An attacker uploads a malicious file to a web application that does not validate file types, then executes it on the server. Which vulnerability is being exploited?

Cross-site request forgery (CSRF)

A red team is assessing a company that runs a web application on a server with a misconfigured file upload feature. The team has identified that the server does not validate file types and allows uploading executable files. Which action is most likely to achieve initial access?

Upload a web shell disguised as an image file and then access it via the web server to execute commands.

Perform a port scan of the web server to identify other services that may be vulnerable.

Use a brute force attack on the web application's login page to gain admin access.

Send a phishing email to the web application's administrator to obtain credentials.

A red team is targeting a company that has recently migrated to a cloud-based identity provider and enforces MFA for all user logins. The company also uses a web application firewall (WAF) in front of its public-facing applications. Which initial access vector is most likely to succeed?

Password spraying against the cloud identity provider

Sending a spear phishing email with a malicious link

Using a vishing call to obtain a password reset token

Exploiting a server-side vulnerability in a public-facing application that bypasses the WAF

A red team has gained access to a file server and wants to locate sensitive data for potential exfiltration. The team has limited time and wants to prioritize files that are most valuable. Which approach is most effective?

Enumerate all domain users and groups to identify which users have access to sensitive folders.

Scan the file server for open ports and services to identify other potential targets.

Copy all files from the file server to a staging area for later analysis.

Search for files with names containing keywords like 'password', 'secret', 'confidential', and 'financial' across common file shares.

During a penetration test, you discover that a public-facing web application is vulnerable to SQL injection in the login form. You successfully extract the password hash of a service account. What is the most appropriate next step to gain initial access?

Enumerate users and groups from the database to plan privilege escalation

Upload a web shell to the server to maintain persistence

Immediately scan the internal network for other vulnerable services

Crack the hash offline and attempt to authenticate to the web application

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 2)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 6–10

6foundation · easy
An attacker uploads a malicious file to a web application that does not validate file types, then executes it on the server. Which vulnerability is being exploited?
Select an answer first
7application · medium
A red team is assessing a company that runs a web application on a server with a misconfigured file upload feature. The team has identified that the server does not validate file types and allows uploading executable files. Which action is most likely to achieve initial access?
Select an answer first
8expert · hard
A red team is targeting a company that has recently migrated to a cloud-based identity provider and enforces MFA for all user logins. The company also uses a web application firewall (WAF) in front of its public-facing applications. Which initial access vector is most likely to succeed?
Select an answer first
9application · medium
A red team has gained access to a file server and wants to locate sensitive data for potential exfiltration. The team has limited time and wants to prioritize files that are most valuable. Which approach is most effective?
Select an answer first
10application · medium
During a penetration test, you discover that a public-facing web application is vulnerable to SQL injection in the login form. You successfully extract the password hash of a service account. What is the most appropriate next step to gain initial access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.