Red Teaming · CyberQuiz

Q1 Easy 10 pts

'C2' stands for:

Cyber Compliance Command and Control Cloud Container Client Certificate

Q2 Medium 15 pts

Moving from the initial compromised host to other systems is called lateral ____ .

Q3 Medium 15 pts

Mimikatz is most known for:

Port scanning Dumping Windows credentials/hashes/tickets from memory Fuzzing web apps Encrypting files

Q4 Medium 15 pts

Reusing a captured NTLM hash to authenticate without cracking it is Pass-the-____ .

Q5 Hard 20 pts

'Living off the land' (LOLBins) means:

Attacking rural targets Abusing legitimate built-in OS tools to evade detection Using a VM farm Only open-source malware

Q6 Medium 15 pts

The MITRE ATT&CK tactic for stealing data OUT of the network is:

Discovery Exfiltration Persistence Execution

Q7 Hard 20 pts

Kerberoasting targets:

Wi-Fi keys Service account TGS tickets to crack their passwords offline TLS certs DNS records

Q8 Hard 20 pts

AS-REP roasting works against accounts that:

Have long passwords Do NOT require Kerberos pre-authentication Are disabled Use MFA

Q9 Hard 20 pts

A 'Golden Ticket' attack forges:

A TLS certificate A Kerberos TGT using the krbtgt hash for domain-wide access A password reset email A DNS entry

Q10 Hard 20 pts

DCSync abuses replication rights to:

Restart the DC Request password hashes from a domain controller Delete logs Patch the OS

Q11 Medium 20 pts

BloodHound is used to:

Crack Wi-Fi Map Active Directory attack paths via graph analysis Scan web apps Capture packets

Q12 Hard 20 pts

Pass-the-Ticket reuses:

A password A stolen Kerberos ticket (TGT/TGS) to authenticate An SSH key A cookie

Q13 Medium 15 pts

Cobalt Strike, Sliver and Mythic are:

Antivirus products Command-and-control (C2) frameworks SIEM tools Password managers

Q14 Medium 15 pts

A C2 'beacon' typically:

Runs once and exits Periodically checks in to the C2 for tasking (often jittered) Encrypts the whole disk Scans all ports

Q15 Hard 20 pts

'Jitter' in a beacon is used to:

Speed transfers Randomize check-in timing to evade detection Encrypt payloads Increase privileges

Q16 Hard 20 pts

AMSI bypass techniques aim to defeat:

The firewall Windows' Antimalware Scan Interface that inspects scripts TLS DNS

Q17 Hard 20 pts

Process injection is used to:

Speed the CPU Run malicious code within a legitimate process for stealth Compress files Rotate keys

Q18 Medium 15 pts

'Initial access' via a malicious document usually relies on:

A firmware bug Phishing that tricks a user into enabling macros/opening a payload A DNS flush A TLS downgrade

Q19 Medium 15 pts

'MFA fatigue' (push bombing) attacks work by:

Cracking the password offline Spamming push prompts until the user approves one Disabling MFA remotely Stealing the phone

Q20 Hard 20 pts

A 'redirector' in C2 infrastructure:

Redirects DNS globally Sits between the target and team server to hide the real C2 Encrypts disks Blocks traffic

Q21 Hard 20 pts

'Domain fronting' hides C2 traffic by:

Using no encryption Making requests appear to go to a trusted high-reputation domain Disabling DNS Using Telnet

Q22 Medium 15 pts

PsExec, WMI and WinRM are commonly used for:

Backups Lateral movement / remote execution in Windows networks Disk encryption DNS updates

Q23 Easy 10 pts

The offensive team is 'red'; the defenders monitoring/responding are the ____ team.

