GPEN Command and Control — All Questions With Answers

Question 1

Which THREE techniques are commonly used by attackers to hide C2 traffic within legitimate network protocols?

Accepted Answer

Embedding data in DNS TXT records.. Attackers disguise C2 traffic to blend in with normal organizational traffic, reducing the probability of detection by security teams. By leveraging protocols that are already allowed through firewalls, they ensure reliable communication while remaining stealthy. Understanding these masking techniques allows testers to develop more effective detection rules, focusing on content inspection and behavioral analysis rather than simple port blocking, which is often bypassed by these sophisticated methods.

Answer

Modifying the TTL field in IP headers.

Answer

Replacing the TCP/IP stack with a custom version.

Question 2

During an authorized penetration test, you successfully establish an interactive command and control shell via DNS tunneling. However, you notice that large data exfiltration queries are frequently failing or timing out due to upstream DNS server payload restrictions and strict rate limiting. Which action should you take to optimize reliability while maintaining covert persistence?

Accepted Answer

Delegate an authoritative nameserver for your testing domain and configure direct query routing over alternative record types.. Switching to a stateful protocol like HTTPS or utilizing DNS direct-server communication via a designated authoritative nameserver bypasses recursive resolver payload ceilings. This technique ensures reliable fragmentation and chunking of large files without triggering anomalous query rates or dropping packets at intermediary caching servers during penetration testing operations.

Answer

Increase the TXT record payload size to the absolute maximum allowed by the protocol standard to accelerate data transfer rates.

Answer

Configure the tunneling tool to query the domain directly through the compromised host's primary corporate recursive DNS server.

Answer

Disable data compression algorithms entirely to reduce the processing overhead on the target operating system's network stack.

Question 3

You are conducting a penetration test and have established a C2 channel using the Metasploit Framework's Meterpreter payload. You need to maintain persistence on the compromised Windows host while ensuring that the C2 communication survives reboots and user logoffs. Which two techniques can you use with Meterpreter to achieve this? (Choose two.)

Accepted Answer

Use the 'schtasks' command to create a scheduled task that runs the payload at system startup.. The two techniques that provide persistence for a Meterpreter session are using the 'persistence' module to create a registry key and using 'schtasks' to create a scheduled task. Both ensure that the payload runs automatically at startup or logon, re-establishing the C2 channel. Migration, RDP, and keylogging do not provide automatic reconnection after a reboot.

Answer

Use the 'keyscan_start' command to capture keystrokes and store them for later retrieval.

Answer

Use the 'migrate' command to move the Meterpreter session into a long-running process such as explorer.exe.

Answer

Use the 'getgui' command to enable Remote Desktop and then reconnect via RDP.

Question 4

During an authorized penetration test, you have established a Meterpreter session to a Windows 10 target over TCP port 443. The client's egress firewall begins inspecting TLS certificates and blocking self-signed certificates. Your session dies. You need a new payload that can survive this inspection while still using port 443. Which Metasploit payload is best suited?

Accepted Answer

windows/meterpreter/reverse_https with a valid certificate. The firewall blocks self-signed certificates. Using reverse_https with a valid certificate makes the TLS handshake appear legitimate, allowing the payload to traverse the firewall on port 443. Other options either still use self-signed certificates or abandon TLS entirely, which may trigger other blocks. This approach mimics legitimate HTTPS traffic, a common technique in penetration testing.

Answer

windows/meterpreter/reverse_tcp

Answer

windows/meterpreter/reverse_winhttps

Answer

windows/meterpreter/reverse_https

Question 5

During a penetration test, you have compromised a host in a restricted network that only allows outbound DNS traffic. You need to establish a C2 channel. Which of the following techniques would be most effective for maintaining a reliable, low-bandwidth C2 channel over DNS?

Accepted Answer

Using DNS TXT records to encode and transmit command output from the compromised host to the C2 server.. DNS TXT records are the most effective for DNS-based C2 because they can carry arbitrary data and are often allowed through firewalls. Encoding command output in TXT queries or responses enables bidirectional communication. Other DNS record types like A, PTR, or MX are limited in their ability to carry data or are not typically allowed for arbitrary use, making them less suitable for a reliable C2 channel.

Answer

Using DNS A records to transmit data by encoding information in the subdomain of the query.

Answer

Using DNS PTR records to send commands from the C2 server to the compromised host by encoding them in reverse DNS lookups.

Answer

Using DNS MX records to establish a direct TCP connection back to the C2 server over port 25.

Question 6

During a penetration test, you have established a C2 session with a target host using a Meterpreter reverse HTTPS payload. You want to maintain access even if the user logs off or the system reboots. Which of the following methods is the MOST reliable for achieving persistence on a Windows host?

