During network enumeration, what does a TCP connect scan (e.g., nmap -sT) do?

Sends a UDP packet to the target port

Sends a SYN packet and waits for a SYN-ACK without completing the handshake

Sends an ICMP echo request to the target

Completes the full TCP three-way handshake

A red team is targeting a company that has recently implemented a security awareness program and enforced MFA for all external logins. The team has a limited budget and cannot use zero-day exploits. The company uses Office 365 and has a public-facing VPN portal. Which combination of techniques is most likely to achieve initial access?

Perform a brute force attack on the Office 365 admin account using a large wordlist.

Exploit a known vulnerability in the VPN portal using a public exploit, and then use the access to reset user passwords.

Use spear phishing with a malicious Office document that downloads a payload, and also perform password spraying against the VPN portal with MFA fatigue.

Send a whaling email to the CEO with a fake Office 365 login page and hope the CEO enters credentials.

A red team is tasked with gaining initial access to a company that has strong endpoint protection and email filtering. The company uses multi-factor authentication (MFA) for all remote access. Which initial access vector is most likely to succeed despite these controls?

Sending a spear phishing email with a malicious attachment

Password spraying against the VPN portal

Exploiting a vulnerability in a public-facing web application

Vishing to obtain a one-time passcode

During a red team exercise, you have gained access to a web server. You need to identify installed software and services that could be exploited for lateral movement. Which enumeration step is most likely to reveal exploitable services?

Enumerate scheduled tasks on the server

Check the ARP cache to identify other hosts on the subnet

Review the web server access logs for suspicious requests

List running services and their versions using system commands

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 3)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
During network enumeration, what does a TCP connect scan (e.g., nmap -sT) do?
Select an answer first
12expert · hard
A red team is targeting a company that has recently implemented a security awareness program and enforced MFA for all external logins. The team has a limited budget and cannot use zero-day exploits. The company uses Office 365 and has a public-facing VPN portal. Which combination of techniques is most likely to achieve initial access?
Select an answer first
13application · medium
A red team is tasked with gaining initial access to a company that has strong endpoint protection and email filtering. The company uses multi-factor authentication (MFA) for all remote access. Which initial access vector is most likely to succeed despite these controls?
Select an answer first
14application · medium
During a red team exercise, you have gained access to a web server. You need to identify installed software and services that could be exploited for lateral movement. Which enumeration step is most likely to reveal exploitable services?
Select an answer first
15foundation · easy
After gaining initial access, which discovery technique would an attacker use to identify other systems on the same network segment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 3)

Questions 11–15

During network enumeration, what does a TCP connect scan (e.g., nmap -sT) do?

A red team is tasked with gaining initial access to a company that has strong endpoint protection and email filtering. The company uses multi-factor authentication (MFA) for all remote access. Which initial access vector is most likely to succeed despite these controls?

During a red team exercise, you have gained access to a web server. You need to identify installed software and services that could be exploited for lateral movement. Which enumeration step is most likely to reveal exploitable services?

After gaining initial access, which discovery technique would an attacker use to identify other systems on the same network segment?

Keep studying — Initial Access and Discovery