GPEN Command and Control Practice Test 2 — 15 Questions

Question 1

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Accepted Answer

To provide a layer of obfuscation for the C2 server.. Redirectors act as a layer of separation between the compromised host and the actual C2 server. They proxy the incoming beacon traffic to the real server, masking the location of the true command infrastructure. This protects the C2 server from being directly identified and blacklisted, as the traffic appears to originate from the redirector node. This is a critical component for maintaining a resilient and stealthy operational environment.

Answer

To increase the bandwidth of the C2 connection.

Answer

To translate commands into local system calls.

Answer

To manage the encryption keys for the C2 channel.

Question 2

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

Accepted Answer

Applying statistical analysis to traffic patterns.. Since jitter and randomized timing break the simple periodic heartbeat, security teams must use statistical analysis to identify the traffic. By calculating the frequency distribution of connections over a long time window, analysts can identify the underlying regularity that persists despite the jitter. This behavioral approach is significantly more effective than static threshold-based alerts, which are easily defeated by the randomness built into modern C2 communication protocols.

Answer

Blocking all traffic to unknown IP addresses.

Answer

Scanning for specific byte signatures in the payloads.

Answer

Monitoring for high-bandwidth bursts in the network.

Question 3

During an internal penetration test, you have compromised a Windows workstation and need to establish a covert channel that will survive network address translation and filtering. You decide to use the Domain Name System (DNS) TXT record for command and control. Which tool should you use to create a DNS tunnel that encapsulates IP traffic over DNS queries and responses?

Accepted Answer

iodine. The correct tool for encapsulating IP traffic over DNS is iodine. It creates a virtual network interface and tunnels IPv4 packets inside DNS queries and responses, effectively providing a VPN over DNS. This allows the attacker to bypass network restrictions that only allow DNS traffic. Other tools like dnscat2 and dns2tcp provide C2 channels but do not encapsulate IP traffic.

Answer

dnscat2

Answer

dns2tcp

Answer

iodine-client

Question 4

During an authorized penetration test, you have established a C2 session using a popular framework. Your goal is to maintain persistent access to a compromised Windows host even after the user logs off or the system reboots. You decide to use a service-based persistence mechanism. Which of the following commands, when executed on the compromised host, would create a new Windows service that runs your payload at startup?

Accepted Answer

sc create Updater binPath= "C:\Windows\Temp\payload.exe" start= auto. Creating a Windows service with sc.exe is a reliable method for achieving persistence because services can be configured to start automatically at boot, independent of user logon. The command must use the correct syntax with spaces after 'binPath=' and 'start='. Other options either rely on user logon or use invalid syntax, failing to meet the requirement of persistence across reboots without user interaction.

Answer

wmic service create name='Updater' path='C:\Windows\Temp\payload.exe' startmode='Auto'

Answer

schtasks /create /tn "Updater" /tr "C:\Windows\Temp\payload.exe" /sc onlogon

Answer

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\Temp\payload.exe"

Question 5

You are performing an authorized penetration test and have established a C2 channel using HTTPS. To evade network detection, you configure your C2 beacon to use domain fronting. Which of the following best describes how domain fronting masks the true destination of your C2 traffic?

Accepted Answer

The TLS SNI field contains the domain of a legitimate high-reputation service, while the HTTP Host header contains the actual C2 domain.. Domain fronting works by manipulating the TLS SNI and HTTP Host header. The SNI, visible during the TLS handshake, points to a legitimate domain hosted on a CDN, while the encrypted Host header points to the actual C2 domain also hosted on the same CDN. This makes the traffic appear to be destined for the legitimate domain to network observers, effectively hiding the C2 communication.

Answer

The C2 traffic is routed through multiple compromised hosts in a peer-to-peer network, making it difficult to trace back to the origin.

Answer

The TLS SNI field contains the actual C2 domain, while the HTTP Host header contains the domain of a legitimate service.

Answer

The C2 traffic is encapsulated within DNS queries to a legitimate domain, and the responses contain the C2 instructions.

Question 6

You are using Cobalt Strike in an authorized penetration test. The target network uses a next-generation firewall that performs SSL inspection and blocks self-signed certificates. You need to configure your HTTPS beacon to blend in with legitimate traffic and avoid detection. (Choose two.)

Accepted Answer

Configure the beacon to use a malleable C2 profile that mimics a known application like Microsoft Outlook Web Access.. To evade SSL inspection and blend in, using a valid certificate from a trusted CA ensures the TLS handshake is accepted, and a malleable C2 profile mimicking a known application like OWA makes the traffic appear legitimate at the application layer. Together, they address both certificate trust and traffic pattern detection. Other options do not resolve the certificate blocking or are less effective for blending.

