Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After completing a red team engagement, the lead analyst is preparing the final report. The client's executive team wants a high-level overview, while the technical staff needs detailed remediation steps. Which report structure best satisfies both audiences?

   • AProvide a single technical report with all details, including exploit code and network diagrams.
   • BCreate an executive summary for leadership and a separate technical appendix for the IT staff.
   • CSend the full report only to the IT staff and let them summarize it for the executives.
   • DWrite a short report with only the executive summary and no technical details.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which activity is typically performed during the post-engagement phase of a red team operation?

   • ADeveloping the rules of engagement
   • BConducting a lessons-learned review with the red team and stakeholders
   • CIdentifying the scope of the engagement
   • DExecuting the attack scenarios
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of risk management in red team engagement planning?

   • ATo ensure the red team uses the most advanced exploitation techniques
   • BTo identify, assess, and mitigate potential negative outcomes that could impact the organization or the engagement
   • CTo guarantee that no systems are disrupted during testing
   • DTo maximize the number of findings in the final report
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of the rules of engagement (RoE) in a red team operation?

   • ATo provide a detailed schedule of when each attack phase will occur
   • BTo list the names and contact information of all personnel involved in the engagement
   • CTo define the technical tools and techniques the red team will use
   • DTo establish the boundaries and constraints within which the red team must operate, including authorized targets and permissible actions
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A red team is planning an engagement that involves social engineering, including phishing and phone calls. The client is concerned about the risk of an employee falling for the phishing and causing a real security incident. The red team lead must balance realism with safety. Which mitigation is most appropriate?

   • AConduct the social engineering test without any safeguards to ensure maximum realism.
   • BMake the phishing emails so obvious that no employee would fall for them.
   • CCancel the social engineering portion of the engagement to eliminate all risk.
   • DInclude a 'safe word' or code phrase in the phishing emails that employees can use to verify the email is part of the test, and ensure the RoE includes a clear process for stopping the test if an employee reports a real incident.
   Reveal Solution Discussion Select an answer first