Accepted Answer

Create a new scheduled task that runs the payload at system startup with highest privileges.. For reliable persistence on Windows that survives reboots and does not depend on user logon, a scheduled task set to run at system startup with highest privileges is the best choice. It executes with SYSTEM rights and runs regardless of user interaction. The other options either depend on user logon (HKCU Run key, Startup folder) or use a less reliable automated method (Meterpreter persistence command) that may not configure the task optimally.

Answer

Place a shortcut to the payload in the Startup folder for the current user.

Answer

Add a registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Answer

Use the 'persistence' command in Meterpreter to create a backdoor service that runs on boot.

Question 7

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Accepted Answer

Implementing Domain Generation Algorithms (DGA).. Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Answer

Hardcoding the IP address of the C2 server.

Answer

Using unencrypted HTTP for all C2 traffic.

Answer

Requiring manual operator interaction for beaconing.

Question 8

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Accepted Answer

To prevent detection via traffic pattern analysis.. The jitter parameter introduces a random percentage of variation into the beacon interval, preventing the C2 traffic from appearing as a perfectly rhythmic heartbeat. Static intervals are highly detectable through statistical analysis, as they create distinct patterns in network traffic logs. Introducing jitter makes the C2 communication appear more organic and unpredictable, complicating efforts by defenders to identify the malicious connection using simple frequency-based anomaly detection algorithms.

Answer

To reduce the CPU overhead on the infected host.

Answer

To synchronize beaconing across multiple infected hosts.

Answer

To increase the throughput of the C2 channel.

Question 9

Which term best describes the stage of a cyberattack where a compromised host signals a remote server to request instructions or transmit stolen data?

Accepted Answer

Command and control. The command and control (C2) phase represents the ongoing communication channel between the attacker's infrastructure and the compromised system. It is the tactical link that allows the adversary to remotely manage the infection, deploy additional tools, and exfiltrate information. Recognizing C2 traffic is fundamental to incident response because it is the primary vector for controlling the adversary's actions within the network environment.

Answer

Privilege escalation

Answer

Reconnaissance

Answer

Log clearing

Question 10

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Accepted Answer

The certificate uses a self-signed or invalid chain.. Malicious C2 infrastructure often uses self-signed certificates or certificates issued by untrusted/free Certificate Authorities to encrypt traffic. In a professional environment, legitimate services typically use well-known, trusted CAs. When a penetration tester sees an endpoint using a certificate with a random common name, short expiration period, or invalid chain, it serves as a strong indicator that the connection is intended for unauthorized command and control purposes.

Answer

The certificate uses a 2048-bit RSA key.

Answer

The certificate is signed by a reputable public CA.

Answer

The certificate includes a valid Subject Alternative Name.

Question 11

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Accepted Answer

The client system does not trust the C2 server's certificate.. The 'tlsv1 alert unknown ca' error indicates that the client rejected the server's certificate because it was not signed by a trusted root CA. In the context of C2, this often happens when an automated beacon tries to connect to an infrastructure node using a self-signed certificate, and the host's security policy or a proxy is performing SSL inspection and fails the trust validation process.

Answer

The C2 server is unreachable due to a network outage.

Answer

The C2 server is performing a man-in-the-middle attack.

Answer

The C2 server has exhausted its connection limit.

Question 12

Which of the following is a classic characteristic of 'beaconing' behavior observed in C2 traffic?

Accepted Answer

Consistent, periodic intervals between connections.. Beaconing is characterized by the repeated, predictable nature of the connection attempts from a compromised host to an external server. By analyzing network traffic, one can identify these 'heartbeats' that occur at fixed intervals. This pattern is often the first red flag that a system has been compromised, as legitimate user activity is typically irregular and bursty compared to the methodical, automated nature of a C2 beacon.

Answer

High-volume data exfiltration during business hours.

Answer

Randomized connections to various global IP addresses.

Answer

Traffic that exclusively utilizes UDP transport.

Question 13

What is the primary risk of using 'Domain Fronting' in a C2 architecture during a penetration test?

Accepted Answer

It can cause accidental disruption to legitimate services.. Domain fronting relies on the trust placed in large Content Delivery Networks (CDNs). If a penetration tester uses a high-traffic, reputable CDN for C2, the organization's defense team may be unable to block the C2 traffic without also blocking legitimate business services that share the same CDN infrastructure. This creates a significant conflict between security needs and operational availability, which must be carefully managed during the engagement.

Answer

It will trigger an immediate alert on all EDR agents.

Answer

It is easily detectable by standard firewall port filtering.

Answer

It forces the malware to use a non-standard protocol.

Question 14

Why do many C2 frameworks include a 'sleep' command that can be configured by the operator?

