You have compromised a service account that runs a critical application and need to maintain access to a specific file server without re-authenticating. You want to avoid using the KRBTGT account to minimize detection. Which technique is most appropriate?

Modify the AdminSDHolder ACL to grant the service account full control

Use SID History injection to add the service account to the Domain Admins group

Forge a Silver Ticket for the file server's CIFS service using the service account's hash

Create a Golden Ticket using the KRBTGT hash

You have established persistence on a domain controller and need to exfiltrate data without being detected. Which combination of actions is most effective?

Use HTTPS to upload data and disable the firewall

Use email to send data and modify timestamps on the email server

Use DNS tunneling for exfiltration and clear the DNS server logs

Use SMB shares to move data and clear the Security log

You need to exfiltrate data from a compromised machine in a network that has strict egress filtering, allowing only DNS and HTTPS. You want to avoid detection by the security team. Which exfiltration method is most appropriate?

Use HTTP to POST data to a web server.

Use DNS tunneling to encode data in DNS queries.

Use SMB to copy files to an external share.

Use FTP to upload files to an external server.

GIAC Red Team Professional

Domain 3Objective 3

Persistence and Exfiltration GRTP Practice Questions (Page 1)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

3concepts

Questions 1–5

1foundation · easy
Which Active Directory persistence technique involves forging a Kerberos Ticket Granting Ticket (TGT) using the hash of the krbtgt account to gain domain-wide access?
Select an answer first
2application · medium
You have compromised a service account that runs a critical application and need to maintain access to a specific file server without re-authenticating. You want to avoid using the KRBTGT account to minimize detection. Which technique is most appropriate?
Select an answer first
3foundation · easy
Which data exfiltration technique encodes data into DNS queries and responses to bypass network egress controls?
Select an answer first
4application · medium
You have established persistence on a domain controller and need to exfiltrate data without being detected. Which combination of actions is most effective?
Select an answer first
5application · medium
You need to exfiltrate data from a compromised machine in a network that has strict egress filtering, allowing only DNS and HTTPS. You want to avoid detection by the security team. Which exfiltration method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Persistence and Exfiltration GRTP Practice Questions (Page 1)

Questions 1–5

Which Active Directory persistence technique involves forging a Kerberos Ticket Granting Ticket (TGT) using the hash of the krbtgt account to gain domain-wide access?

You have compromised a service account that runs a critical application and need to maintain access to a specific file server without re-authenticating. You want to avoid using the KRBTGT account to minimize detection. Which technique is most appropriate?

Which data exfiltration technique encodes data into DNS queries and responses to bypass network egress controls?

You have established persistence on a domain controller and need to exfiltrate data without being detected. Which combination of actions is most effective?

You need to exfiltrate data from a compromised machine in a network that has strict egress filtering, allowing only DNS and HTTPS. You want to avoid detection by the security team. Which exfiltration method is most appropriate?

Keep studying — Active Directory Attacks and Post-Exploitation