A security researcher is analyzing a vendor's security patch to understand the underlying vulnerability. The patch modifies a single function in a binary. Which reverse engineering technique is most effective for identifying the vulnerability?

Disassemble the entire binary and manually review every function.

Run the unpatched binary in a debugger and set breakpoints on all functions.

Use a fuzzer to find a crash in the patched binary.

Perform a binary diff between the patched and unpatched versions to isolate the changed code.

A penetration tester is targeting a Windows workstation that has a strict application whitelisting policy allowing only signed Microsoft executables to run. The tester has a DLL payload that needs to be executed in the context of a legitimate application. Which technique would most likely bypass the whitelisting control?

Use a script such as PowerShell to load the DLL directly into memory.

Place the DLL in the same directory as a vulnerable signed Microsoft executable that performs DLL loading from its local path.

Rename the DLL to a name that matches a Microsoft system DLL and place it in the Windows directory.

Compile the DLL as a signed binary using a stolen code-signing certificate.

What is a common way to exploit a misconfigured service for privilege escalation?

Changing the service binary path to point to a malicious executable

Restarting the service to trigger a vulnerability

Changing the service account to a lower-privileged user

Stopping the service to cause a denial of service

A red team has achieved code execution on a Windows 10 endpoint protected by a next-gen AV that uses both signature and behavioral detection, and an EDR that hooks user-mode APIs and monitors ETW. The team needs to run a custom credential-dumping tool that is known to trigger behavioral detections. The team also wants to avoid alerting the SOC. Which combination of techniques would be most effective?

Use a fileless PowerShell script that downloads and executes the tool in memory, relying on obfuscation.

Run the tool from a network share with a renamed executable to avoid signature detection.

Use a reflective DLL injection to load the tool into a trusted process, unhook EDR hooks, and disable ETW for the process.

Use a signed Microsoft binary to run the tool via DLL side-loading, without any additional evasion.

What is the purpose of patch analysis in product security?

To create a new patch for a different vulnerability

To understand what vulnerabilities a patch fixes and identify the underlying issue

To apply patches to a system automatically

To test the performance of a patch

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 5)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 21–25

21application · medium
A security researcher is analyzing a vendor's security patch to understand the underlying vulnerability. The patch modifies a single function in a binary. Which reverse engineering technique is most effective for identifying the vulnerability?
Select an answer first
22application · medium
A penetration tester is targeting a Windows workstation that has a strict application whitelisting policy allowing only signed Microsoft executables to run. The tester has a DLL payload that needs to be executed in the context of a legitimate application. Which technique would most likely bypass the whitelisting control?
Select an answer first
23foundation · easy
What is a common way to exploit a misconfigured service for privilege escalation?
Select an answer first
24expert · hard
A red team has achieved code execution on a Windows 10 endpoint protected by a next-gen AV that uses both signature and behavioral detection, and an EDR that hooks user-mode APIs and monitors ETW. The team needs to run a custom credential-dumping tool that is known to trigger behavioral detections. The team also wants to avoid alerting the SOC. Which combination of techniques would be most effective?
Select an answer first
25foundation · easy
What is the purpose of patch analysis in product security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 5)

Questions 21–25

A security researcher is analyzing a vendor's security patch to understand the underlying vulnerability. The patch modifies a single function in a binary. Which reverse engineering technique is most effective for identifying the vulnerability?

What is a common way to exploit a misconfigured service for privilege escalation?

What is the purpose of patch analysis in product security?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing