What is polymorphism in the context of antivirus evasion?

A technique that encrypts the malware with a static key

A technique that only works against heuristic-based detection

A technique where the malware changes its code signature each time it replicates or runs

A technique that uses multiple different payloads in a single attack

What is the role of reverse engineering in analyzing security patches?

To decompile or disassemble the patched binary to see the code changes

To test the patch on a live system

To encrypt the patch to protect it from attackers

To sign the patch with a digital certificate

What is fuzzing in the context of vulnerability discovery?

A technique that scans for open ports on a network

A technique that sends malformed or unexpected input to a program to trigger crashes or vulnerabilities

A technique that monitors network traffic for attacks

A technique that analyzes binary code for known signatures

You have compromised a Windows server and have a shell as a service account with SeImpersonatePrivilege. The server is fully patched, and the EDR is configured to block known potato exploit binaries. You need to escalate to SYSTEM without triggering the EDR. Which approach is most appropriate?

Dump the SAM database and use pass-the-hash to authenticate as SYSTEM.

Search for a kernel exploit that is not blocked by the EDR.

Use the original JuicyPotato binary because it is the most reliable.

Use a custom potato exploit that performs the same token impersonation but is not signatured by the EDR.

What is the purpose of threat modeling for a product?

To write user documentation for the product

To identify and prioritize potential security threats and vulnerabilities

To create a marketing plan for the product

To test the product's performance under attack

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 8)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 36–40

36foundation · easy
What is polymorphism in the context of antivirus evasion?
Select an answer first
37foundation · easy
What is the role of reverse engineering in analyzing security patches?
Select an answer first
38foundation · easy
What is fuzzing in the context of vulnerability discovery?
Select an answer first
39expert · hard
You have compromised a Windows server and have a shell as a service account with SeImpersonatePrivilege. The server is fully patched, and the EDR is configured to block known potato exploit binaries. You need to escalate to SYSTEM without triggering the EDR. Which approach is most appropriate?
Select an answer first
40foundation · easy
What is the purpose of threat modeling for a product?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.