Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A red team is planning an engagement that requires the use of a specific exploit framework. The team's lead is concerned about the tool's stability and the potential for it to crash target systems. Which action is most appropriate to mitigate this risk?

   • ARemove the exploit framework from the engagement plan and rely on manual techniques.
   • BUse the exploit framework only on non-critical systems during the engagement.
   • CInclude a clause in the RoE that the client accepts all risk of system crashes.
   • DTest the exploit framework in a lab environment that mirrors the target environment before the engagement.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a red team engagement, the team identifies two findings: one allows unauthenticated remote code execution on a public-facing server, and another allows an authenticated user to view another user's profile data. Which finding should be prioritized for remediation?

   • AThe unauthenticated remote code execution, because it has higher impact and is more likely to be exploited.
   • BThe authenticated data exposure, because it is easier to fix.
   • CThe authenticated data exposure, because it involves sensitive personal data.
   • DBoth findings should be prioritized equally, regardless of severity.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During the planning phase of a red team engagement, which stakeholder is most likely to provide critical information about system architecture and potential impact of testing?

   • AThe Chief Executive Officer (CEO)
   • BThe public relations department
   • CThe system and network administrators
   • DThe external auditor
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A red team engagement has concluded, and the final report has been delivered. The client's security team wants to know what the red team learned about the client's detection capabilities. Which post-engagement activity is most appropriate for sharing this insight?

   • AProvide the client with the raw logs and let them analyze the red team's activities.
   • BConduct a separate debrief meeting focused on the red team's observations and recommendations.
   • CInclude a section in the final report that describes the red team's observations about detection and response capabilities.
   • DDo not share observations because they are internal to the red team.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which component of a red team engagement plan defines the specific systems, networks, and facilities that the red team is permitted to test?

   • ARules of Engagement
   • BScope
   • CObjectives
   • DTimeline
   Reveal Solution Discussion Select an answer first