Which of the following is a common vulnerability that a secure code review might identify?

A slow database query that causes timeouts

SQL injection due to unsanitized user input

A user interface that is not intuitive

A missing feature that users expect

Which of the following is a common step in threat modeling?

Configuring a firewall for the product

Decomposing the application to identify entry points and trust boundaries

Running a vulnerability scanner against the product

Writing a penetration test report

A penetration tester has compromised a Windows service account that has the SeAssignPrimaryTokenPrivilege and SeImpersonatePrivilege enabled. The tester wants to escalate to SYSTEM. However, the environment has a security product that monitors for known token impersonation tools like JuicyPotato. Which approach would be most effective?

Use a kernel exploit to gain SYSTEM privileges.

Run JuicyPotato with obfuscated arguments to avoid detection.

Use a UAC bypass to gain administrative privileges and then use a service to run as SYSTEM.

Manually implement token impersonation using Windows API calls to duplicate a SYSTEM token and create a process with it.

A penetration tester has discovered a critical remote code execution vulnerability in a client's web application. The client asks for a report. What is the most important element to include in the report?

The CVSS score and severity rating of the vulnerability.

Clear remediation steps that address the root cause of the vulnerability.

A detailed proof-of-concept exploit code that demonstrates the vulnerability.

The names of the vulnerable software and version numbers.

Why is product security testing important in the software development lifecycle?

It ensures the product has no bugs at all

It is required by law for all software products

It helps identify and fix vulnerabilities before the product is released, reducing risk

It replaces the need for regular security updates

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 12)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 56–60

56foundation · easy
Which of the following is a common vulnerability that a secure code review might identify?
Select an answer first
57foundation · easy
Which of the following is a common step in threat modeling?
Select an answer first
58expert · hard
A penetration tester has compromised a Windows service account that has the SeAssignPrimaryTokenPrivilege and SeImpersonatePrivilege enabled. The tester wants to escalate to SYSTEM. However, the environment has a security product that monitors for known token impersonation tools like JuicyPotato. Which approach would be most effective?
Select an answer first
59application · medium
A penetration tester has discovered a critical remote code execution vulnerability in a client's web application. The client asks for a report. What is the most important element to include in the report?
Select an answer first
60foundation · easy
Why is product security testing important in the software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.