Free GRTP Practice Questions

Question 1

An ordinary domain user obtains an RC4-encrypted ticket for MSSQLSvc/sql01.corp.example:1433. The SPN belongs to svc_sql, whose account requires Kerberos preauthentication. The operator exports the service ticket for an authorized offline password-recovery test. Which account's password-derived key is the target of that test?

Accepted Answer

svc_sql, the account to which the SPN is registered

Answer

SQL01$, the computer account of the server hosting the service

Answer

KRBTGT, the domain account that protects ticket-granting tickets

Answer

The domain user who requested the ticket

Question 2

A scheduled workstation rebuild removes an HTTPS parent Beacon, and its two SMB children stop checking in. A surviving HTTPS Beacon on the same Cobalt Strike team server can reach both children over TCP 445 and has credentials permitted to access their named pipes. Both child processes are verified alive and waiting for connections. The engagement remains active. How can control be recovered with the fewest changes to the endpoints?

Accepted Answer

Link both waiting children through the surviving HTTPS Beacon.

Answer

Restart the team server to rebuild its child-to-parent connections.

Answer

Restore the original parent before attempting further child tasking.

Answer

Redeploy both children with their own HTTPS callback channels.

Question 3

At 09:14, an emailed test file produces a fresh agent check-in from a hostname verified as the customer's mail-analysis sandbox. Message tracking records delivery to the employee at 09:16. The employee's workstation has no matching execution event for the file. The engagement objective requires execution on an employee workstation. What can the team legitimately claim from the 09:14 callback?

Accepted Answer

The file executed in the sandbox; employee-workstation execution remains unverified.

Answer

The objective is complete because code ran within the customer's environment.

Answer

Employee execution is confirmed because the file registered an agent.

Answer

Endpoint protection blocked the employee's copy of the file.

Question 4

A Linux escalation check produces these findings:

Process real/effective UID: 1001/1001
Executable: native ELF, owned by root, mode 4755
Filesystem: set-ID execution permitted
Process tracing: none
no_new_privs: 1

The executable reports its effective UID immediately after execve, before changing credentials itself. Which output and explanation should the operator expect?

Accepted Answer

UID 1001: execution is allowed, but no_new_privs suppresses the set-user-ID gain.

Answer

UID 0: root ownership and the set-user-ID bit change the effective user.

Answer

UID 1001: mode 4755 changes the effective group instead of the effective user.

Answer

No UID output: no_new_privs prohibits execution of files bearing a set-ID bit.

Question 5

A callback trace shows the following sequence: the hostname resolves to the public redirector, TLS validation succeeds, and the agent receives '302 Found' with 'Location: https://10.20.30.40/task'. The agent follows that address and times out. That private C2 backend is reachable from the redirector, but not from the workstation. The design requires workstation connections to stay on the public endpoint. What needs to change at the redirector?

Accepted Answer

Proxy requests to the backend and relay its responses through the public endpoint.

Answer

Publish the private backend address as a second A record for the callback hostname.

Answer

Return 307 instead of 302 to preserve the client's request method.

Answer

Install the backend's certificate in the workstation's trusted certificate store.

Question 6

An operator runs this command while reviewing a service account:

Get-ADUser -Identity svc_reports | Select-Object SamAccountName, ServicePrincipalNames

The account name appears, but the ServicePrincipalNames column is blank. The query returns no access error. Before concluding that the account has no SPNs, make the change that directly checks whether the property was retrieved:

Accepted Answer

Add -Properties ServicePrincipalNames to Get-ADUser before selecting fields.

Answer

Run the same command as a domain administrator to obtain the omitted properties.

Answer

Use -Filter to select the same account, leaving the property list unchanged.

Answer

Replace Select-Object with Format-List * to fetch every directory attribute.

Question 7

A purple-team exercise schedules 28 actions. Four cannot start because required software is absent; four more never reach their endpoints after a controller failure. Endpoint evidence confirms execution of the rest. Fourteen alert records correspond to 12 distinct executed actions. The other executed actions produce searchable telemetry but no qualifying alert. The agreed measure counts each executed action once and requires a validated alert for detection. Which result and follow-up belong in the report?

Accepted Answer

60% detection; investigate the eight executed actions that lacked a qualifying alert.

Answer

43% detection; treat all 16 scheduled actions without a qualifying alert as detection failures.

Answer

70% detection; investigate the six executed actions not represented by an alert record.

Answer

50% detection; prioritize the 14 scheduled actions without their own alert record.

Question 8

From OP01, a domain account opens a Kerberos-authenticated PowerShell session on JUMP01. Local commands there succeed, but a read of FILE01's approved share fails. The same account reads that share directly from OP01. SMB connectivity from JUMP01 to FILE01 is verified, permissions are unchanged, and the remote session has neither credential delegation nor separately supplied credentials. The difference between these access paths points to:

Accepted Answer

The onward SMB connection lacks delegated or separately supplied credentials.

Answer

A firewall rule that prevents JUMP01 from establishing an SMB connection to FILE01.

Answer

A share ACL that denies the domain account access to the requested file.

Answer

Network logon rights that prevent this account from authenticating to FILE01.

Question 9

For a persistence test, SessionCheck is added under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce. At the next normal user logon, the referenced executable is temporarily missing. No process starts, and the registry value is absent afterward. The file is restored, but a second logon still produces no process. Before attributing this to endpoint protection, which mechanism accounts for the sequence?

Accepted Answer

RunOnce consumed the value before the failed launch; restoring the file does not recreate the entry.

Answer

RunOnce removes entries only after a successful launch, so another process must have deleted this value.

Answer

The HKCU entry is retained until an administrator logs on after a reboot.

Answer

RunOnce is a boot-time trigger, so an interactive user logon cannot invoke the entry.

Question 10

Threat intelligence describes an intruder querying AD group memberships over LDAP with a proprietary utility before choosing lateral-movement targets. The engagement must assess the client's collection and detection of those live LDAP queries. The utility is unavailable, but equivalent queries are permitted. Which substitution preserves the purpose of the emulation?

Accepted Answer

Reproduce the LDAP queries from the same access context with a substitute utility, and record the change.

Answer

Replay captured LDAP events into the SIEM with the actor's original usernames, timestamps, and source addresses.

Answer

Rename an available discovery executable to match the actor's binary and reproduce its recorded installation path.

Answer

Enumerate the same accounts through SMB while retaining the actor's ATT&CK technique label and target list.

Free GRTP Practice Questions

Domain 1: Adversary Emulation Fundamentals

Question 1

Domain 2: Attacking Active Directory

Question 2

Domain 3: Command and Control infrastructure

Question 3

Domain 4: Creating the Attack infrastructure

Question 4

Domain 5: Discovery and Enumeration

Question 5

Domain 6: Enumerating and Attacking Privileges

Question 6

Domain 7: Gaining Access

Question 7

Domain 8: Leveraging the Domain

Question 8

Domain 9: Persistence and Exfiltration

Question 9

Domain 10: Red Team Engagement Planning and Reporting

Question 10

That's 10 of 1,030