GIAC GRTP Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Red Team Professional (GRTP) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GRTP certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GRTP Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Red Team Professional (GRTP) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Red Team Professional exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GRTP Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GRTP Sample Questions:
01. A red team is planning the impact demonstration for a ransomware-actor emulation. Which three actions keep the demonstration within a responsible, examinable approach?
(Choose three.)
a) Delete the client's backups first, so the test cannot be trivially undone
b) Encrypt live production shares so the impact is undeniable
c) Coordinate through the agreed deconfliction channel so blue can tell it from a real incident
d) Keep the demonstration reversible and bounded by the rules of engagement
e) Demonstrate the capability on client-provisioned test data rather than production data
02. While staging data for the exfiltration objective, the team encounters a folder of regulated personal records that are clearly outside what the objective requires.
Under typical rules of engagement, how should the team handle this discovery?
a) Delete it to demonstrate the impact of a destructive actor
b) Copy it to the team's infrastructure but omit it from the report
c) Exfiltrate it too, since it proves deeper access and strengthens the report
d) Leave it in place and handle it per the RoE's data-handling agreement, taking only what the objective requires
03. Incident responders reset the passwords of every account the red team is known to have touched. The team nonetheless retains authenticated access to the domain afterward.
Which persistence approach best explains surviving a domain-wide password reset?
a) Persistence via an issued certificate, which continues to authenticate after a password change
b) A scheduled task that re-runs the payload at each startup
c) A registry run key that relaunches the C2 beacon on each boot
d) A hidden local user account created earlier, whose password was reset along with every other account the team touched
04. The engagement objective is to prove a specific customer database could be reached and its contents taken. The team already has code execution on a server that can query that database.
Which two actions most directly advance this objective while staying disciplined?
(Choose two.)
a) Access the database and stage a bounded, representative extract for controlled exfiltration
b) Begin compromising every other subnet for breadth before touching the database
c) Document the access path so the finding is reproducible in the engagement report
d) Escalate to domain admin first, even though the current access already reaches the database
05. To reach a database server on an isolated subnet that the operator's foothold cannot route to directly, the team relays its traffic through an already-compromised host that can reach that subnet.
What is this technique, and where does it operate?
a) Domain fronting, disguising the traffic's destination as a trusted domain
b) DNS tunneling, encoding the session inside name-resolution queries
c) Pivoting, relaying through a compromised internal host to reach an otherwise-unreachable segment
d) Redirection, which operates on the team's own external infrastructure to conceal the C2 server's address
06. A defender is mapping lateral-movement techniques to the primary host artifact each one leaves, in order to prioritise logging. Which three pairings correctly match a movement class to its characteristic artifact?
(Choose three.)
a) WMI execution leaves a new service in the service database
b) Scheduled-task movement leaves a newly registered task
c) DCOM invocation leaves a new scheduled task in the task store
d) PsExec-style service creation leaves a new service and service-control events
e) Remoting over WinRM leaves a remoting session log
07. Preparing the report, an operator wants to append two things 'for completeness': a full dump of the blue team's internal security-tool configuration, and the addresses and credentials of the red team's own C2 infrastructure.
How should the report handle these two additions?
a) Include the blue team configuration but exclude the red team infrastructure, to help defenders
b) Exclude both: the client's internal tool inventory is not a finding, and the team's own infrastructure secrets do not belong in a client deliverable
c) Exclude the blue team configuration but include the red team infrastructure, for reproducibility
d) Include both, since a thorough report should document every artifact the team encountered and preserve each one in an appendix for the client's permanent records
08. Beyond the exploited vulnerabilities themselves, a team wants the report to capture what the exercise revealed about the defenders' performance over time. Which two elements best capture that?
(Choose two.)
a) A record of what was and was not detected, that is, the detection gaps
b) The red team's private C2 infrastructure credentials
c) The blue team's internal security-tool version inventory
d) The attack timeline showing when each action occurred
09. Cyber threat intelligence offers a well-documented actor, but that actor historically steals a data type the client does not hold, while the client's real concern is a different high-value asset.
How should the emulation plan reconcile this?
a) Switch to whichever actor's objective happens to match the client's asset, no matter how irrelevant that actor is to the client's threat model
b) Drop the actor entirely and run an unstructured test aimed only at the high-value asset
c) Retain the actor's techniques and tradecraft but redirect them at the client's actual high-value asset
d) Emulate the actor's original objective anyway, since fidelity to the actor outranks the client's concern
10. A team's only foothold is a beacon that reconnects to its C2 after reboot by way of a registry run key. The blue team blocks the C2 domain at the perimeter. The run key still executes on the next reboot, yet the team loses all access.
What does this outcome show about that persistence mechanism?
a) The run key failed, because a working run key would bypass any perimeter block
b) The run key preserves execution on the host, but access also depends on the C2 channel remaining reachable
c) Persistence is unaffected by network controls, so the loss of access must be unrelated
d) The mechanism escalated privilege, which perimeter blocks always revoke
Answers:
|
Question: 01 Answer: c, d, e |
Question: 02 Answer: d |
Question: 03 Answer: a |
Question: 04 Answer: a, c |
Question: 05 Answer: c |
|
Question: 06 Answer: b, d, e |
Question: 07 Answer: b |
Question: 08 Answer: a, d |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: For any error in GIAC Red Team Professional (GRTP) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
