GPEN Command and Control Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The C2 server is unreachable due to a network outage.

  Why it's wrong here

  A network outage would typically result in a connection timeout, 'connection refused', or 'no route to host' error. This specific error message indicates that the TCP connection was established and the SSL handshake process actually began, but failed during the authentication phase of the TLS negotiation.

• ✓

  The client system does not trust the C2 server's certificate.

  Why this is correct

  This specific TLS alert signifies that the client received a certificate it could not verify against its local root store. This is a common indicator that the C2 infrastructure is using a self-signed certificate, which the client is configured to reject due to strict security settings.

• ✗

  The C2 server is performing a man-in-the-middle attack.

  Why it's wrong here

  While this error could occur in a man-in-the-middle scenario, the error code implies that the client is the one rejecting the certificate. If the C2 server were the one attacking, it would likely be the client's own certificate that fails or a mismatch in the expected cipher suites.

• ✗

  The C2 server has exhausted its connection limit.

  Why it's wrong here

  Connection limits are typically enforced at the network or application layer, resulting in '503 Service Unavailable' or TCP resets. A TLS-specific alert regarding an 'unknown CA' is strictly related to the cryptographic handshake and identity verification process, not the server's available resource capacity or connection load.