Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A red team is negotiating the rules of engagement with a client. The client wants the red team to avoid any activity that could be detected by their security operations center (SOC) because they want to test the SOC's response capabilities. However, the client also wants the red team to provide real-time alerts if they are about to take an action that could cause significant damage. How should the red team incorporate these conflicting requirements into the RoE?

   • ADefine specific actions that require a pre-approval or alert, while allowing all other actions to proceed without notification.
   • BProvide real-time alerts for all actions, which will inevitably reveal the red team's presence to the SOC.
   • CAgree to avoid detection but do not provide real-time alerts, as that would reveal the red team's presence.
   • DRefuse the engagement unless the client removes the real-time alert requirement.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A red team engagement plan includes a test that could trigger a denial-of-service condition on a critical public-facing application. The client has approved the test but requires that the application remain available to customers. Which risk mitigation approach is most appropriate?

   • APerform the test in a staging environment that mirrors the production application.
   • BPerform the test on production without any additional precautions because the client approved it.
   • CPerform the test on production but only during off-peak hours.
   • DPerform the test on production and have a rollback plan ready.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which resource is essential for a red team engagement to simulate realistic attack scenarios?

   • AA set of commercial penetration testing tools
   • BA high-performance server for running automated scans
   • CSkilled personnel with diverse expertise in offensive security
   • DA dedicated testing lab with production-like systems
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a red team engagement, the red team discovers a critical vulnerability in a legacy application that the client's IT team is actively migrating to a new platform. The red team lead needs to communicate this finding to the client. Which approach is most appropriate?

   • AWait until the final report is delivered to avoid disrupting the client's migration project.
   • BImmediately notify the client's designated emergency contact and provide a preliminary summary, then include full details in the final report.
   • CDiscuss the finding only with the IT team lead and omit it from the final report to protect the client's reputation.
   • DSend the full technical details to the entire IT team to ensure everyone is aware of the issue.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A red team is preparing the final report for an engagement. The client's executive team wants a clear picture of the overall risk posture, while the technical team needs detailed findings to remediate. The report must also be usable for a board presentation. Which report structure best meets these needs?

   • AProvide only an executive summary with a risk score and no technical details.
   • BCreate a single report that combines executive and technical content in one continuous narrative.
   • CStart with an executive summary that includes a risk heat map, followed by detailed technical findings and a remediation roadmap.
   • DProvide only a technical report with detailed findings and no executive summary.
   Reveal Solution Discussion Select an answer first