Which of the following is a common Linux privilege escalation vector?

A system with unnecessary network services

A cron job that runs a script writable by unprivileged users

A misconfigured firewall that allows SSH access

What is the primary purpose of endpoint control evasion techniques in a penetration test?

To avoid detection by security controls so that the tester can assess the true exposure of the endpoint

To ensure that the penetration test does not cause any disruption to the target environment

To permanently disable all security software on the target system

To prove that antivirus software is ineffective and should not be used

What is API unhooking in the context of EDR evasion?

Removing or restoring hooks placed by EDR on API functions to avoid monitoring

Creating new API functions to bypass EDR

Calling APIs in a different order to confuse EDR

Using undocumented APIs to avoid EDR

What is DLL side-loading in the context of application whitelisting bypass?

Replacing a system DLL with a malicious one

Using a DLL to inject code into a remote process

Placing a malicious DLL in a location where a trusted application will load it

Loading a DLL directly into the kernel to bypass security

Which of the following best defines privilege escalation?

The act of removing privileges from a user account

The act of exploiting a vulnerability to gain higher levels of access than originally granted

The process of auditing user privileges on a system

The process of assigning privileges to users in an organization

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 11)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 51–55

51foundation · easy
Which of the following is a common Linux privilege escalation vector?
Select an answer first
52foundation · easy
What is the primary purpose of endpoint control evasion techniques in a penetration test?
Select an answer first
53foundation · easy
What is API unhooking in the context of EDR evasion?
Select an answer first
54foundation · easy
What is DLL side-loading in the context of application whitelisting bypass?
Select an answer first
55foundation · easy
Which of the following best defines privilege escalation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.