Q24 Medium 15 pts

'Purple teaming' means:

Only attacking Red and blue collaborating to improve detection and response Only defending Auditing finances

Q25 Medium 15 pts

An 'assumed breach' engagement starts from:

Outside with zero access A foothold already inside, testing detection/lateral movement The physical building only The help desk

Q26 Hard 20 pts

IOAs (Indicators of Attack) differ from IOCs by focusing on:

File hashes only Attacker behavior/intent rather than static artifacts IP addresses only Certificates

Q27 Medium 15 pts

OPSEC for red teams means:

Publishing all actions Minimizing footprint/detection and protecting operational details Ignoring logs Using loud tools

Q28 Medium 15 pts

Payload obfuscation/packing is used to:

Improve UX Evade signature-based AV/EDR detection Speed the network Reduce privileges

Q29 Medium 15 pts

A 'reverse shell' beacon over HTTPS is preferred because:

It's unencrypted It blends with normal web traffic and often traverses firewalls It's slower It needs no server

Q30 Medium 15 pts

Data 'staging' before exfiltration means:

Deleting data Collecting/compressing/encrypting data in one place before transfer Encrypting the C2 Rotating tickets

Q31 Medium 15 pts

Scheduled tasks and registry Run keys are examples of:

Exfiltration Persistence mechanisms Recon Initial access

Q32 Hard 20 pts

A WMI event subscription is used by attackers for:

Faster boot Stealthy, fileless persistence triggered by system events Disk cleanup DNS caching

Q33 Hard 20 pts

'Token impersonation' on Windows lets an attacker:

Buy tokens Assume another user's security context/privileges Encrypt tokens Reset passwords

Q34 Hard 20 pts

Unconstrained Kerberos delegation is dangerous because:

It speeds logins A compromised host can capture and reuse users' TGTs It disables MFA It blocks DNS

Q35 Medium 15 pts

The MITRE ATT&CK 'Defense Evasion' tactic covers:

Making backups Techniques to avoid detection (obfuscation, disabling tools, LOLBins) Buying licenses Writing reports

Q36 Medium 15 pts

A red team's deliverable emphasizes:

Only the flag captured Attack narrative, detection gaps and actionable remediation Selling exploits Nothing written

Q37 Easy 10 pts

Phishing pretext quality matters because:

Longer emails are better Believable context increases click/credential capture rates It encrypts email It bypasses TLS

Q38 Hard 20 pts

C2 over DNS is useful when:

HTTP is fastest Only DNS egress is allowed, so data is tunneled in DNS queries There's no network TLS is required

Q39 Hard 20 pts

'Silver Ticket' forges a ticket for:

The whole domain A specific service using that service account's hash The root CA A VPN

Q40 Hard 20 pts

EDR evasion via 'unhooking' targets:

Firewall rules The EDR's userland API hooks used to monitor calls DNS TLS certs

Q41 Medium 15 pts

Enumerating AD users/groups after a foothold is part of the ATT&CK tactic:

Discovery Impact Collection Exfiltration

Q42 Medium 15 pts

A 'dropper' is malware that:

Encrypts email Installs/loads additional payloads onto the system Scans ports Manages tickets

Q43 Hard 20 pts

Reflective DLL injection loads a DLL:

From disk normally Directly from memory without touching disk, aiding evasion Via the registry only Over DNS

Q44 Medium 15 pts

Password spraying is favored over brute force in AD because it:

Is louder Avoids account lockouts by trying few passwords across many users Cracks hashes offline Needs no accounts

Q45 Easy 10 pts

A red team engagement should always have:

No rules A signed scope/authorization and rules of engagement Unlimited targets Public disclosure first

Q46 Easy 10 pts

Credential 'harvesting' via a cloned login portal is a form of:

Patch management Social engineering / phishing Fuzzing Encryption

Q47 Medium 15 pts

'Impact' tactic in ATT&CK includes:

Recon Destruction/encryption of data (e.g. ransomware) or service disruption Initial access Discovery

Q48 Medium 15 pts

Detonating payloads in a lab before the op helps ensure:

Louder alerts They work and understand what telemetry they generate (OPSEC) Higher privileges Faster DNS

Q49 Medium 20 pts

The main difference between a pentest and a red team op is:

Red teams find every vuln Red teams emulate a real adversary against people/process/tech and detection Pentests are illegal There is none

Q50 Medium 15 pts

After the engagement, red teams should:

Keep persistence installed Remove artifacts/backdoors and hand over full details to defenders Sell access Delete client logs