Answer

Enable the TCP beacon instead of the HTTPS beacon.

Answer

Use a self-signed certificate but set the beacon's user agent to match a common browser.

Answer

Set the beacon's sleep time to 60 seconds with 30% jitter.

Question 7

You are configuring a C2 listener to use a malleable profile to blend in with legitimate traffic. Which two of the following are key benefits of using a malleable C2 profile in a penetration test? (Choose two.)

Accepted Answer

It provides a mechanism to define how the C2 server responds to specific requests, including error pages and other decoy content.. Malleable C2 profiles are used to customize the network traffic generated by a C2 framework to evade detection. They allow operators to define request and response structures, including headers, URIs, and body content, so that the traffic mimics legitimate services. This customization helps in blending with normal network activity and avoiding signature-based detection, making it a valuable tool during penetration tests.

Answer

It enables the C2 server to automatically generate new domain names for each beacon, avoiding domain blacklisting.

Answer

It encrypts the C2 traffic using a unique, randomly generated key for each session, ensuring perfect forward secrecy.

Answer

It allows the C2 traffic to be routed through multiple redirectors without additional configuration.

Question 8

A penetration tester has compromised a host in a restricted network that only allows outbound DNS queries to a specific internal resolver. The tester needs to establish a command and control channel that can traverse this restriction. Which C2 technique is most appropriate?

Accepted Answer

DNS tunneling. DNS tunneling is the only technique that can operate within a network that only allows DNS queries to an internal resolver. It encapsulates C2 traffic within DNS packets, which are forwarded by the resolver to external authoritative servers. This makes it ideal for bypassing strict egress filtering. Other techniques require protocols or ports that are not permitted in this scenario.

Answer

SMTP beaconing

Answer

ICMP tunneling

Answer

HTTPS beaconing

Question 9

You are configuring a Cobalt Strike beacon for a penetration test. The client's security team monitors for periodic beaconing patterns. You want to reduce the chance of detection by network behavior analysis. Which beacon setting should you adjust?

Accepted Answer

Increase the sleep time and add jitter.. Adjusting sleep time and jitter directly modifies the beacon's communication schedule, making it less predictable. Longer sleep intervals reduce traffic volume, and jitter adds randomness, breaking the periodic pattern that network behavior analysis seeks. Other options affect different layers (application headers, transport, or TLS) but do not address the timing-based detection described.

Answer

Change the user agent to match a common browser.

Answer

Use a self-signed certificate for the HTTPS listener.

Answer

Enable the TCP beacon instead of HTTPS.

Question 10

During an authorized penetration test, you compromise a Windows host in a restricted network segment that only permits outbound DNS (UDP 53) to an internal resolver. You need to establish a command-and-control channel that can survive reboots and provide interactive shell access while blending with normal DNS traffic. Which of the following is the MOST appropriate technique to achieve this?

Accepted Answer

Use a DNS tunneling tool such as dnscat2, configure it with a domain you control, and set up a scheduled task to restart the client on boot.. The scenario requires a C2 channel that works over DNS only, supports interactive shell, and survives reboots. DNS tunneling via dnscat2 meets these requirements because it encapsulates data in DNS queries and responses, which are allowed. Persistence via scheduled task ensures the client restarts after a reboot. The other options either violate the allowed protocol (TCP/443, ICMP) or attempt to bypass the internal resolver, which is not permitted.

Answer

Use a DNS TXT record to store commands, and have the compromised host poll a public DNS server directly on UDP 53, bypassing the internal resolver.

Answer

Use a reverse TCP Meterpreter payload over port 443 with TLS, and rely on the firewall's deep packet inspection to allow it as HTTPS.

Answer

Use an ICMP tunnel such as ptunnel to encapsulate shell traffic in echo requests, and configure a registry run key for persistence.

Question 11

During a penetration test, you have established a C2 channel using a domain fronting technique with a CDN. The target organization's proxy logs show connections to a high-reputation domain, but the actual C2 traffic is destined for your backend server. Which component is essential for this setup to function?

Accepted Answer

A CDN that supports domain fronting and allows you to configure the Host header separately from the SNI.. Domain fronting requires a CDN that permits the Host header to differ from the SNI. The CDN uses the Host header to route to the correct backend, while the SNI shows a trusted domain. This makes the traffic appear to go to a high-reputation domain. Without CDN support, the technique cannot work. Other options are either handled by the CDN or irrelevant to the mechanism.

