You have gained access to a web server that hosts multiple virtual hosts. You need to identify which services are running and their versions to find a vulnerability for lateral movement. The server is behind a load balancer, and the SOC monitors for unusual outbound connections. Which enumeration technique is most appropriate?

Use an external vulnerability scanner against the server's public IP

Query the load balancer's management interface for backend service information

Run a port scan from the server to other internal hosts

Use local system commands to list listening ports and service versions

A red team is planning an initial access operation against a company that has a public-facing web application and a remote access VPN. The team has identified a critical vulnerability in the web application that allows remote code execution. Which initial access vector is most likely to provide the fastest and most reliable foothold?

Use a vishing call to the IT help desk to obtain VPN credentials.

Exploit the web application vulnerability to execute a command that establishes a reverse shell to the team's server.

Perform a password spraying attack against the VPN portal using common passwords.

Send a spear phishing email to employees with a malicious link to a credential harvesting page.

A red team has gained access to a Windows server that hosts a critical business application. The team wants to identify installed software and services that may have known vulnerabilities, but the server is heavily monitored and any use of third-party scanning tools would trigger alerts. Which method is most appropriate?

Use built-in Windows Management Instrumentation (WMI) queries to enumerate installed software and services, then compare versions against a local vulnerability database.

Run a network vulnerability scanner like Nessus against the server from another compromised host.

Download and run a portable vulnerability scanner like OpenVAS on the server.

Use `tasklist` and `netstat` to list running processes and open ports, then manually guess software versions.

Which of the following is a common misconfiguration that can be discovered during system and service enumeration and may lead to privilege escalation?

World-writable files or directories

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 1)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 1–5

1expert · hard
You have gained access to a web server that hosts multiple virtual hosts. You need to identify which services are running and their versions to find a vulnerability for lateral movement. The server is behind a load balancer, and the SOC monitors for unusual outbound connections. Which enumeration technique is most appropriate?
Select an answer first
2foundation · easy
Which attack involves using previously breached username and password pairs to try to log in to multiple different services?
Select an answer first
3application · medium
A red team is planning an initial access operation against a company that has a public-facing web application and a remote access VPN. The team has identified a critical vulnerability in the web application that allows remote code execution. Which initial access vector is most likely to provide the fastest and most reliable foothold?
Select an answer first
4expert · hard
A red team has gained access to a Windows server that hosts a critical business application. The team wants to identify installed software and services that may have known vulnerabilities, but the server is heavily monitored and any use of third-party scanning tools would trigger alerts. Which method is most appropriate?
Select an answer first
5foundation · easy
Which of the following is a common misconfiguration that can be discovered during system and service enumeration and may lead to privilege escalation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 1)

Questions 1–5

Which attack involves using previously breached username and password pairs to try to log in to multiple different services?

Which of the following is a common misconfiguration that can be discovered during system and service enumeration and may lead to privilege escalation?

Keep studying — Initial Access and Discovery