What is pass-the-hash in the context of credential reuse?

Stealing a password hash from a database

Using a password hash to crack the plaintext password

Encrypting a password hash to hide it

Using a captured password hash to authenticate without knowing the plaintext password

What is the purpose of UAC bypass techniques?

To disable UAC entirely on the system

To change the UAC settings in the registry

To execute elevated actions without triggering a UAC prompt

To create a new user account with admin privileges

A penetration tester has gained low-privileged access to a Windows server. The tester discovers that a third-party service runs as SYSTEM and its installation directory is writable by the Everyone group. Which privilege escalation technique would be most appropriate to gain SYSTEM privileges?

Use token impersonation to steal the token of the SYSTEM service process.

Replace the service executable with a malicious binary and restart the service.

Dump the SAM database to obtain the administrator password hash and use pass-the-hash.

Exploit a kernel vulnerability to gain SYSTEM privileges directly.

What is token duplication in the context of Windows privilege escalation?

Deleting a token and recreating it

Creating a copy of an existing token to use for a new process

Sharing a token between two users

Encrypting a token to protect it

During a penetration test, a tester has gained initial access to a Linux server running a host-based intrusion detection system (HIDS) that monitors file integrity and process execution. The tester needs to maintain persistence by modifying a system configuration file, but the HIDS will alert on the change. Which technique would best evade the HIDS while achieving persistence?

Write the modification to a new file and use a symlink to redirect the original path.

Stop the HIDS service, modify the file, then restart the service.

Use a rootkit to intercept the file read and write system calls, hiding the modification from the HIDS.

Modify the file directly and then restore its original timestamps using touch.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 6)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 26–30

26foundation · easy
What is pass-the-hash in the context of credential reuse?
Select an answer first
27foundation · easy
What is the purpose of UAC bypass techniques?
Select an answer first
28application · medium
A penetration tester has gained low-privileged access to a Windows server. The tester discovers that a third-party service runs as SYSTEM and its installation directory is writable by the Everyone group. Which privilege escalation technique would be most appropriate to gain SYSTEM privileges?
Select an answer first
29foundation · easy
What is token duplication in the context of Windows privilege escalation?
Select an answer first
30application · medium
During a penetration test, a tester has gained initial access to a Linux server running a host-based intrusion detection system (HIDS) that monitors file integrity and process execution. The tester needs to maintain persistence by modifying a system configuration file, but the HIDS will alert on the change. Which technique would best evade the HIDS while achieving persistence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.