A tester is developing an exploit for a service that uses seccomp to allow only read, write, exit, and sigreturn. The tester has a ROP chain that can call any libc function. The goal is to read a file and exfiltrate its contents. Which approach is most likely to succeed?

Use open, read, and write syscalls to read the file and send it to the network.

Use sigreturn-oriented programming (SROP) to set up a syscall frame that performs an open syscall.

Use mmap to map the file into memory, then use write to send it, assuming the file descriptor is already open.

Use the existing file descriptor of the network socket to write data, and use read to read from a file descriptor that is already open.

Control Flow Integrity (CFI) is designed to prevent which type of attack?

Redirecting indirect branches to unintended targets

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 1

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 4)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

9concepts

Questions 16–20

16expert · hard
A tester is developing an exploit for a service that uses seccomp to allow only read, write, exit, and sigreturn. The tester has a ROP chain that can call any libc function. The goal is to read a file and exfiltrate its contents. Which approach is most likely to succeed?
Select an answer first
17foundation · easy
Control Flow Integrity (CFI) is designed to prevent which type of attack?
Select an answer first
18foundation · easy
Which mitigation makes the Global Offset Table (GOT) read-only after dynamic linking completes, preventing an attacker from overwriting function pointers to redirect execution?
Select an answer first
19foundation · easy
Which Linux exploit mitigation is designed to prevent an attacker from predicting the memory addresses of specific functions or variables across different executions of the same program?
Select an answer first
20foundation · easy
Which technique can be used to bypass PIE without a full address leak, by only modifying the lower bytes of a pointer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 4)

Questions 16–20

A tester is developing an exploit for a service that uses seccomp to allow only read, write, exit, and sigreturn. The tester has a ROP chain that can call any libc function. The goal is to read a file and exfiltrate its contents. Which approach is most likely to succeed?

Control Flow Integrity (CFI) is designed to prevent which type of attack?

Which mitigation makes the Global Offset Table (GOT) read-only after dynamic linking completes, preventing an attacker from overwriting function pointers to redirect execution?

Which Linux exploit mitigation is designed to prevent an attacker from predicting the memory addresses of specific functions or variables across different executions of the same program?

Which technique can be used to bypass PIE without a full address leak, by only modifying the lower bytes of a pointer?

Keep studying — Exploit Mitigation Bypass Techniques