During a penetration test, you have achieved arbitrary write and read primitives in a 64-bit Windows 10 process that has DEP and ASLR enabled. The target application does not use CFG. You need to execute shellcode. Which approach is most appropriate?

Use your read primitive to leak the base address of a loaded module, then build a ROP chain using gadgets from that module to call VirtualProtect and mark your shellcode region executable.

Disable DEP by setting the /NXCOMPAT:NO linker flag at runtime from your exploit.

Use a partial overwrite of the return address to redirect to a one-gadget in ntdll without needing a full leak.

Directly jump to your shellcode address because DEP only affects stack memory, not heap memory.

You are exploiting a Windows service with DEP and ASLR enabled. You have a stack overflow and a way to leak the base address of kernel32.dll. You need to execute shellcode. Which approach is most efficient?

Build a ROP chain using gadgets from kernel32.dll to call VirtualProtect, then jump to your shellcode on the stack.

Use a partial overwrite of the return address to point to a 'jmp esp' gadget in kernel32.

Use the leaked kernel32 base to calculate the address of VirtualProtect and call it directly from your overflow.

Directly jump to your shellcode on the stack because the leak gives you the stack address.

Which of the following is a common weakness that can allow an attacker to bypass stack cookies (GS) without directly overwriting the cookie?

Using a format string vulnerability

Overwriting an exception handler

Which of the following is a reason why an attacker might chain multiple bypass techniques when exploiting a system with several memory protections enabled?

Each protection addresses a different aspect of memory safety, so multiple techniques are needed to overcome all of them.

Chaining techniques is required because each technique alone is always detected by antivirus.

Chaining techniques is necessary because no single technique can bypass any protection.

Chaining techniques makes the exploit more reliable by reducing the number of steps.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 2

Bypassing Windows Memory Protections GXPN Practice Questions (Page 1)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

Questions 1–5

1application · medium
During a penetration test, you have achieved arbitrary write and read primitives in a 64-bit Windows 10 process that has DEP and ASLR enabled. The target application does not use CFG. You need to execute shellcode. Which approach is most appropriate?
Select an answer first
2application · medium
You are exploiting a Windows service with DEP and ASLR enabled. You have a stack overflow and a way to leak the base address of kernel32.dll. You need to execute shellcode. Which approach is most efficient?
Select an answer first
3foundation · easy
Which of the following is a common weakness that can allow an attacker to bypass stack cookies (GS) without directly overwriting the cookie?
Select an answer first
4foundation · easy
Which of the following is a reason why an attacker might chain multiple bypass techniques when exploiting a system with several memory protections enabled?
Select an answer first
5foundation · easy
Which technique can be used to bypass ASLR by leaking the base address of a loaded module through a vulnerability that discloses memory contents?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.