After gaining initial access to a Windows workstation, a red teamer wants to map the internal network to identify other hosts and services. The team has a low-privileged account and wants to avoid detection. Which discovery technique is most appropriate?

Use built-in Windows commands like `net view` and `arp -a` to enumerate network shares and active IP addresses.

Run a full port scan with Nmap from the compromised host to identify open ports on all internal hosts.

Use PowerShell to enumerate all domain users and groups from the workstation.

Upload a network scanning tool like masscan to the compromised host and scan the entire internal subnet.

A red team is assessing a company that hosts a web application on a public IP. The team has identified that the application uses an outdated version of Apache Struts, which is vulnerable to remote code execution. The team wants to gain initial access to the internal network. What is the most effective first step?

Scan the internal network from the internet to find other vulnerable hosts before exploiting the web app.

Send a spear phishing email to the web application's administrator to obtain credentials.

Perform a brute force attack on the web application's login page to gain admin access.

Exploit the known Struts vulnerability to execute a command that downloads and runs a reverse shell payload.

You are planning a phishing campaign against a law firm that handles high-profile cases. The firm has implemented DMARC, SPF, and DKIM to prevent email spoofing. You need to deliver a credential-harvesting link to a specific partner. Which approach is most likely to succeed?

Spoof the email address of the firm's CEO using a lookalike domain

Compromise a legitimate email account of a trusted external partner and send the phishing email from that account

Use a free email service to send the phishing email

Send a vishing call instead of an email

A red team is tasked with gaining initial access to a target organization that uses Microsoft 365 and has enabled multi-factor authentication (MFA) for all users. The team has obtained a list of valid employee email addresses from public sources and knows the organization enforces a password policy requiring at least 12 characters. Which approach is most likely to succeed in gaining access to an account?

Send a spear phishing email with a malicious attachment to all employees, hoping one opens it and provides credentials.

Use credential stuffing with passwords from previous breaches, hoping the user reused a password.

Perform a password spraying attack using common passwords against all accounts, then attempt to bypass MFA with push notification fatigue.

Run a brute force attack against a single account using a large wordlist until the correct password is found.

GIAC Red Team Professional

Domain 2Objective 1

Gaining Access GRTP Practice Questions (Page 9)

Part of the Initial Access and Discovery domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 41–45

41application · medium
After gaining initial access to a Windows workstation, a red teamer wants to map the internal network to identify other hosts and services. The team has a low-privileged account and wants to avoid detection. Which discovery technique is most appropriate?
Select an answer first
42application · medium
A red team is assessing a company that hosts a web application on a public IP. The team has identified that the application uses an outdated version of Apache Struts, which is vulnerable to remote code execution. The team wants to gain initial access to the internal network. What is the most effective first step?
Select an answer first
43expert · hard
You are planning a phishing campaign against a law firm that handles high-profile cases. The firm has implemented DMARC, SPF, and DKIM to prevent email spoofing. You need to deliver a credential-harvesting link to a specific partner. Which approach is most likely to succeed?
Select an answer first
44application · medium
A red team is tasked with gaining initial access to a target organization that uses Microsoft 365 and has enabled multi-factor authentication (MFA) for all users. The team has obtained a list of valid employee email addresses from public sources and knows the organization enforces a password policy requiring at least 12 characters. Which approach is most likely to succeed in gaining access to an account?
Select an answer first
45foundation · easy
In an Active Directory environment, which tool or command is commonly used to enumerate domain users and groups?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Gaining Access GRTP Practice Questions (Page 9)

Questions 41–45

After gaining initial access to a Windows workstation, a red teamer wants to map the internal network to identify other hosts and services. The team has a low-privileged account and wants to avoid detection. Which discovery technique is most appropriate?

You are planning a phishing campaign against a law firm that handles high-profile cases. The firm has implemented DMARC, SPF, and DKIM to prevent email spoofing. You need to deliver a credential-harvesting link to a specific partner. Which approach is most likely to succeed?

In an Active Directory environment, which tool or command is commonly used to enumerate domain users and groups?

Keep studying — Initial Access and Discovery