A red team has compromised a standard user account in an Active Directory environment. The team wants to escalate to Domain Admin. The environment has a mature security posture with monitoring for unusual logon events and account lockouts. Which approach is most likely to succeed while minimizing detection?

Use BloodHound to identify an ACL-based attack path, such as GenericAll on a privileged group, and then modify group membership using a controlled PowerShell command.

Enumerate all domain users and groups to manually identify which accounts are in the Domain Admins group, then brute force one of those accounts.

Dump the SAM database from the compromised host and crack local admin hashes to reuse them on other hosts.

Perform a password spraying attack against all domain users with a few common passwords to find a service account with elevated privileges.

Which of the following is a common initial access vector that involves tricking a user into opening a malicious attachment?

Exploitation of public-facing application

A red team is assessing a web application that is behind a Web Application Firewall (WAF). The team has identified a SQL injection vulnerability in a search parameter, but the WAF blocks common SQL injection payloads. The team wants to gain access to the backend database. Which approach is most likely to succeed?

Perform a full port scan of the web server to find other services that may be vulnerable.

Use a known exploit for the web server's operating system to gain direct access.

Use an obfuscated SQL injection payload that bypasses the WAF's signature-based detection, such as using inline comments or encoding.

Send a large number of SQL injection payloads to overwhelm the WAF and cause it to fail open.

A red team has gained access to a low-privileged domain account and wants to escalate privileges. The team discovers that the domain has a large number of users and that many accounts have not changed their passwords in years. Which technique is most likely to yield a higher-privileged account?

Enumerate all domain users and groups to identify which accounts are members of the Domain Admins group.

Perform a password spraying attack using common passwords against all domain users, including service accounts.

Dump the local SAM database from the compromised host to extract password hashes.

Use a brute force attack against the domain administrator account with a wordlist of common passwords.

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 6)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 26–30

26expert · hard
A red team has compromised a standard user account in an Active Directory environment. The team wants to escalate to Domain Admin. The environment has a mature security posture with monitoring for unusual logon events and account lockouts. Which approach is most likely to succeed while minimizing detection?
Select an answer first
27foundation · easy
Which of the following is a common initial access vector that involves tricking a user into opening a malicious attachment?
Select an answer first
28expert · hard
A red team is assessing a web application that is behind a Web Application Firewall (WAF). The team has identified a SQL injection vulnerability in a search parameter, but the WAF blocks common SQL injection payloads. The team wants to gain access to the backend database. Which approach is most likely to succeed?
Select an answer first
29application · medium
A red team has gained access to a low-privileged domain account and wants to escalate privileges. The team discovers that the domain has a large number of users and that many accounts have not changed their passwords in years. Which technique is most likely to yield a higher-privileged account?
Select an answer first
30foundation · easy
During discovery, which type of data would an attacker most likely prioritize for collection to prepare for exfiltration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 6)

Questions 26–30

Which of the following is a common initial access vector that involves tricking a user into opening a malicious attachment?

A red team has gained access to a low-privileged domain account and wants to escalate privileges. The team discovers that the domain has a large number of users and that many accounts have not changed their passwords in years. Which technique is most likely to yield a higher-privileged account?

During discovery, which type of data would an attacker most likely prioritize for collection to prepare for exfiltration?

Keep studying — Initial Access and Discovery