What is the purpose of process injection as a HIDS evasion technique?

To run malicious code within the context of a legitimate process to avoid detection

To terminate the HIDS process by injecting a kill command

To create a new process that mimics a legitimate one

To inject malicious code into the kernel to disable HIDS

What is token impersonation in Windows privilege escalation?

Encrypting a user's token to prevent access

Deleting a user's token to lock them out

Using another user's access token to perform actions with their privileges

Creating a new token for a user

You have compromised a Windows workstation and obtained the NTLM hash of a local administrator account. You need to move laterally to a server where the same local administrator password is used. Which technique is most appropriate?

Use token impersonation to steal a token from a process on the server.

Use a kernel exploit on the server to gain SYSTEM privileges.

Use pass-the-hash to authenticate to the server using the NTLM hash without knowing the plaintext password.

Crack the NTLM hash to obtain the plaintext password and then use it to log in.

What is the purpose of timing-based evasion in EDR evasion?

To use the system clock to determine when EDR is inactive

To delay malicious actions to avoid triggering real-time detection

To execute attacks only during off-peak hours

To synchronize attacks with system maintenance windows

During a Windows assessment, you have a shell as a standard user with UAC set to 'Always Notify'. You need to execute a payload with elevated privileges without triggering a UAC prompt that would alert the user. Which technique is most appropriate?

Use a DLL side-loading attack against a trusted application to execute your payload with elevated privileges.

Use an auto-elevating process like 'fodhelper.exe' and modify the registry key 'HKCU\Software\Classes\ms-settings\Shell\Open\command' to point to your payload.

Run your payload with the 'runas' command and provide the administrator password.

Disable UAC by modifying the registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA' to 0.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 1)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 1–5

1foundation · easy
What is the purpose of process injection as a HIDS evasion technique?
Select an answer first
2foundation · easy
What is token impersonation in Windows privilege escalation?
Select an answer first
3application · medium
You have compromised a Windows workstation and obtained the NTLM hash of a local administrator account. You need to move laterally to a server where the same local administrator password is used. Which technique is most appropriate?
Select an answer first
4foundation · easy
What is the purpose of timing-based evasion in EDR evasion?
Select an answer first
5application · medium
During a Windows assessment, you have a shell as a standard user with UAC set to 'Always Notify'. You need to execute a payload with elevated privileges without triggering a UAC prompt that would alert the user. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.