You have gained access to a network router's management interface through a default password. The router is in the path between the internal network and the internet. You want to use this access to reach a server on the internal network that is not directly accessible. Which technique is most appropriate?

Create a static route on the router to forward traffic from your machine to the internal server.

Disable the router's logging to avoid detection.

Upload a new firmware image that includes a backdoor.

Change the router's admin password to a value you know.

During an internal penetration test, you discover a network segment that uses a legacy protocol for device management. You need to identify all network devices on that segment without triggering IDS alerts. Which approach best achieves this while minimizing detection?

Passively listen to network traffic and analyze protocol banners and MAC OUI prefixes to identify device types.

Use SNMP community strings (public/private) to query device MIBs and enumerate system information.

Send a broadcast ARP request and analyze the responses to map active hosts and their MAC addresses.

Query the local DNS server for PTR records of the subnet to enumerate hostnames and infer device types.

During the reconnaissance phase of a penetration test, an analyst sends crafted packets to a target network and observes that responses are generated by multiple distinct IP addresses, each with a different MAC address, all responding to the same virtual IP. Which type of infrastructure component is most likely being identified?

A router performing NAT for multiple internal hosts

A switch with multiple VLANs configured

A load balancer distributing traffic across backend servers

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 2

Infrastructure Manipulation and Exploitation GXPN Practice Questions (Page 3)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 11–15

11application · medium
You are performing a man-in-the-middle attack and need to modify traffic in real-time. Which tool is best suited for this?
Select an answer first
12application · medium
You have gained access to a network router's management interface through a default password. The router is in the path between the internal network and the internet. You want to use this access to reach a server on the internal network that is not directly accessible. Which technique is most appropriate?
Select an answer first
13application · medium
During an internal penetration test, you discover a network segment that uses a legacy protocol for device management. You need to identify all network devices on that segment without triggering IDS alerts. Which approach best achieves this while minimizing detection?
Select an answer first
14foundation · easy
During the reconnaissance phase of a penetration test, an analyst sends crafted packets to a target network and observes that responses are generated by multiple distinct IP addresses, each with a different MAC address, all responding to the same virtual IP. Which type of infrastructure component is most likely being identified?
Select an answer first
15foundation · easy
Which network protocol is susceptible to cache poisoning attacks where an attacker sends a forged response to a recursive resolver, causing it to store incorrect address mappings for a domain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Infrastructure Manipulation and Exploitation GXPN Practice Questions (Page 3)

Questions 11–15

You are performing a man-in-the-middle attack and need to modify traffic in real-time. Which tool is best suited for this?

During an internal penetration test, you discover a network segment that uses a legacy protocol for device management. You need to identify all network devices on that segment without triggering IDS alerts. Which approach best achieves this while minimizing detection?

Which network protocol is susceptible to cache poisoning attacks where an attacker sends a forged response to a recursive resolver, causing it to store incorrect address mappings for a domain?

Keep studying — Network and Infrastructure Attacks