You are mapping a network that uses both IPv4 and IPv6. You need to identify all infrastructure devices, but your tools only support IPv4. What is the best approach?

Use a dual-stack scanner that can handle both protocols.

Use IPv4-to-IPv6 translation techniques to scan IPv6 addresses.

Focus on IPv4 and ignore IPv6 devices.

Use DNS to discover IPv6 addresses and then manually test them.

You have found a network switch with a known firmware vulnerability. You want to exploit it to gain a foothold. What is the first step?

Use a generic exploit that works on all versions.

Immediately launch a brute-force attack on the management interface.

Disable the switch's logging to avoid detection.

Identify the exact firmware version and available exploits.

An attacker sends a forged SNMP response to a network management station, claiming that a critical router is down. The management station then marks the router as unavailable and reroutes traffic. Which network protocol weakness is being exploited?

SNMP MIB objects are world-readable by default

SNMP uses UDP, which is connectionless and allows easy spoofing of source IP addresses

SNMP community strings are often sent in cleartext and can be guessed or sniffed

SNMP lacks authentication for trap messages in many versions

You are assessing a network that uses a redundant pair of routers with HSRP for gateway redundancy. You want to become the active router to intercept traffic, but you must avoid causing a permanent outage. Which technique is most effective?

Send a crafted HSRP message with a higher priority to become the active router.

Poison the ARP cache of the clients to redirect traffic to your machine.

Disable the active router's interfaces to force a failover to the standby router.

Use SNMP to change the HSRP priority on the active router.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 2

Infrastructure Manipulation and Exploitation GXPN Practice Questions (Page 4)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 16–20

16expert · hard
You are mapping a network that uses both IPv4 and IPv6. You need to identify all infrastructure devices, but your tools only support IPv4. What is the best approach?
Select an answer first
17application · medium
You have found a network switch with a known firmware vulnerability. You want to exploit it to gain a foothold. What is the first step?
Select an answer first
18foundation · easy
An attacker sends a forged SNMP response to a network management station, claiming that a critical router is down. The management station then marks the router as unavailable and reroutes traffic. Which network protocol weakness is being exploited?
Select an answer first
19foundation · easy
An attacker wants to map the network infrastructure of a target organization. Which technique is specifically used to identify routers, switches, and other Layer 3 devices by sending packets with incrementally increasing TTL values and analyzing ICMP Time Exceeded messages?
Select an answer first
20expert · hard
You are assessing a network that uses a redundant pair of routers with HSRP for gateway redundancy. You want to become the active router to intercept traffic, but you must avoid causing a permanent outage. Which technique is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.