You have established persistence on a domain controller by modifying the AdminSDHolder ACL. To avoid detection, which additional action is most effective?

Clear the PowerShell operational log

Create a new domain admin account for backup access

Use a legitimate administrative tool like PowerShell to make the change

Disable the Windows Event Log service

You are on an engagement where the client's security team has implemented egress filtering that only allows DNS and SMB traffic to specific internal servers. You need to exfiltrate a large database file. The client has also deployed a SIEM that alerts on unusual DNS query patterns. Which approach best balances stealth and effectiveness?

Send the data via email to an external address

Upload the data to a public cloud storage service via HTTPS

Use DNS tunneling with a custom encoding scheme and limit query rate to avoid pattern detection

Copy the data to an internal SMB share and leave it there

You have compromised a workstation in a corporate network and need to exfiltrate sensitive documents. The environment has strict egress filtering that only allows DNS and HTTPS traffic to external destinations. You want to avoid detection by the security team. Which exfiltration method is most appropriate?

Upload the files to a public SMB share on the internet.

Use an unencrypted HTTP POST to a web server you control.

Email the files to an external address using the corporate mail server.

Encode the data and send it in DNS queries to a domain you control.

You need to exfiltrate a large amount of data from a Windows domain. The security team monitors outbound traffic and flags large transfers. Which method is most likely to avoid detection?

Send the data via email in a single attachment

Copy the data to an internal SMB share

Upload the data to a cloud storage service via HTTPS

Split the data into small chunks and send via DNS queries

GIAC Red Team Professional

Domain 3Objective 3

Persistence and Exfiltration GRTP Practice Questions (Page 2)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

3concepts

Questions 6–10

6application · medium
You have established persistence on a domain controller by modifying the AdminSDHolder ACL. To avoid detection, which additional action is most effective?
Select an answer first
7foundation · easy
Which detection evasion technique involves altering file timestamps to make malicious files appear as if they were created during a legitimate software installation?
Select an answer first
8expert · hard
You are on an engagement where the client's security team has implemented egress filtering that only allows DNS and SMB traffic to specific internal servers. You need to exfiltrate a large database file. The client has also deployed a SIEM that alerts on unusual DNS query patterns. Which approach best balances stealth and effectiveness?
Select an answer first
9application · medium
You have compromised a workstation in a corporate network and need to exfiltrate sensitive documents. The environment has strict egress filtering that only allows DNS and HTTPS traffic to external destinations. You want to avoid detection by the security team. Which exfiltration method is most appropriate?
Select an answer first
10application · medium
You need to exfiltrate a large amount of data from a Windows domain. The security team monitors outbound traffic and flags large transfers. Which method is most likely to avoid detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Persistence and Exfiltration GRTP Practice Questions (Page 2)

Questions 6–10

You have established persistence on a domain controller by modifying the AdminSDHolder ACL. To avoid detection, which additional action is most effective?

Which detection evasion technique involves altering file timestamps to make malicious files appear as if they were created during a legitimate software installation?

You need to exfiltrate a large amount of data from a Windows domain. The security team monitors outbound traffic and flags large transfers. Which method is most likely to avoid detection?

Keep studying — Active Directory Attacks and Post-Exploitation