Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A red team has documented a finding that involves a vulnerability in a custom web application. The team has evidence of exploitation, but the client's developers are unsure how to reproduce it. What should the red team include in the finding documentation to help the developers?

   • AOnly a high-level description of the vulnerability, since the developers can figure out the details.
   • BA step-by-step reproduction guide, including the exact requests and conditions needed to trigger the vulnerability.
   • CThe raw network traffic logs without any explanation.
   • DA recommendation to replace the custom application with a commercial product.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A red team lead is drafting the engagement plan for a financial client. The client insists that the red team must not use phishing against employees because of a recent insider-threat incident, but the client still wants to test the effectiveness of email security controls. The red team lead needs to incorporate this constraint into the plan. Which action best aligns the engagement plan with the client's requirement?

   • AInclude a simulated phishing campaign but only against a small, pre-approved group of security staff.
   • BRemove all email-based attack simulations from the scope and document the exclusion in the rules of engagement.
   • CReplace employee-targeted phishing with a technical test of the email gateway using a controlled, non-delivered malicious attachment.
   • DProceed with the phishing simulation and note in the final report that the client requested it despite the constraint.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A red team is planning an engagement for a financial services client. The client's compliance team has mandated that no real customer data may be accessed or exfiltrated during the test, even if the red team successfully compromises a database server. The red team lead is drafting the rules of engagement (RoE). Which action best addresses this requirement?

   • AInclude a clause in the RoE that prohibits accessing or copying customer data and requires the team to use synthetic data or stop testing if real data is encountered.
   • BNote in the RoE that customer data access is permitted if the team documents it as a finding.
   • CAdd a technical control in the RoE that automatically redacts any customer data before it reaches the red team's logging system.
   • DState in the RoE that the red team will avoid all database servers to prevent any possibility of accessing customer data.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary purpose of the recommendations section in a red team engagement report?

   • ATo summarize the rules of engagement and scope of the test
   • BTo list the names of all red team members and their qualifications
   • CTo provide a detailed log of every action taken by the red team
   • DTo offer actionable steps to remediate the identified vulnerabilities and improve security posture
   Reveal Solution Discussion Select an answer first