What is the main advantage of fuzzing over manual code review?

It guarantees the discovery of all vulnerabilities

It does not require access to the source code

It can automatically test a wide range of inputs quickly

It is faster than any other testing method

During a Windows privilege escalation assessment, you find that a third-party service runs as SYSTEM and its executable file is writable by the Everyone group. You need to escalate privileges to SYSTEM. Which technique is most appropriate?

Modify the service's registry entry to point to a malicious executable.

Use a kernel exploit to gain SYSTEM privileges.

Replace the service executable with a malicious binary that spawns a reverse shell as SYSTEM, then restart the service.

Use token impersonation to steal a SYSTEM token from another process.

What is the general approach to exploiting a kernel vulnerability?

Compile a user-mode exploit and run it as an administrator

Modify the kernel configuration file to enable debug mode

Trigger the vulnerability to execute code in kernel context, often by using a crafted payload

Use a buffer overflow in a user application to gain root

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 15)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 71–73

71foundation · easy
What is the main advantage of fuzzing over manual code review?
Select an answer first
72application · medium
During a Windows privilege escalation assessment, you find that a third-party service runs as SYSTEM and its executable file is writable by the Everyone group. You need to escalate privileges to SYSTEM. Which technique is most appropriate?
Select an answer first
73foundation · easy
What is the general approach to exploiting a kernel vulnerability?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 15)

Questions 71–73

What is the main advantage of fuzzing over manual code review?

During a Windows privilege escalation assessment, you find that a third-party service runs as SYSTEM and its executable file is writable by the Everyone group. You need to escalate privileges to SYSTEM. Which technique is most appropriate?

What is the general approach to exploiting a kernel vulnerability?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing