A penetration tester is assessing a Windows server that is fully patched but has a known vulnerable kernel driver installed by a third-party application. The tester wants to escalate privileges to SYSTEM. Which approach is most appropriate?

Exploit the vulnerable kernel driver to gain SYSTEM privileges.

Use a UAC bypass to gain administrative privileges.

Use a user-mode exploit against a vulnerable service running as SYSTEM.

Use a pass-the-hash attack with a captured NTLM hash.

What is the primary goal of a secure code review?

To document the code for future maintenance

To improve the performance of the code

To identify security vulnerabilities and weaknesses in source code

To ensure the code follows coding standards

A penetration tester has access to a Windows 10 workstation as a standard user. The tester needs to run a malicious executable with administrative privileges without triggering a UAC prompt. Which technique would be most effective?

Disable UAC by modifying the registry key EnableLUA to 0.

Simply right-click the executable and select 'Run as administrator' and enter the administrator password.

Use a UAC bypass technique that exploits a trusted binary with auto-elevation, such as fodhelper.exe, to launch the payload.

Use a kernel exploit to gain SYSTEM privileges and then run the executable.

You are evading a host-based intrusion detection system (HIDS) that monitors file system changes and process creation. You need to maintain persistence on a Windows host without triggering the HIDS. Which technique is most appropriate?

Modify the registry Run key to execute your payload from a network share.

Use a DLL side-loading attack with a malicious DLL placed in the application directory.

Create a new scheduled task that runs your payload from a file on disk.

Use a reflective DLL injection to load your payload into a trusted process and avoid writing files to disk.

A security reviewer is examining a web application's source code. The reviewer notices that user input is concatenated directly into an SQL query string. Which vulnerability is most likely present, and what is the best remediation?

SQL injection; use parameterized queries or prepared statements.

Cross-site scripting; encode all output before rendering.

Buffer overflow; use safer string functions.

Command injection; use input validation to block special characters.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 2)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 6–10

6application · medium
A penetration tester is assessing a Windows server that is fully patched but has a known vulnerable kernel driver installed by a third-party application. The tester wants to escalate privileges to SYSTEM. Which approach is most appropriate?
Select an answer first
7foundation · easy
What is the primary goal of a secure code review?
Select an answer first
8application · medium
A penetration tester has access to a Windows 10 workstation as a standard user. The tester needs to run a malicious executable with administrative privileges without triggering a UAC prompt. Which technique would be most effective?
Select an answer first
9application · medium
You are evading a host-based intrusion detection system (HIDS) that monitors file system changes and process creation. You need to maintain persistence on a Windows host without triggering the HIDS. Which technique is most appropriate?
Select an answer first
10application · medium
A security reviewer is examining a web application's source code. The reviewer notices that user input is concatenated directly into an SQL query string. Which vulnerability is most likely present, and what is the best remediation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.