You have gained initial access to a Windows workstation in a corporate network. Your objective is to map the domain structure and identify high-value targets. Which discovery technique should you prioritize first?

Search for sensitive files on the local disk

Dump local password hashes from the workstation

Enumerate domain users and groups using built-in Windows commands

Run a full port scan of the entire internal network

A red team has compromised a Windows domain-joined workstation with a low-privileged user account. The team wants to identify potential privilege escalation paths by understanding the domain structure. Which technique is most effective?

Use BloodHound to collect domain object relationships and analyze paths to high-value targets like Domain Admins.

Use `net user /domain` to list all domain users and then manually guess which ones are admins.

Run `whoami /priv` to check for enabled privileges on the current user token.

Enumerate all local users and groups on the compromised workstation to find local admin accounts.

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 5)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 21–25

21foundation · easy
An attacker tries a few common passwords (e.g., 'Password123', 'Summer2024') against many user accounts to avoid account lockouts. Which technique is this?
Select an answer first
22application · medium
You have gained initial access to a Windows workstation in a corporate network. Your objective is to map the domain structure and identify high-value targets. Which discovery technique should you prioritize first?
Select an answer first
23foundation · easy
Which tool is commonly used for network scanning and enumeration to identify open ports and services?
Select an answer first
24foundation · easy
Which discovery technique would an attacker use to identify the operating system and running services on a discovered host?
Select an answer first
25application · medium
A red team has compromised a Windows domain-joined workstation with a low-privileged user account. The team wants to identify potential privilege escalation paths by understanding the domain structure. Which technique is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 5)

Questions 21–25

An attacker tries a few common passwords (e.g., 'Password123', 'Summer2024') against many user accounts to avoid account lockouts. Which technique is this?

You have gained initial access to a Windows workstation in a corporate network. Your objective is to map the domain structure and identify high-value targets. Which discovery technique should you prioritize first?

Which tool is commonly used for network scanning and enumeration to identify open ports and services?

Which discovery technique would an attacker use to identify the operating system and running services on a discovered host?

A red team has compromised a Windows domain-joined workstation with a low-privileged user account. The team wants to identify potential privilege escalation paths by understanding the domain structure. Which technique is most effective?

Keep studying — Initial Access and Discovery