Question bank
Certified Red Team Specialist
40 Certified Red Team Specialist questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Adversary Emulation and TTPs
8 questions in this domain
- Question 1Single Choice
What is the primary purpose of mapping TTPs from known threat actors?
- AReplicate indicators of compromise
- BValidate detection analytics against realistic behaviorsCorrect answer
- CExploit all vulnerabilities
- DAutomate penetration testing
Why this is the answer
The primary purpose is to validate detection analytics and response procedures by emulating realistic adversary behavior, not just replicating IOCs.
- Question 2Multiple Select
Which components are part of the MITRE ATT&CK hierarchy?
- ATacticsCorrect answer
- BTechniquesCorrect answer
- CProceduresCorrect answer
- DIndicators of Compromise
Why this is the answer
The ATT&CK hierarchy consists of Tactics (why), Techniques (how), and Procedures (specific implementation). IOCs are not part of the hierarchy.
- Question 3Interactive
The following C2 profile fragment configures which parameter?
- ABeacon intervalCorrect answer
- BConnection retries
- CEncryption key
- DHTTP method
Why this is the answer
The parameters 'set sleep_time 60000' and 'set jitter 20' configure the beacon's sleep interval and jitter, which define how frequently the agent communicates.
- Question 4Single Choice
What is a key characteristic of APT simulation compared to standard penetration testing?
- ASpeed of exploitation
- BUse of automated scanners
- CEmphasis on stealth and persistenceCorrect answer
- DFocus on vulnerability discovery
Why this is the answer
APT simulation prioritizes stealth and long-term persistence to mimic real advanced actors, unlike penetration tests which are often time-limited and noisy.
- Question 5Multiple Select
Which of the following are valid adaptations after detecting a defensive response?
- AChange payload hashCorrect answer
- BRotate C2 domainCorrect answer
- CIncrease attack speed
- DSwitch to a different lateral movement techniqueCorrect answer
Why this is the answer
Adaptations include rotating hashes and C2 domains, and changing techniques. Speeding up usually increases detection risk, so it is not a valid adaptation.
- Question 6Interactive
The techniques shown belong to which MITRE ATT&CK tactic?
- AInitial AccessCorrect answer
- BExecution
- CPersistence
- DDefense Evasion
Why this is the answer
T1566 (Phishing) and T1190 (Exploit Public-Facing Application) are both Initial Access techniques.
- Question 7Single Choice
What is the primary function of the ATT&CK Navigator in structured emulation?
- AAutomate attack execution
- BVisualize technique coverageCorrect answer
- CGenerate payloads
- DEncrypt C2 traffic
Why this is the answer
The ATT&CK Navigator provides a visual heatmap of technique coverage, helping teams see which TTPs have been executed or detected.
- Question 8Multiple Select
Which of the following are common persistence techniques used by APT groups?
- AScheduled tasksCorrect answer
- BRegistry run keysCorrect answer
- COpen file shares
- DWMI event subscriptionsCorrect answer
Why this is the answer
Scheduled tasks, registry run keys, and WMI event subscriptions are common persistent mechanisms. Open file shares are not a persistence technique.
Exploitation and Post-Exploitation
12 questions in this domain
- Question 9Single Choice
What is the primary goal of vulnerability identification in red team exploitation?
- ATo assign CVSS scores to all findings
- BTo discover weaknesses across the attack surfaceCorrect answer
- CTo generate automated scan reports
- DTo patch identified vulnerabilities immediately
Why this is the answer
Identification involves systematic reconnaissance to discover weaknesses across operating systems, networks, and applications.
- Question 10Multiple Select
Which factors should be considered when prioritizing vulnerabilities for exploitation? (Select two)
- AExploit complexityCorrect answer
- BCVSS score only
- CAsset criticalityCorrect answer
- DNumber of open ports
Why this is the answer
Prioritization is risk-based, considering exploit complexity and asset value, not just CVSS.
- Question 11Interactive
Examine the following code block. Which type of privilege escalation vulnerability does it demonstrate?
- AUnquoted Service PathCorrect answer
- BToken Impersonation
- CKernel Exploit
- DAlwaysInstallElevated
Why this is the answer
The code shows a service binary path with spaces and no quotes, indicating unquoted service path vulnerability.
- Question 12Single Choice
What is the purpose of using a SOCKS proxy in pivoting?
- ATo directly access the target's desktop
- BTo route traffic through a compromised hostCorrect answer
- CTo perform vulnerability scanning locally
- DTo bypass antivirus software
Why this is the answer
A SOCKS proxy on a compromised host allows the attacker to route traffic to otherwise unreachable segments.
- Question 13Multiple Select
Which of the following are native Windows persistence mechanisms? (Select two)
- AScheduled tasksCorrect answer
- BAppInit_DLLsCorrect answer
- CSSH authorized_keys
- DLD_PRELOAD
Why this is the answer
Scheduled tasks and AppInit_DLLs are Windows-specific persistence mechanisms; SSH and LD_PRELOAD are Linux.
- Question 14Interactive
Analyze the command below. What is the attacker trying to achieve?
