Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During a red team engagement, the red team discovers a critical vulnerability in a legacy system that the client's IT team is actively migrating. The red team lead needs to communicate this finding to the client without disrupting the engagement or causing panic. Which communication approach is most appropriate?

   • ANotify the designated emergency contact from the rules of engagement and provide a concise, actionable summary.
   • BPost the finding on the internal wiki so all teams can access it at their convenience.
   • CImmediately email the entire IT department with the technical details and recommended fixes.
   • DWait until the final report to disclose the finding, as the engagement is still ongoing.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is typically included in the rules of engagement (RoE) for a red team engagement?

   • AThe authorization boundaries, such as prohibited actions and emergency stop conditions
   • BThe names of all red team operators and their roles
   • CThe specific IP addresses and domains that are in scope
   • DThe detailed exploitation techniques to be used against each target
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A red team is planning a two-week engagement for a client with a complex, multi-site network. The team has a limited budget and must decide how to allocate resources. Which resource allocation is most likely to ensure the engagement meets its objectives?

   • AReduce the scope of the engagement to only one site to save money, even if it no longer meets the client's objectives.
   • BPrioritize personnel with the right skills for the engagement's objectives, and allocate tools and travel budget based on the sites that are in scope.
   • CAssign the most junior team members to the engagement to keep costs low and free up senior staff for other projects.
   • DSpend most of the budget on the most expensive commercial tools to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A red team is writing the final report for an engagement. The client's legal team has requested that the report avoid including specific exploit code and instead focus on the business impact. The technical team, however, wants the exploit details for remediation. How should the red team structure the report to satisfy both parties?

   • AInclude the exploit code in the main body of the report and summarize the business impact in the executive summary.
   • BProvide two separate reports: one with exploit details for the technical team and one with business impact for legal.
   • CPlace the exploit details in a technical appendix marked as confidential and keep the main report focused on business impact.
   • DExclude all exploit details and provide only business impact and recommendations.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A red team is planning an engagement for a multinational client with operations in the EU and the US. The client wants to test both regions, but the EU legal team has imposed strict data-handling rules that prohibit any test data from leaving the EU. The red team's primary infrastructure is hosted in the US. The engagement timeline is tight, and the client wants a single coordinated test. Which approach best satisfies the legal constraint while achieving the client's objective?

   • ARun the EU portion from US-based infrastructure and ensure that no test data is stored after the test.
   • BCancel the EU portion of the test and focus only on the US operations.
   • CDeploy a temporary red team infrastructure within the EU for the EU portion and use US infrastructure only for the US portion.
   • DRun the entire engagement from the US and have the EU legal team approve a data-transfer exception.
   Reveal Solution Discussion Select an answer first