `whoami /priv` and `whoami /groups` to check for enabled privileges and group memberships.

Query Active Directory for all domain admins using `net group "Domain Admins" /domain`.

Upload and run `winPEAS.exe` to enumerate all privilege escalation vectors in one pass.

You have a low-privilege shell on a Windows host. You find a scheduled task that runs as SYSTEM with an action that points to a script in a directory where your user has write permissions. However, the task is configured to run only when the user is logged on. What is the most effective way to escalate privileges?

Use `runas /user:SYSTEM` to run the payload directly.

Replace the script with a payload and wait for the task to trigger, but also check if the task can be manually started.

Modify the task's configuration to run whether the user is logged on or not, then trigger it.

Use `schtasks /run` to start the task immediately.

GIAC Red Team Professional

Domain 2Objective 3

Enumerating and Attacking Privileges GRTP Practice Questions (Page 7)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 31–35

31application · medium
You have a low-privilege shell on a Linux host. Enumeration shows that the `/etc/passwd` file is world-writable. What is the most effective way to escalate privileges?
Select an answer first
32foundation · easy
Which privilege abuse technique involves creating or modifying a scheduled task to run a malicious binary with elevated privileges?
Select an answer first
33application · medium
You have a shell as a user in the `Developers` group on a Windows host. You find that the `Developers` group has `SeDebugPrivilege` enabled. What is the most effective way to escalate privileges?
Select an answer first
34application · medium
During a red team engagement, you gain initial access to a Windows workstation as a standard domain user. You need to identify potential privilege escalation paths without triggering EDR alerts. Which approach best balances stealth and effectiveness for enumerating privileges?
Select an answer first
35expert · hard
You have a low-privilege shell on a Windows host. You find a scheduled task that runs as SYSTEM with an action that points to a script in a directory where your user has write permissions. However, the task is configured to run only when the user is logged on. What is the most effective way to escalate privileges?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.