Accepted Answer

To minimize the visibility of the C2 beacon.. The 'sleep' command allows an operator to control the frequency of beaconing manually. This is useful for balancing the need for responsiveness with the need for stealth. By increasing the sleep time, the operator makes the beacon less frequent, which reduces the chance of detection by network anomaly systems. This flexibility is a core feature of modern C2 suites, enabling operators to manage the trade-off between active engagement and operational security.

Answer

To allow the malware to clear its memory footprint.

Answer

To bypass the need for a persistent connection.

Answer

To prevent the target from shutting down the system.

Question 15

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

Accepted Answer

Centralized DNS query logs.. DNS query logs are the primary data source for identifying DNS-based C2. By analyzing these logs, security teams can identify anomalies such as high volumes of queries to a specific domain, unusual record types like TXT or NULL records, or domains with extremely high entropy. Without centralized DNS logging, detecting this specific type of C2 becomes nearly impossible, as the traffic occurs at the infrastructure level rather than the end-host level.

Answer

Endpoint system event logs.

Answer

Firewall traffic logs (Layer 4).

Answer

Antivirus detection logs.

Question 16

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Accepted Answer

To provide a layer of obfuscation for the C2 server.. Redirectors act as a layer of separation between the compromised host and the actual C2 server. They proxy the incoming beacon traffic to the real server, masking the location of the true command infrastructure. This protects the C2 server from being directly identified and blacklisted, as the traffic appears to originate from the redirector node. This is a critical component for maintaining a resilient and stealthy operational environment.

Answer

To increase the bandwidth of the C2 connection.

Answer

To translate commands into local system calls.

Answer

To manage the encryption keys for the C2 channel.

Question 17

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

Accepted Answer

Applying statistical analysis to traffic patterns.. Since jitter and randomized timing break the simple periodic heartbeat, security teams must use statistical analysis to identify the traffic. By calculating the frequency distribution of connections over a long time window, analysts can identify the underlying regularity that persists despite the jitter. This behavioral approach is significantly more effective than static threshold-based alerts, which are easily defeated by the randomness built into modern C2 communication protocols.

Answer

Blocking all traffic to unknown IP addresses.

Answer

Scanning for specific byte signatures in the payloads.

Answer

Monitoring for high-bandwidth bursts in the network.

Question 18

During an internal penetration test, you have compromised a Windows workstation and need to establish a covert channel that will survive network address translation and filtering. You decide to use the Domain Name System (DNS) TXT record for command and control. Which tool should you use to create a DNS tunnel that encapsulates IP traffic over DNS queries and responses?

Accepted Answer

iodine. The correct tool for encapsulating IP traffic over DNS is iodine. It creates a virtual network interface and tunnels IPv4 packets inside DNS queries and responses, effectively providing a VPN over DNS. This allows the attacker to bypass network restrictions that only allow DNS traffic. Other tools like dnscat2 and dns2tcp provide C2 channels but do not encapsulate IP traffic.

Answer

dnscat2

Answer

dns2tcp

Answer

iodine-client

Question 19

During an authorized penetration test, you have established a C2 session using a popular framework. Your goal is to maintain persistent access to a compromised Windows host even after the user logs off or the system reboots. You decide to use a service-based persistence mechanism. Which of the following commands, when executed on the compromised host, would create a new Windows service that runs your payload at startup?

Accepted Answer

sc create Updater binPath= "C:\Windows\Temp\payload.exe" start= auto. Creating a Windows service with sc.exe is a reliable method for achieving persistence because services can be configured to start automatically at boot, independent of user logon. The command must use the correct syntax with spaces after 'binPath=' and 'start='. Other options either rely on user logon or use invalid syntax, failing to meet the requirement of persistence across reboots without user interaction.

Answer

wmic service create name='Updater' path='C:\Windows\Temp\payload.exe' startmode='Auto'

Answer

schtasks /create /tn "Updater" /tr "C:\Windows\Temp\payload.exe" /sc onlogon

Answer

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\Temp\payload.exe"

Question 20

You are performing an authorized penetration test and have established a C2 channel using HTTPS. To evade network detection, you configure your C2 beacon to use domain fronting. Which of the following best describes how domain fronting masks the true destination of your C2 traffic?

Accepted Answer

The TLS SNI field contains the domain of a legitimate high-reputation service, while the HTTP Host header contains the actual C2 domain.. Domain fronting works by manipulating the TLS SNI and HTTP Host header. The SNI, visible during the TLS handshake, points to a legitimate domain hosted on a CDN, while the encrypted Host header points to the actual C2 domain also hosted on the same CDN. This makes the traffic appear to be destined for the legitimate domain to network observers, effectively hiding the C2 communication.

