A penetration tester has obtained a low-privileged shell on a Linux server. The tester finds that the /usr/bin/find binary has the SUID bit set and is owned by root. Which technique would allow the tester to escalate privileges to root?

Read the /etc/shadow file to obtain the root password hash and crack it.

Run 'find / -exec /bin/sh \;' to execute a shell with root privileges.

Exploit a kernel vulnerability to gain root access.

Use 'sudo find / -exec whoami \;' to run commands as root.

You have a shell as a standard user on a Windows 10 machine with UAC set to the default level. You need to execute a payload with elevated privileges, but the EDR monitors for known UAC bypass techniques such as fodhelper.exe registry modifications. Which technique is most appropriate?

Use the fodhelper.exe registry modification because it is the most reliable.

Disable UAC by modifying the registry key 'EnableLUA' to 0.

Use a custom UAC bypass that leverages an auto-elevating process but modifies a different registry key or uses a different mechanism not monitored by the EDR.

Use a DLL side-loading attack against a trusted application to gain elevated privileges.

What is the role of kernel vulnerabilities in privilege escalation?

They are only relevant to Linux systems

They are only exploitable by physical attackers

They can allow an unprivileged user to execute code in kernel mode, gaining full system control

They can only cause denial of service, not privilege escalation

A development team is about to release a web application and wants to identify security vulnerabilities in the source code before deployment. They have a limited budget and need a quick automated scan. Which approach is most appropriate?

Run a dynamic application security testing (DAST) tool against the deployed application.

Use a fuzzer to test the application's input handling.

Run a static application security testing (SAST) tool that scans the source code for common vulnerabilities.

Perform a manual code review of the entire codebase.

During a penetration test, you discover that a Windows 10 workstation is running an outdated kernel with a known local privilege escalation vulnerability. You have a standard user shell. Which approach is most appropriate to escalate privileges to SYSTEM?

Use a UAC bypass to gain elevated privileges and then run the kernel exploit.

Use a publicly available exploit for the kernel vulnerability to gain SYSTEM privileges.

Search for misconfigured services that run as SYSTEM and attempt to exploit them.

Dump the SAM database to recover the administrator password and use it to log in as SYSTEM.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 1

Endpoint Control Evasions and Escalation GXPN Practice Questions (Page 9)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 73 practice questions to prepare you well beyond it. (estimate)

73questions here

15free pages

20concepts

20 Concepts in This Objective

Endpoint Control Evasion Fundamentals
Antivirus Evasion Techniques
Host-Based Intrusion Detection System (HIDS) Evasion
Application Whitelisting Bypass
Endpoint Detection and Response (EDR) Evasion
Privilege Escalation Fundamentals
Windows Privilege Escalation Techniques
Linux Privilege Escalation Techniques
Token Manipulation and Impersonation
Service and Scheduled Task Exploitation
Credential Harvesting and Reuse
UAC Bypass Techniques
Kernel Exploitation Basics
Product Security Testing Concepts
Threat Modeling for Products
Secure Code Review
Fuzzing and Vulnerability Discovery
Exploit Development for Product Testing
Patch Analysis and Reverse Engineering
Reporting and Remediation Guidance

Questions 41–45

41application · medium
A penetration tester has obtained a low-privileged shell on a Linux server. The tester finds that the /usr/bin/find binary has the SUID bit set and is owned by root. Which technique would allow the tester to escalate privileges to root?
Select an answer first
42expert · hard
You have a shell as a standard user on a Windows 10 machine with UAC set to the default level. You need to execute a payload with elevated privileges, but the EDR monitors for known UAC bypass techniques such as fodhelper.exe registry modifications. Which technique is most appropriate?
Select an answer first
43foundation · easy
What is the role of kernel vulnerabilities in privilege escalation?
Select an answer first
44application · medium
A development team is about to release a web application and wants to identify security vulnerabilities in the source code before deployment. They have a limited budget and need a quick automated scan. Which approach is most appropriate?
Select an answer first
45application · medium
During a penetration test, you discover that a Windows 10 workstation is running an outdated kernel with a known local privilege escalation vulnerability. You have a standard user shell. Which approach is most appropriate to escalate privileges to SYSTEM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.