- ADumping LSASS credentials
- BEnumerating SUID binariesCorrect answer
- CChecking sudo privileges
- DModifying cron jobs
Why this is the answer
The find command with -perm -4000 lists files with SUID bit set, used for Linux privilege escalation enumeration.
- Question 15Single Choice
What does 'living off the land' mean in red team operations?
- AUsing only open-source tools
- BLeveraging built-in OS tools for malicious purposesCorrect answer
- CRelying on third-party remote access software
- DExploiting zero-day vulnerabilities
Why this is the answer
LotL uses built-in binaries like PowerShell, wmic, or certutil to execute attacks, reducing forensic footprint.
- Question 16Multiple Select
Which of the following are common Linux privilege escalation vectors? (Select two)
- ASUID binary exploitationCorrect answer
- BUnquoted service paths
- CKernel exploitsCorrect answer
- DToken impersonation
Why this is the answer
SUID binaries and kernel exploits are Linux-specific; unquoted service paths and token impersonation apply to Windows.
- Question 17Interactive
Examine the snippet of a WMI event subscription. What is the purpose of this code?
- AScheduled task creation
- BWMI permanent event subscriptionCorrect answer
- CRegistry run key modification
- DService installation
Why this is the answer
WMI event subscriptions allow code execution when specific events occur, providing stealthy persistence without file drops.
- Question 18Single Choice
What is the primary advantage of custom shellcode over Metasploit payloads?
- AIs easier to write
- BAvoids static signaturesCorrect answer
- CWorks on all platforms
- DDoes not require compilation
Why this is the answer
Custom shellcode has no known signatures, enabling bypass of signature-based detection by AV and EDR.
- Question 19Multiple Select
Which two techniques are used for lateral movement via native Windows protocols? (Select two)
- AWinRMCorrect answer
- BSSH
- CWMICorrect answer
- DRDP
Why this is the answer
WinRM and WMI are native Windows remote administration protocols; SSH is Unix-based and RDP is for remote desktop, not typically used for lateral movement.
- Question 20Interactive
Analyze the following command. What is its purpose in post-exploitation?
- AExfiltrating data
- BEstablishing a reverse tunnelCorrect answer
- CCreating a scheduled task
- DDumping credentials
Why this is the answer
The SSH command with -R creates a reverse port forward, allowing the attacker to reach internal services through the compromised host.
Planning, Scoping, and Legal Compliance
6 questions in this domain
- Question 21Single Choice
Which law is the primary legislation for unauthorised computer access in the UK?
- AComputer Misuse Act 1990Correct answer
- BCFAA (Computer Fraud and Abuse Act)
- CGDPR
- DPCI DSS
Why this is the answer
The Computer Misuse Act 1990 is the primary UK law that criminalises unauthorised access to computer material.
- Question 22Multiple Select
Which items must be explicitly included in a Red Team Rules of Engagement? (Select all that apply.)
- APermitted attack techniques and toolsCorrect answer
- BExcluded target systems and assetsCorrect answer
- CExact start time of the engagement
- DData handling and privacy proceduresCorrect answer
Why this is the answer
RoE must specify techniques, exclusions, and data handling rules. The exact start time is typically withheld for realism.
- Question 23Interactive
Based on the communication protocol shown, what is the primary purpose of having a single point of contact (SPOC) in red team exercises?
- ATo enable rapid deconfliction and prevent false alarmsCorrect answer
- BTo provide the blue team with real-time attack details
- CTo bypass legal compliance requirements
- DTo allow the red team to continue without interruption
Why this is the answer
The SPOC validates whether alerts are from the exercise, allowing quick deconfliction and avoiding unnecessary escalation.
- Question 24Single Choice
Which risk treatment approach involves formally consenting to proceed with a documented risk?
- AAvoid
- BMitigate
- CRisk acceptanceCorrect answer
- DTransfer
Why this is the answer
Risk acceptance is a formal decision to retain the risk, documented and signed off by the client.
- Question 25Multiple Select
Which attributes are characteristic of well-defined success criteria for a red team engagement? (Select all that apply.)
- ASpecific and quantitativeCorrect answer
- BTime-bound with a clear deadlineCorrect answer
- CSubjective and flexible
- DMeasurable and verifiableCorrect answer
Why this is the answer
Success criteria should be SMART: Specific, Measurable, Achievable, Relevant, Time-bound. Subjective criteria are not effective.
- Question 26Interactive
Given the data handling clause from a Rules of Engagement, what must the red team do with any personal data accidentally accessed?
- ADelete immediately and not report
- BReport and store for logging purposes
- CReport within 2 hours and ensure secure deletionCorrect answer
- DUse it as proof of compromise
Why this is the answer
The clause requires reporting to the client within 2 hours and deletion; storage or use is prohibited.
Reconnaissance and Intelligence Gathering
8 questions in this domain
- Question 27Single Choice
Which of the following best defines passive reconnaissance?
- AInteracting directly with target systems
- BCollecting data from third-party sources without touching targetCorrect answer
- CPerforming vulnerability scans
- DSending phishing emails
Why this is the answer
Passive reconnaissance gathers information from public sources without direct interaction with the target.
