A red team has gained access to a Windows server that runs a legacy application. The team wants to identify installed software and services that may have known vulnerabilities. Which method is most appropriate?

Query the Windows registry and use `wmic` to enumerate installed programs and services, then compare versions against vulnerability databases.

Run a vulnerability scanner like OpenVAS from the compromised host against the local machine.

Use `netstat -ano` to list open ports and running processes, then guess the software versions.

Check the Windows Event Log for application errors that might indicate vulnerable versions.

A red teamer wants to phish a high-level executive who frequently posts on LinkedIn about industry events. The goal is to obtain the executive's credentials without triggering email security filters. Which phishing technique is most appropriate?

Spear phishing with a personalized email referencing a recent conference the executive attended, containing a link to a fake login page.

Whaling with a generic email that appears to be from the CEO asking for urgent wire transfer.

Vishing by calling the executive's office and pretending to be IT support requesting a password reset.

Phishing with a mass email that includes a malicious attachment disguised as an event agenda.

You have compromised a file server that contains sensitive project documents. Your objective is to exfiltrate data without being detected by data loss prevention (DLP) systems that monitor outbound traffic. Which approach is most likely to avoid detection?

Send the files via email to an external account

Compress and encrypt the data, then exfiltrate in small chunks over DNS queries

Upload the files to a public cloud storage service using HTTPS

Copy the files to a USB drive attached to the server

An attacker exploits a SQL injection vulnerability in a public-facing web application to gain a foothold. Which initial access vector category does this represent?

Exploitation of public-facing applications

A red teamer wants to phish a group of employees in the finance department. The team has obtained a list of their email addresses and knows they frequently use a specific internal expense reporting system. Which phishing technique is most likely to succeed?

Spear phishing with an email that appears to be from the expense system, asking employees to verify their account by clicking a link to a fake login page.

Whaling with an email to the CFO asking for a wire transfer.

Vishing by calling each employee and pretending to be from IT support.

Mass phishing with a generic email about a fake package delivery.

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 4)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 16–20

16application · medium
A red team has gained access to a Windows server that runs a legacy application. The team wants to identify installed software and services that may have known vulnerabilities. Which method is most appropriate?
Select an answer first
17application · medium
A red teamer wants to phish a high-level executive who frequently posts on LinkedIn about industry events. The goal is to obtain the executive's credentials without triggering email security filters. Which phishing technique is most appropriate?
Select an answer first
18expert · hard
You have compromised a file server that contains sensitive project documents. Your objective is to exfiltrate data without being detected by data loss prevention (DLP) systems that monitor outbound traffic. Which approach is most likely to avoid detection?
Select an answer first
19foundation · easy
An attacker exploits a SQL injection vulnerability in a public-facing web application to gain a foothold. Which initial access vector category does this represent?
Select an answer first
20application · medium
A red teamer wants to phish a group of employees in the finance department. The team has obtained a list of their email addresses and knows they frequently use a specific internal expense reporting system. Which phishing technique is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.