You need to exfiltrate a large database from a compromised server in a segmented network. The only allowed outbound protocol is HTTPS, and you want to avoid detection by using encryption. Which exfiltration method is most appropriate?

Upload the database to a cloud storage service using HTTPS.

Send the data in chunks over an encrypted HTTPS connection to a web server you control.

Copy the data to an SMB share on the same network and later retrieve it.

Use DNS tunneling to send the data in DNS queries.

You have compromised a workstation in a corporate network and need to exfiltrate a large database file. The security team monitors outbound HTTP/HTTPS traffic and blocks large file transfers, but DNS queries are not inspected. Which exfiltration method is most appropriate?

Encode the file and send it in chunks as DNS TXT queries to a domain you control

Upload the file to a public cloud storage service via HTTPS

Copy the file to a network share on a compromised server

Send the file via encrypted email to an external address

GIAC Red Team Professional

Domain 3Objective 3

Persistence and Exfiltration GRTP Practice Questions (Page 3)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

3concepts

Questions 11–15

11foundation · easy
Which detection evasion technique involves removing or altering event logs to hide the actions performed during an attack?
Select an answer first
12foundation · easy
Which Active Directory persistence technique involves modifying the security descriptor of the AdminSDHolder object so that the changes propagate to all protected groups?
Select an answer first
13application · medium
You need to exfiltrate a large database from a compromised server in a segmented network. The only allowed outbound protocol is HTTPS, and you want to avoid detection by using encryption. Which exfiltration method is most appropriate?
Select an answer first
14foundation · easy
Which exfiltration method uses an existing SMB share on a compromised host to stage data before transferring it out of the network?
Select an answer first
15application · medium
You have compromised a workstation in a corporate network and need to exfiltrate a large database file. The security team monitors outbound HTTP/HTTPS traffic and blocks large file transfers, but DNS queries are not inspected. Which exfiltration method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Persistence and Exfiltration GRTP Practice Questions (Page 3)

Questions 11–15

Which detection evasion technique involves removing or altering event logs to hide the actions performed during an attack?

Which Active Directory persistence technique involves modifying the security descriptor of the AdminSDHolder object so that the changes propagate to all protected groups?

You need to exfiltrate a large database from a compromised server in a segmented network. The only allowed outbound protocol is HTTPS, and you want to avoid detection by using encryption. Which exfiltration method is most appropriate?

Which exfiltration method uses an existing SMB share on a compromised host to stage data before transferring it out of the network?

You have compromised a workstation in a corporate network and need to exfiltrate a large database file. The security team monitors outbound HTTP/HTTPS traffic and blocks large file transfers, but DNS queries are not inspected. Which exfiltration method is most appropriate?

Keep studying — Active Directory Attacks and Post-Exploitation