A penetration tester has low-privileged access to a Windows server. The tester discovers that a scheduled task runs as SYSTEM and the task's action points to a script in a directory where the tester has write permissions. However, the tester also notices that the task is configured to run only when the user is logged on. Which approach would be most reliable to escalate privileges?

Use a kernel exploit to gain SYSTEM privileges directly.

Dump the credentials of the logged-on user and use pass-the-hash.

Replace the scheduled task's action to run a malicious executable immediately.

Modify the script to add a reverse shell and wait for the task to trigger when an administrator logs on.

Which of the following is a technique used to evade Host-Based Intrusion Detection Systems (HIDS)?

Disabling the HIDS service through the Windows registry

Encrypting the hard drive to prevent HIDS from reading files

Deleting or modifying log entries to remove traces of malicious activity

Using a VPN to hide the source IP address

During a Linux penetration test, you discover a custom SUID binary owned by root that executes a shell command using the system() function with a user-controlled environment variable. You need to escalate privileges to root. Which technique is most appropriate?

Overwrite the binary's configuration file to inject a malicious library using LD_PRELOAD.

Use a kernel exploit to gain root privileges.

Set the PATH environment variable to point to a malicious executable named after the command invoked by the binary.

Create a cron job that runs a reverse shell as root.

A penetration tester has compromised a Windows service account that has the SeImpersonatePrivilege enabled. The tester wants to escalate privileges to SYSTEM. Which technique would be most effective in this scenario?

Modify the service's registry key to run a malicious binary as SYSTEM.

Use a tool like JuicyPotato to impersonate a SYSTEM token and execute a command.

Use a kernel exploit to gain SYSTEM privileges.

Dump the SAM database to obtain the administrator hash and use pass-the-hash.

What is product security testing?

The process of marketing a product to security-conscious customers

The process of ensuring a product is user-friendly

The process of testing a product's performance under load

The process of evaluating a product's security posture by identifying vulnerabilities and weaknesses

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 4)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 16–20

16expert · hard
A penetration tester has low-privileged access to a Windows server. The tester discovers that a scheduled task runs as SYSTEM and the task's action points to a script in a directory where the tester has write permissions. However, the tester also notices that the task is configured to run only when the user is logged on. Which approach would be most reliable to escalate privileges?
Select an answer first
17foundation · easy
Which of the following is a technique used to evade Host-Based Intrusion Detection Systems (HIDS)?
Select an answer first
18application · medium
During a Linux penetration test, you discover a custom SUID binary owned by root that executes a shell command using the system() function with a user-controlled environment variable. You need to escalate privileges to root. Which technique is most appropriate?
Select an answer first
19application · medium
A penetration tester has compromised a Windows service account that has the SeImpersonatePrivilege enabled. The tester wants to escalate privileges to SYSTEM. Which technique would be most effective in this scenario?
Select an answer first
20foundation · easy
What is product security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.