You are testing an EDR solution that uses user-mode API hooking to monitor process behavior. You need to execute a payload that performs process injection without being detected by the EDR's hooks. Which technique is most appropriate?

Use a reflective DLL injection technique that loads the payload into memory without calling LoadLibrary.

Use PowerShell's Invoke-Mimikatz to perform the injection.

Use the standard Windows API functions like VirtualAllocEx and WriteProcessMemory to perform the injection.

Use direct system calls (syscalls) to invoke NtAllocateVirtualMemory and NtWriteVirtualMemory, bypassing the user-mode hooks.

A product security team is testing a new file parser for a document viewer. They want to discover memory corruption vulnerabilities before release. Which technique is most appropriate?

Use a coverage-guided fuzzer like libFuzzer or AFL to feed malformed inputs to the parser and monitor for crashes.

Run a static analysis tool to scan for common vulnerabilities.

Perform a manual code review of the parser source code.

Deploy the parser to production and monitor for crashes.

What is the purpose of password dumping in privilege escalation?

To delete password hashes to prevent login

To extract password hashes or plaintext credentials from memory or system files

To change a user's password to gain access

To encrypt password hashes for secure storage

What is a key element of an effective security finding report?

A copy of the source code of the product

A detailed log of every command executed

A clear description of the vulnerability and its impact

A list of all tools used during the test

Which of the following is a common technique used for endpoint control evasion?

Using only open-source tools to avoid detection

Increasing the volume of network traffic to overwhelm the IDS

Disabling the Windows firewall via the command line

Obfuscating payloads to change their signature

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 7)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 31–35

31application · medium
You are testing an EDR solution that uses user-mode API hooking to monitor process behavior. You need to execute a payload that performs process injection without being detected by the EDR's hooks. Which technique is most appropriate?
Select an answer first
32application · medium
A product security team is testing a new file parser for a document viewer. They want to discover memory corruption vulnerabilities before release. Which technique is most appropriate?
Select an answer first
33foundation · easy
What is the purpose of password dumping in privilege escalation?
Select an answer first
34foundation · easy
What is a key element of an effective security finding report?
Select an answer first
35foundation · easy
Which of the following is a common technique used for endpoint control evasion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.