Which evasion technique is specifically designed to bypass security tools that only inspect the first hop of a redirect?

Using a 301 status code instead of 302

Using a meta refresh with a 0-second delay

Using a multi-hop redirect chain

Using an HTTP 200 response with a JavaScript redirect

Which obfuscation technique is specifically effective against signature-based antivirus detection?

Running the attack during off-peak hours

Using a well-known open-source exploit

An attacker wants to harvest credentials by redirecting a victim from a legitimate-looking login page to a malicious page. Which redirection approach is most likely to maintain a legitimate appearance while sending the victim to the attacker's credential harvesting page?

Placing a meta refresh tag on the legitimate site that redirects after a 10-second delay

Using a JavaScript alert to display the phishing URL before navigating

Using an HTTP 301 redirect from the legitimate site to the attacker's phishing page

Sending the victim an email with a direct link to the attacker's IP address

During a phishing assessment, you need to redirect a victim from a legitimate-looking login page to a credential-harvesting server. The redirect must not appear as a suspicious 3xx response in the proxy logs and must work even if JavaScript is disabled. Which redirection technique best meets these constraints?

Meta refresh tag with a 0-second delay

JavaScript window.location assignment

GIAC Cloud Penetration Tester

Domain 6Objective 2

Redirection and Attack Obfuscation GCPN Practice Questions (Page 1)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

Questions 1–5

1foundation · easy
Which evasion technique is specifically designed to bypass security tools that only inspect the first hop of a redirect?
Select an answer first
2foundation · easy
Which obfuscation technique is specifically effective against signature-based antivirus detection?
Select an answer first
3foundation · easy
Which HTTP response status code is specifically defined for a permanent URL redirection?
Select an answer first
4foundation · easy
An attacker wants to harvest credentials by redirecting a victim from a legitimate-looking login page to a malicious page. Which redirection approach is most likely to maintain a legitimate appearance while sending the victim to the attacker's credential harvesting page?
Select an answer first
5application · medium
During a phishing assessment, you need to redirect a victim from a legitimate-looking login page to a credential-harvesting server. The redirect must not appear as a suspicious 3xx response in the proxy logs and must work even if JavaScript is disabled. Which redirection technique best meets these constraints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Redirection and Attack Obfuscation GCPN Practice Questions (Page 1)

Questions 1–5

Which evasion technique is specifically designed to bypass security tools that only inspect the first hop of a redirect?

Which obfuscation technique is specifically effective against signature-based antivirus detection?

Which HTTP response status code is specifically defined for a permanent URL redirection?

An attacker wants to harvest credentials by redirecting a victim from a legitimate-looking login page to a malicious page. Which redirection approach is most likely to maintain a legitimate appearance while sending the victim to the attacker's credential harvesting page?

Keep studying — Credential Attacks and Evasion