Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When prioritizing findings for remediation, which factor should be considered alongside the severity of the vulnerability?

   • AThe color scheme of the report
   • BThe name of the vulnerability scanner used
   • CThe likelihood of exploitation
   • DThe number of pages in the report
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A red team found three vulnerabilities during an engagement: a critical remote code execution on an internet-facing server, a medium-severity misconfiguration in an internal application, and a low-severity information disclosure in a public-facing document. The client has limited remediation resources. How should the red team prioritize these findings in the report?

   • APrioritize by severity only, listing the critical RCE first, then the medium, then the low.
   • BPrioritize by a combination of severity, likelihood of exploitation, and business impact, placing the RCE at the top.
   • CPrioritize by ease of remediation, fixing the low-severity issue first because it is quickest.
   • DList all findings alphabetically so the client can decide which to fix first.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A red team engagement has ended. The team has delivered the final report and is now conducting a lessons-learned session with the client. Which activity is most appropriate for this session?

   • ADiscuss what went well and what could be improved in the engagement process, and capture action items for future engagements.
   • BRe-test all the vulnerabilities to confirm they still exist.
   • CDelete all logs and evidence to protect the client's privacy.
   • DReview the final report in detail and argue about the severity ratings.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A red team is planning an engagement that requires a custom tool to emulate a specific attacker technique. The team has limited budget and must decide whether to develop the tool in-house or purchase a commercial tool. The commercial tool is expensive but well-supported, while the in-house tool would take time to develop but would be tailored to the client's environment. Which decision best balances cost, time, and effectiveness?

   • ADevelop the in-house tool because it will be tailored to the client's environment.
   • BPurchase the commercial tool because it is well-supported and saves development time.
   • CSkip the custom tool and use a generic tool that approximates the technique.
   • DEvaluate whether the commercial tool can be configured to meet the requirement; if not, develop a minimal in-house tool.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A red team is about to start an engagement. The client has designated a single point of contact (SPOC) for all communication. During the engagement, the red team discovers a critical issue that requires immediate action. What is the most appropriate communication step?

   • AContact the SPOC immediately and provide a preliminary summary of the issue.
   • BPost the details on a public forum to get community advice.
   • CWait for the next scheduled status meeting to discuss the issue.
   • DContact the client's CEO directly to ensure the issue is escalated.
   Reveal Solution Discussion Select an answer first