You have compromised a service account that has access to a specific file server. You want to maintain access to that file server without needing to re-authenticate, and you want to avoid detection by using a ticket that is valid for a specific service. Which persistence technique should you use?

Create a Golden Ticket using the krbtgt hash.

Create a Silver Ticket for the file server service using the service account's hash.

Modify the AdminSDHolder object to add the service account to the local Administrators group on the file server.

Inject the SID of the Domain Admins group into the service account.

You have established persistence on a domain controller by creating a new domain admin account. You want to avoid detection by the blue team during routine audits. Which action is most effective for evading detection?

Modify the account's creation timestamp to appear as if it was created months ago.

Add the account to the 'Protected Users' group to avoid Kerberos delegation issues.

Disable the account's logon hours to prevent use outside business hours.

Set the account's password to never expire and disable the 'must change password at next logon' flag.

After installing a persistence mechanism on a domain controller, you want to reduce the chance of immediate detection by the blue team. Which action is most aligned with detection evasion?

Clear the Security event log on the domain controller

Disable the Windows Defender service on the domain controller

Modify the timestamps of the files you created to match surrounding system files

Create a new domain admin account and add it to the Domain Admins group

GIAC Red Team Professional

Domain 3Objective 3

Persistence and Exfiltration GRTP Practice Questions (Page 4)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

3concepts

Questions 16–18

16application · medium
You have compromised a service account that has access to a specific file server. You want to maintain access to that file server without needing to re-authenticate, and you want to avoid detection by using a ticket that is valid for a specific service. Which persistence technique should you use?
Select an answer first
17application · medium
You have established persistence on a domain controller by creating a new domain admin account. You want to avoid detection by the blue team during routine audits. Which action is most effective for evading detection?
Select an answer first
18application · medium
After installing a persistence mechanism on a domain controller, you want to reduce the chance of immediate detection by the blue team. Which action is most aligned with detection evasion?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Persistence and Exfiltration GRTP Practice Questions (Page 4)

Questions 16–18

You have compromised a service account that has access to a specific file server. You want to maintain access to that file server without needing to re-authenticate, and you want to avoid detection by using a ticket that is valid for a specific service. Which persistence technique should you use?

You have established persistence on a domain controller by creating a new domain admin account. You want to avoid detection by the blue team during routine audits. Which action is most effective for evading detection?

After installing a persistence mechanism on a domain controller, you want to reduce the chance of immediate detection by the blue team. Which action is most aligned with detection evasion?

Keep studying — Active Directory Attacks and Post-Exploitation