Answer

An HTTP redirect from the high-reputation domain to your backend server.

Answer

A DNS TXT record pointing to your backend server.

Answer

A valid SSL certificate for the high-reputation domain on your backend server.

Question 12

You are conducting a penetration test against a target that employs a next-generation firewall (NGFW) with SSL inspection. Your C2 channel uses a custom protocol over TCP port 8443 with a self-signed certificate. The NGFW is blocking your traffic. You need to modify your C2 configuration to evade detection while maintaining command and control. Which of the following changes is MOST likely to succeed?

Accepted Answer

Switch to using a legitimate code-signing certificate issued by a trusted CA and mimic the TLS fingerprint of a common web browser.. The NGFW's SSL inspection is blocking the C2 because it can decrypt the traffic and detect the self-signed certificate or suspicious TLS characteristics. To evade this, the C2 must present a trusted certificate and mimic a legitimate browser's TLS handshake. This makes the traffic indistinguishable from normal HTTPS. The other options either do not address SSL inspection (jitter, port change) or retain the self-signed certificate (domain fronting), which would still be flagged.

Answer

Configure the C2 client to use a random port above 1024 and implement jitter in the beacon interval to avoid pattern detection.

Answer

Use a domain fronting technique with a popular CDN to hide the true destination, and keep the self-signed certificate.

Answer

Encapsulate the C2 traffic within DNS queries to a domain you control, using a high volume of queries to avoid detection.

Question 13

You are designing a resilient command-and-control (C2) infrastructure for an authorized penetration test. The client's network has strict egress filtering and monitors for anomalous traffic. You need to ensure that your C2 channel can survive the takedown of a single server and adapt to changing network conditions. Which two of the following techniques should you implement? (Choose two.)

Accepted Answer

Implement a fallback channel that uses a different protocol (e.g., DNS) if the primary channel is blocked.. Resilient C2 infrastructure requires redundancy and adaptability. Multiple redirectors with domain fronting provide redundancy and hide the true server, making takedown more difficult. A fallback channel using a different protocol ensures communication continues if the primary channel is blocked. These two techniques directly address survivability and adaptability. The other options either introduce single points of failure or focus on stealth rather than resilience.

Answer

Enable jitter and sleep intervals to randomize beacon timing and avoid pattern-based detection.

Answer

Configure the C2 client to use a single hardcoded IP address for the C2 server to simplify reconnection.

Answer

Use a single domain name with a long TTL to minimize DNS lookups and reduce the chance of detection.

Question 14

You are setting up a C2 infrastructure for a penetration test. To protect the backend C2 server from direct exposure, you deploy a redirector. Which of the following best describes the primary function of a redirector in this context?

Accepted Answer

It acts as a proxy that forwards only malicious traffic to the C2 server while blocking or misdirecting other traffic.. A redirector's primary function is to act as a proxy that filters incoming traffic, forwarding only legitimate C2 traffic to the backend server while blocking or misdirecting other connections. This protects the C2 server's location and makes it more difficult for defenders to identify and block the actual C2 infrastructure. Encryption, load balancing, and domain generation are separate concerns handled by other components or techniques.

Answer

It generates random domain names for the C2 server to evade domain blacklisting.

Answer

It load-balances incoming connections across multiple C2 servers to ensure high availability.

Answer

It encrypts all traffic between the compromised host and the C2 server, ensuring confidentiality.

Question 15

You are using a C2 framework that supports malleable C2 profiles. Your current profile uses a default HTTP GET beacon with a fixed User-Agent and a URI of /submit.php. The target's network monitoring has flagged this traffic as suspicious. You need to modify the profile to better blend with legitimate traffic. Which of the following changes is the MOST effective for evading network-based detection?

Accepted Answer

Mimic a legitimate application's traffic pattern by using its specific User-Agent, URI structure, and request headers, and set the beacon interval to match its typical polling frequency.. To evade network-based detection, the C2 traffic must closely resemble legitimate traffic. Simply changing the User-Agent or URI is insufficient because the overall pattern may still be anomalous. The most effective approach is to fully emulate a legitimate application, including its headers, URI structure, and timing. This makes the C2 traffic indistinguishable from the application's normal traffic, bypassing both signature and anomaly-based detection. The other options only partially address the problem.

Answer

Increase the beacon interval to several hours and add large amounts of jitter to make the traffic less frequent and more random.

Answer

Enable HTTPS with a valid certificate and use a domain that is categorized as 'business' by the firewall's URL filtering.

Answer

Change the User-Agent to match a common browser and set the URI to a random string for each beacon.