You have compromised a Linux server in a cloud environment. The security team uses network flow logs to detect scanning activity. You need to identify other hosts and services on the internal VPC without triggering alerts. Which scanning strategy is most likely to avoid detection?

Use a TCP connect scan with source IP spoofing

Run a fast full-port scan of the entire VPC CIDR

Use a UDP scan of all ports on a few hosts

Perform a slow, low-rate SYN scan of a few common ports across a small IP range

A red team has established a foothold on a Linux server in a DMZ. The team wants to identify active hosts and services on the internal network without being detected by the security operations center (SOC). Which approach is most appropriate?

Use passive network monitoring by capturing traffic on the compromised server's network interface to identify internal hosts and services.

Query the DNS server for all internal hostnames to build a list of active systems.

Perform a TCP connect scan of the entire internal subnet using Nmap to enumerate open ports.

Use ARP scanning to identify active hosts on the local subnet.

A red team has compromised a Linux server in a cloud environment. The team wants to identify other internal hosts and services, but the environment uses network security groups (NSGs) that restrict traffic between subnets. The team has credentials for a service account that can read NSG rules. Which approach is most effective?

Use passive network monitoring on the compromised server to capture traffic and identify hosts, ignoring NSG rules.

Perform a full port scan of all internal IP ranges to find any host that responds, regardless of NSG rules.

Enumerate all cloud resources using the service account's read permissions to list virtual machines and their IP addresses.

Use the cloud provider's API to query NSG rules and identify which subnets can communicate, then target those subnets with a limited port scan.

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 8)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 36–40

36expert · hard
You have compromised a Linux server in a cloud environment. The security team uses network flow logs to detect scanning activity. You need to identify other hosts and services on the internal VPC without triggering alerts. Which scanning strategy is most likely to avoid detection?
Select an answer first
37application · medium
A red team has established a foothold on a Linux server in a DMZ. The team wants to identify active hosts and services on the internal network without being detected by the security operations center (SOC). Which approach is most appropriate?
Select an answer first
38foundation · easy
Which of the following is a common vulnerability that attackers exploit in public-facing web applications to gain initial access?
Select an answer first
39expert · hard
A red team has compromised a Linux server in a cloud environment. The team wants to identify other internal hosts and services, but the environment uses network security groups (NSGs) that restrict traffic between subnets. The team has credentials for a service account that can read NSG rules. Which approach is most effective?
Select an answer first
40foundation · easy
Which command would an attacker use on a Windows system to enumerate all local user accounts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 8)

Questions 36–40

You have compromised a Linux server in a cloud environment. The security team uses network flow logs to detect scanning activity. You need to identify other hosts and services on the internal VPC without triggering alerts. Which scanning strategy is most likely to avoid detection?

A red team has established a foothold on a Linux server in a DMZ. The team wants to identify active hosts and services on the internal network without being detected by the security operations center (SOC). Which approach is most appropriate?

Which of the following is a common vulnerability that attackers exploit in public-facing web applications to gain initial access?

Which command would an attacker use on a Windows system to enumerate all local user accounts?

Keep studying — Initial Access and Discovery