- Question 28Multiple Select
Which of the following are considered OSINT tools?
- ANmap
- BMaltegoCorrect answer
- CtheHarvesterCorrect answer
- DMetasploit
Why this is the answer
Maltego and theHarvester are OSINT tools; Nmap and Metasploit are active reconnaissance or exploitation tools.
- Question 29Interactive
Given the following command, what is its primary purpose?
- AEmail addresses and subdomainsCorrect answer
- BOpen ports
- CSSL certificates
- DSocial media profiles
Why this is the answer
The theHarvester command with -b google searches for emails and subdomains from Google indexes.
- Question 30Single Choice
Which Nmap scan type is stealthy because it does not complete the TCP handshake?
- ATCP connect scan
- BSYN scanCorrect answer
- CUDP scan
- DACK scan
Why this is the answer
Nmap SYN scan (-sS) sends only SYN packets and does not complete the three-way handshake.
- Question 31Multiple Select
Which of the following are application enumeration techniques?
- ADirectory bustingCorrect answer
- BService fingerprintingCorrect answer
- CWHOIS lookup
- DSNMP walk
Why this is the answer
Directory busting and service fingerprinting are application-level; WHOIS and SNMP are network/OSINT.
- Question 32Interactive
What does the -sV flag in this Nmap command do?
- AEnables version detectionCorrect answer
- BPerforms SYN scan
- CSets timing template
- DDefines output format
Why this is the answer
The -sV flag tells Nmap to probe open ports to determine service version information.
- Question 33Single Choice
Which component is part of the external attack surface?
- AActive Directory
- BPublic web applicationCorrect answer
- CInternal file share
- DDomain controller
Why this is the answer
A public web application is Internet-facing and part of the external attack surface.
- Question 34Multiple Select
Which of the following are internal attack surface elements?
- AExposed API
- BLateral movement pathsCorrect answer
- CCloud storage buckets
- DActive Directory misconfigurationsCorrect answer
Why this is the answer
Lateral movement paths and AD misconfigurations are internal; APIs and cloud buckets are external.
Reporting and Communication
6 questions in this domain
- Question 35Single Choice
What is the primary purpose of the executive summary in a red team report?
- AProvide detailed exploitation commands and technical evidence
- BCommunicate business risk, top findings, and high-level recommendations to non-technical stakeholdersCorrect answer
- CList all vulnerabilities by CVSS score
- DInclude raw packet captures and full log files
Why this is the answer
The executive summary is designed for non-technical stakeholders like executives; it must translate technical findings into business impact and strategic recommendations, avoiding jargon and excessive detail.
- Question 36Multiple Select
Which of the following are essential components of a professional red team report? (Select all that apply)
- AExecutive SummaryCorrect answer
- BRisk Assessment MatrixCorrect answer
- CFull source code of all exploits used
- DTechnical AnnexCorrect answer
Why this is the answer
A red team report includes an Executive Summary (for executives), a Risk Assessment Matrix (for prioritization), and a Technical Annex (for technical teams). Full exploit source code is not typically included unless agreed upon.
- Question 37Interactive
Read the following excerpt from a red team report. Which section of the report does it most likely belong to?
- AExecutive SummaryCorrect answer
- BTechnical Annex
- CRisk Assessment Matrix
- DRemediation Recommendations
Why this is the answer
The excerpt focuses on business impact and high-level findings without technical depth, which is characteristic of the Executive Summary.
- Question 38Single Choice
When communicating a technical finding to a non-technical executive, which approach is most appropriate?
- AWe exploited CVE-2023-3434 via a buffer overflow in the web application.
- BAn attacker could gain complete control of your critical systems, leading to significant financial and reputational damage.Correct answer
- CThe vulnerability has a CVSS score of 9.8 and is remotely exploitable with low complexity.
- DWe used Metasploit module exploit/multi/http/struts2_rest_xstream to achieve code execution.
Why this is the answer
Executive audiences need business risk context, not technical details. The correct option translates the finding into business impact and uses non-technical language.
- Question 39Multiple Select
Which of the following are examples of appropriate audience-specific communication in a red team engagement? (Select all that apply)
- AUsing MITRE ATT&CK technique IDs when briefing the SOC teamCorrect answer
- BUsing business impact language (e.g., financial loss, regulatory fines) when briefing the boardCorrect answer
- CIncluding full command outputs and raw logs in the executive summary
- DProviding a step-by-step attack chain with evidence in the technical annexCorrect answer
Why this is the answer
The SOC team appreciates technical details like MITRE ATT&CK IDs; the board needs business impact; the technical annex is for deep technical information. Including raw logs in the executive summary is inappropriate for that audience.
- Question 40Interactive
Examine the following log extract from a red team engagement. Which phase of the Cyber Kill Chain does this evidence primarily document?
- AInitial AccessCorrect answer
- BLateral Movement
- CExfiltration
- DPrivilege Escalation
Why this is the answer
The log shows phishing email delivery, macro execution, and C2 connection, which are classic stages of Initial Access in the Cyber Kill Chain (or MITRE ATT&CK TA0001).
Frequently asked questions
Everything about the Certified Red Team Specialist question bank and how to use it.