Answer

The C2 traffic is routed through multiple compromised hosts in a peer-to-peer network, making it difficult to trace back to the origin.

Answer

The TLS SNI field contains the actual C2 domain, while the HTTP Host header contains the domain of a legitimate service.

Answer

The C2 traffic is encapsulated within DNS queries to a legitimate domain, and the responses contain the C2 instructions.

GPEN Command and Control — All Questions With Answers

Which THREE techniques are commonly used by attackers to hide C2 traffic within legitimate network protocols?

During a penetration test, you have compromised a host in a restricted network that only allows outbound DNS traffic. You need to establish a C2 channel. Which of the following techniques would be most effective for maintaining a reliable, low-bandwidth C2 channel over DNS?

During a penetration test, you have established a C2 session with a target host using a Meterpreter reverse HTTPS payload. You want to maintain access even if the user logs off or the system reboots. Which of the following methods is the MOST reliable for achieving persistence on a Windows host?

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Exhibit

Which term best describes the stage of a cyberattack where a compromised host signals a remote server to request instructions or transmit stolen data?

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Exhibit

Which of the following is a classic characteristic of 'beaconing' behavior observed in C2 traffic?

What is the primary risk of using 'Domain Fronting' in a C2 architecture during a penetration test?

Why do many C2 frameworks include a 'sleep' command that can be configured by the operator?

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

You are performing an authorized penetration test and have established a C2 channel using HTTPS. To evade network detection, you configure your C2 beacon to use domain fronting. Which of the following best describes how domain fronting masks the true destination of your C2 traffic?

You are using Cobalt Strike in an authorized penetration test. The target network uses a next-generation firewall that performs SSL inspection and blocks self-signed certificates. You need to configure your HTTPS beacon to blend in with legitimate traffic and avoid detection. (Choose two.)

You are configuring a C2 listener to use a malleable profile to blend in with legitimate traffic. Which two of the following are key benefits of using a malleable C2 profile in a penetration test? (Choose two.)

A penetration tester has compromised a host in a restricted network that only allows outbound DNS queries to a specific internal resolver. The tester needs to establish a command and control channel that can traverse this restriction. Which C2 technique is most appropriate?

You are configuring a Cobalt Strike beacon for a penetration test. The client's security team monitors for periodic beaconing patterns. You want to reduce the chance of detection by network behavior analysis. Which beacon setting should you adjust?

You are setting up a C2 infrastructure for a penetration test. To protect the backend C2 server from direct exposure, you deploy a redirector. Which of the following best describes the primary function of a redirector in this context?

GPEN Command and Control — All Questions With Answers

Which THREE techniques are commonly used by attackers to hide C2 traffic within legitimate network protocols?

During a penetration test, you have compromised a host in a restricted network that only allows outbound DNS traffic. You need to establish a C2 channel. Which of the following techniques would be most effective for maintaining a reliable, low-bandwidth C2 channel over DNS?

During a penetration test, you have established a C2 session with a target host using a Meterpreter reverse HTTPS payload. You want to maintain access even if the user logs off or the system reboots. Which of the following methods is the MOST reliable for achieving persistence on a Windows host?

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Exhibit

Which term best describes the stage of a cyberattack where a compromised host signals a remote server to request instructions or transmit stolen data?

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Exhibit

Which of the following is a classic characteristic of 'beaconing' behavior observed in C2 traffic?

What is the primary risk of using 'Domain Fronting' in a C2 architecture during a penetration test?

Why do many C2 frameworks include a 'sleep' command that can be configured by the operator?

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

You are performing an authorized penetration test and have established a C2 channel using HTTPS. To evade network detection, you configure your C2 beacon to use domain fronting. Which of the following best describes how domain fronting masks the true destination of your C2 traffic?

You are using Cobalt Strike in an authorized penetration test. The target network uses a next-generation firewall that performs SSL inspection and blocks self-signed certificates. You need to configure your HTTPS beacon to blend in with legitimate traffic and avoid detection. (Choose two.)

You are configuring a C2 listener to use a malleable profile to blend in with legitimate traffic. Which two of the following are key benefits of using a malleable C2 profile in a penetration test? (Choose two.)

A penetration tester has compromised a host in a restricted network that only allows outbound DNS queries to a specific internal resolver. The tester needs to establish a command and control channel that can traverse this restriction. Which C2 technique is most appropriate?

You are configuring a Cobalt Strike beacon for a penetration test. The client's security team monitors for periodic beaconing patterns. You want to reduce the chance of detection by network behavior analysis. Which beacon setting should you adjust?

You are setting up a C2 infrastructure for a penetration test. To protect the backend C2 server from direct exposure, you deploy a redirector. Which of the following best describes the primary function of a redirector in this context?