A product security team wants to discover memory corruption vulnerabilities in a C++ application that parses untrusted input files. Which testing technique is most appropriate to start with?

Use a static analysis tool to scan for common vulnerability patterns.

Perform a manual source code review focusing on buffer handling.

Run a fuzzing campaign with a coverage-guided fuzzer like libFuzzer or AFL.

Develop a proof-of-concept exploit for a known vulnerability in a similar application.

A security researcher has discovered a memory corruption vulnerability in a proprietary protocol parser. The researcher has a proof-of-concept that causes a crash but wants to develop a reliable exploit that bypasses ASLR and DEP. Which approach is most appropriate?

Use a heap spray to place shellcode at a predictable address.

Disable ASLR and DEP in the target system before exploitation.

Inject shellcode directly into the process memory and jump to it.

Use a return-oriented programming (ROP) chain to execute code without injecting shellcode.

Which of the following is a common UAC bypass technique?

Changing the UAC level to 'Never Notify'

Running a process as a different user

Abusing a trusted Windows binary that auto-elevates to run malicious code

Using a keylogger to capture the admin password

You are developing a custom payload for a red team engagement. The target environment uses an EDR that performs static signature scanning and user-mode API hooking. You need to ensure the payload evades both static detection and runtime monitoring. Which approach is most effective?

Encrypt the payload with a unique key and decrypt it in memory, then use direct system calls to execute it.

Use a PowerShell script that downloads and executes the payload from a remote server.

Compile the payload with a different compiler to change its signature.

Use a well-known open-source payload and rely on its built-in obfuscation.

How can a misconfigured scheduled task be exploited for privilege escalation?

By creating a new scheduled task that runs as the current user

By deleting the scheduled task to prevent it from running

By modifying the task to run a malicious program with the task's configured privileges

By disabling the scheduled task service

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 13)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 61–65

61application · medium
A product security team wants to discover memory corruption vulnerabilities in a C++ application that parses untrusted input files. Which testing technique is most appropriate to start with?
Select an answer first
62expert · hard
A security researcher has discovered a memory corruption vulnerability in a proprietary protocol parser. The researcher has a proof-of-concept that causes a crash but wants to develop a reliable exploit that bypasses ASLR and DEP. Which approach is most appropriate?
Select an answer first
63foundation · easy
Which of the following is a common UAC bypass technique?
Select an answer first
64expert · hard
You are developing a custom payload for a red team engagement. The target environment uses an EDR that performs static signature scanning and user-mode API hooking. You need to ensure the payload evades both static detection and runtime monitoring. Which approach is most effective?
Select an answer first
65foundation · easy
How can a misconfigured scheduled task be exploited for privilege escalation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.