You are developing a PowerShell script for post-exploitation that must evade AMSI (Antimalware Scan Interface). The script uses `Invoke-Mimikatz`. You need to bypass AMSI while keeping the script functional. Which technique is most effective?

Rename the function `Invoke-Mimikatz` to `Invoke-M`.

Base64-encode the entire script and decode it at runtime.

Use reflection to patch the AMSI scan buffer to return `AMSI_RESULT_CLEAN` before executing the script.

Use `-EncodedCommand` to run the script.

You are developing a PowerShell payload that will be delivered as a file attachment. The client's AV is signature-based and flags common cmdlet names like `Invoke-Mimikatz`. You need to keep the payload functional while evading static detection. Which technique is most appropriate?

Rename the function `Invoke-Mimikatz` to `Invoke-M` and update all references.

Split the script into multiple files and reassemble them on the target.

Base64-encode the entire script and decode it at runtime using `[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(...))`.

Use `-EncodedCommand` in the command line to pass the script to PowerShell.

You have compromised a Windows machine and need to establish persistence. The client's security team monitors scheduled tasks and services. Which persistence mechanism is least likely to be monitored?

Install a Windows service that runs a binary.

Create a scheduled task that runs a PowerShell script every hour.

Use a WMI event subscription to execute a script when the system starts.

Add a registry run key that executes a script at logon.

After compromising a Windows host, you need to maintain access across reboots. You want to create a scheduled task that runs a PowerShell script stored in the registry. The script must be hidden from casual users. Which approach is most effective?

Use `schtasks /create /tn Updater /tr "powershell -ep bypass -enc " /sc onlogon` and store the encoded script in the task action.

Place a .ps1 script in the Startup folder and set it to run hidden.

Use a registry Run key to execute the script with `powershell -file C:\temp\script.ps1`.

Create a service that runs a script from a network share.

Which Python debugging technique is most effective for stepping through code line by line to inspect variable values?

Running the script with python -O

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 1)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 1–5

1expert · hard
You are developing a PowerShell script for post-exploitation that must evade AMSI (Antimalware Scan Interface). The script uses `Invoke-Mimikatz`. You need to bypass AMSI while keeping the script functional. Which technique is most effective?
Select an answer first
2application · medium
You are developing a PowerShell payload that will be delivered as a file attachment. The client's AV is signature-based and flags common cmdlet names like `Invoke-Mimikatz`. You need to keep the payload functional while evading static detection. Which technique is most appropriate?
Select an answer first
3application · medium
You have compromised a Windows machine and need to establish persistence. The client's security team monitors scheduled tasks and services. Which persistence mechanism is least likely to be monitored?
Select an answer first
4application · medium
After compromising a Windows host, you need to maintain access across reboots. You want to create a scheduled task that runs a PowerShell script stored in the registry. The script must be hidden from casual users. Which approach is most effective?
Select an answer first
5foundation · easy
Which Python debugging technique is most effective for stepping through code line by line to inspect variable values?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.