Red Team Engagement Coordination Quiz

1. Which phase of the red team engagement typically involves documenting findings, risk ratings, and remediation recommendations?

Reconnaissance

Exploitation

Reporting and debriefing

Planning

2. Which communication protocol is most secure for transmitting red team data and maintaining confidentiality during an engagement?

HTTP

SSH with encryption

Telnet

FTP

3. In post-exploitation activities, what is the primary purpose of 'data exfiltration'?

To extract and remove sensitive data from the compromised system

To restore all deleted files

To encrypt the entire hard drive

To create a backup copy on the target server

4. What is the primary role of 'credential harvesting' in a red team engagement?

To obtain valid user credentials for lateral movement and privilege escalation

To delete all user accounts

To backup the company's password database

To train employees on password security

5. Which social engineering technique involves impersonating a trusted entity to extract sensitive information?

Phishing

Tailgating

Pretexting

Baiting

6. In a red team engagement, what is the primary advantage of using a 'proxy' or 'pivot' system?

To mask the attacker's origin and maintain anonymity while accessing internal systems

To increase bandwidth on the target network

To automatically patch all vulnerabilities

To replace the need for encryption

7. What does 'CVSS' stand for, and what does it measure?

Common Vulnerability Scoring System; measures severity of vulnerabilities

Comprehensive Vulnerability Scanner Suite; lists all vulnerabilities

Critical Vulnerability Security Standard; defines compliance levels

Cyber Vulnerability Verification Service; certifies security patches

8. Which of the following is the most effective control against SQL injection attacks?

Parameterized queries or prepared statements

Disabling all database access

Running queries as guest users

Logging all SQL commands

9. In network segmentation, what is a 'DMZ' (demilitarized zone) designed to do?

Isolate public-facing systems from the internal network

Increase network speed

Replace firewalls entirely

Store all backup data

10. What is the primary purpose of conducting a 'threat modeling' exercise before a red team engagement?

To identify likely attack vectors and prioritize testing efforts

To guarantee all vulnerabilities will be found

To eliminate the need for actual testing

To increase the engagement cost

11. During the reconnaissance phase of a red team engagement, which passive information gathering technique poses the least risk of detection?

WHOIS and DNS lookups

Port scanning the target network

Social engineering calls to employees

Direct network packet capture

12. What is the primary function of a 'payload' in the context of exploitation?

To deliver malicious code or commands to a vulnerable system

To scan for open ports

To encrypt network traffic

To monitor system logs

13. Which tool is primarily used for web application penetration testing and analyzing HTTP traffic?

Metasploit

Burp Suite

Wireshark

Nessus

14. In vulnerability assessment, what is the difference between a false positive and a false negative?

False positive reports a vulnerability that doesn't exist; false negative misses a real vulnerability

False negative is more severe than false positive

There is no practical difference

False positive is only for network vulnerabilities

15. Which of the following best describes a 'persistence mechanism' in the context of red team operations?

A method to maintain continuous access after initial compromise

A technique to scan all open ports

A firewall rule that blocks traffic

A backup system for data storage

16. What is the primary goal of privilege escalation in a red team engagement?

To gain administrative or root access on a compromised system

To increase network bandwidth

To identify all user accounts

To disable firewall rules

17. Which framework is most commonly used by red teams to structure and document their engagement methodology?

NIST Cybersecurity Framework

MITRE ATT&CK

ISO 27001

PCI DSS

18. In a red team engagement, what does the term 'lateral movement' refer to?

Moving the engagement to a different geographic location

Pivoting from one compromised system to access other systems on the network

Physically relocating the red team to a new office

Changing the assessment timeline

19. Which reconnaissance tool is commonly used to perform active enumeration of DNS records and identify subdomains?

Nmap

Dig or nslookup