After compromising a Linux server in a DMZ, you need to identify other reachable hosts and services on the internal network without being detected by the security operations center (SOC). Which approach best balances stealth and effectiveness?

Use a UDP scan of all ports on a few high-value hosts

Perform a slow, randomized TCP SYN scan of common ports across a limited range of IPs

Run a full connect scan of all 65535 ports on every possible IP address

Ping sweep the entire /8 subnet using ICMP echo requests

You have obtained a list of usernames from a public directory. The target organization uses a password policy that requires 12-character passwords with complexity. You want to test for weak passwords without causing account lockouts. Which method is most appropriate?

Brute force with a wordlist against each account

Password spraying with a few common passwords like 'Winter2024!'

Credential stuffing with passwords from breach dumps

Use a dictionary attack on a single account with a large wordlist

Which of the following is a common method for preparing data for exfiltration during the discovery phase?

Compressing and encrypting the data

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 7)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 31–35

31foundation · easy
An attacker calls a help desk employee, impersonates a remote worker, and requests a password reset. Which phishing method does this describe?
Select an answer first
32application · medium
After compromising a Linux server in a DMZ, you need to identify other reachable hosts and services on the internal network without being detected by the security operations center (SOC). Which approach best balances stealth and effectiveness?
Select an answer first
33foundation · easy
Which of the following is a technique used to gather detailed information about the operating system and installed software on a target host?
Select an answer first
34application · medium
You have obtained a list of usernames from a public directory. The target organization uses a password policy that requires 12-character passwords with complexity. You want to test for weak passwords without causing account lockouts. Which method is most appropriate?
Select an answer first
35foundation · easy
Which of the following is a common method for preparing data for exfiltration during the discovery phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 7)

Questions 31–35

An attacker calls a help desk employee, impersonates a remote worker, and requests a password reset. Which phishing method does this describe?

After compromising a Linux server in a DMZ, you need to identify other reachable hosts and services on the internal network without being detected by the security operations center (SOC). Which approach best balances stealth and effectiveness?

Which of the following is a technique used to gather detailed information about the operating system and installed software on a target host?

You have obtained a list of usernames from a public directory. The target organization uses a password policy that requires 12-character passwords with complexity. You want to test for weak passwords without causing account lockouts. Which method is most appropriate?

Which of the following is a common method for preparing data for exfiltration during the discovery phase?

Keep studying — Initial Access and Discovery