During a red team exercise, the tester needs to establish initial access to a target organization's network. The organization uses a cloud-based email service and has multi-factor authentication enabled. Which technique is most likely to succeed?

Phish for credentials and bypass MFA using a reverse proxy

Send a malicious attachment that exploits a zero-day in the email client

Perform a password spraying attack against the email service

Use a rogue access point to intercept email credentials

A penetration tester is planning to establish network access to an internal corporate network. Which of the following techniques is commonly used to achieve this initial foothold?

Using a rogue access point to intercept wireless traffic

Spear-phishing with a malicious attachment

Performing a password spray against the domain controller

Exploiting a vulnerability in an internal database server

A penetration tester is conducting an external assessment and has identified a VPN gateway that accepts only pre-shared key authentication. The tester has obtained the pre-shared key through social engineering. What is the most effective next step to establish network access?

Use the pre-shared key to authenticate to the VPN and access internal resources

Perform a man-in-the-middle attack on the VPN handshake

Exploit a known vulnerability in the VPN client software

Attempt to brute-force user credentials on the VPN gateway

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 1

Establishing Network Access GXPN Practice Questions (Page 1)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 6 practice questions to prepare you well beyond it. (estimate)

6questions here

2free pages

1concept

Questions 1–5

1application · medium
During a red team exercise, the tester needs to establish initial access to a target organization's network. The organization uses a cloud-based email service and has multi-factor authentication enabled. Which technique is most likely to succeed?
Select an answer first
2application · easy
During an internal penetration test, a tester has discovered that the network uses a Windows domain with LLMNR enabled. The tester wants to capture NTLMv2 hashes from a user who frequently browses to a non-existent UNC path. Which tool would be most appropriate for this task?
Select an answer first
3foundation · easy
A penetration tester is planning to establish network access to an internal corporate network. Which of the following techniques is commonly used to achieve this initial foothold?
Select an answer first
4application · medium
A penetration tester is conducting an external assessment and has identified a VPN gateway that accepts only pre-shared key authentication. The tester has obtained the pre-shared key through social engineering. What is the most effective next step to establish network access?
Select an answer first
5foundation · easy
During the initial phase of a penetration test, a tester successfully obtains a foothold on a target system by exploiting a vulnerability in an internet-facing web application. Which term best describes this stage of the attack lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Establishing Network Access GXPN Practice Questions (Page 1)

Questions 1–5

During a red team exercise, the tester needs to establish initial access to a target organization's network. The organization uses a cloud-based email service and has multi-factor authentication enabled. Which technique is most likely to succeed?

During an internal penetration test, a tester has discovered that the network uses a Windows domain with LLMNR enabled. The tester wants to capture NTLMv2 hashes from a user who frequently browses to a non-existent UNC path. Which tool would be most appropriate for this task?

A penetration tester is planning to establish network access to an internal corporate network. Which of the following techniques is commonly used to achieve this initial foothold?

A penetration tester is conducting an external assessment and has identified a VPN gateway that accepts only pre-shared key authentication. The tester has obtained the pre-shared key through social engineering. What is the most effective next step to establish network access?

During the initial phase of a penetration test, a tester successfully obtains a foothold on a target system by exploiting a vulnerability in an internet-facing web application. Which term best describes this stage of the attack lifecycle?

Keep studying — Network and Infrastructure Attacks