Which of the following is a common Windows privilege escalation vector?

Exploiting a vulnerable service running with SYSTEM privileges

Configuring a firewall rule to allow remote access

Using a weak password on a user account

What is a common misconfiguration that can lead to Windows privilege escalation?

A service executable file that is writable by standard users

A firewall rule that allows inbound traffic on port 445

A user account with a password that never expires

A system with automatic updates enabled

During a Linux assessment, you find a SUID binary that is owned by root and has the SUID bit set. The binary is a custom tool that reads a configuration file from a directory that is writable by your user. You need to escalate to root. Which technique is most appropriate?

Place a malicious configuration file in the writable directory that the SUID binary reads, causing it to execute arbitrary commands as root.

Use LD_PRELOAD to inject a malicious library into the SUID binary.

Replace the SUID binary with a malicious executable.

Use a kernel exploit to gain root privileges.

What is the purpose of providing remediation guidance in a security report?

To assign blame for the vulnerabilities

To provide a list of all possible vulnerabilities in the product

To help developers fix the identified vulnerabilities effectively

To justify the cost of the security test

Which of the following is a common method to bypass application whitelisting?

Using trusted binaries like PowerShell to execute arbitrary code

Renaming a malicious executable to a whitelisted name

Compiling a custom binary that is not in the whitelist

Using a USB drive to bypass the whitelist

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 3)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 11–15

11foundation · easy
Which of the following is a common Windows privilege escalation vector?
Select an answer first
12foundation · easy
What is a common misconfiguration that can lead to Windows privilege escalation?
Select an answer first
13expert · hard
During a Linux assessment, you find a SUID binary that is owned by root and has the SUID bit set. The binary is a custom tool that reads a configuration file from a directory that is writable by your user. You need to escalate to root. Which technique is most appropriate?
Select an answer first
14foundation · easy
What is the purpose of providing remediation guidance in a security report?
Select an answer first
15foundation · easy
Which of the following is a common method to bypass application whitelisting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.