You are exploiting a heap overflow in a Windows application that uses the front-end heap and has DEP enabled. You have achieved arbitrary write but not arbitrary read. Which technique is most appropriate to gain code execution?

Overwrite a function pointer with the address of a ROP gadget that calls VirtualProtect, using a module base leak from a previous step.

Use a 'Heap Feng Shui' technique to allocate a chunk at a predictable address and place shellcode there.

Overwrite the heap metadata to create a fake chunk that gives you write-what-where.

Disable DEP by calling VirtualProtect directly from your arbitrary write primitive.

You are analyzing a Windows binary for a penetration test. You need to determine if the binary is compiled with ASLR support. Which of the following is the most reliable indicator?

The binary imports the function GetSystemTimeAsFileTime.

The binary has a .reloc section.

The binary is compiled with /GS flag.

The PE header has the DYNAMIC_BASE flag set in the DllCharacteristics field.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 2

Bypassing Windows Memory Protections GXPN Practice Questions (Page 4)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

Questions 16–20

16foundation · easy
Which Windows memory protection is designed to prevent the execution of code from memory pages that are not explicitly marked as executable?
Select an answer first
17foundation · easy
Which Windows mitigation places a random value (cookie) before the saved return address on the stack to detect stack buffer overflows?
Select an answer first
18application · medium
You are exploiting a heap overflow in a Windows application that uses the front-end heap and has DEP enabled. You have achieved arbitrary write but not arbitrary read. Which technique is most appropriate to gain code execution?
Select an answer first
19foundation · easy
Which mitigation requires that exception handlers be registered in a table of valid handlers, preventing the use of arbitrary addresses as exception handlers?
Select an answer first
20application · medium
You are analyzing a Windows binary for a penetration test. You need to determine if the binary is compiled with ASLR support. Which of the following is the most reliable indicator?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Bypassing Windows Memory Protections GXPN Practice Questions (Page 4)

Questions 16–20

Which Windows memory protection is designed to prevent the execution of code from memory pages that are not explicitly marked as executable?

Which Windows mitigation places a random value (cookie) before the saved return address on the stack to detect stack buffer overflows?

You are exploiting a heap overflow in a Windows application that uses the front-end heap and has DEP enabled. You have achieved arbitrary write but not arbitrary read. Which technique is most appropriate to gain code execution?

Which mitigation requires that exception handlers be registered in a table of valid handlers, preventing the use of arbitrary addresses as exception handlers?

You are analyzing a Windows binary for a penetration test. You need to determine if the binary is compiled with ASLR support. Which of the following is the most reliable indicator?

Keep studying — Exploit Mitigation Bypass Techniques