After gaining access to a Linux server, you need to automate the collection of system information and the exfiltration of specific files. You want to avoid installing any new tools on the target. Which approach is most appropriate?

Use Python to create a socket and send the files directly.

Write a bash script that uses built-in commands like uname, cat, and tar, then exfiltrates via a reverse shell.

Use curl to upload the files to a remote server.

Use scp to copy the files to your machine.

You are writing a PowerShell script to automate the creation of local user accounts on multiple Windows servers. The script must run without manual intervention and log any errors. Which approach is best?

Use a foreach loop with New-LocalUser and wrap the command in try/catch to log errors.

Use a scheduled task to run the script, but do not log errors.

Use Invoke-Command to run New-LocalUser on each server, but do not handle errors.

Use a for loop with net user commands and redirect output to a file.

During an internal penetration test, you need to enumerate all SMB shares accessible with a set of harvested credentials across 200 hosts. You want to avoid spawning new processes per host and keep the output in a structured format for later parsing. Which approach best meets these requirements?

Use PowerShell's `Get-SmbShare -CimSession` for each host in a foreach loop, exporting to CSV.

Write a Bash script using `smbclient -L //host -U user%pass` in a loop and parse the output with grep.

Run `net view \\host /all` in a bash loop for each host and redirect the text output to a single file.

Use a Python script with the impacket library to connect to each host's IPC$ share and call the NetShareEnum RPC method, storing results as JSON.

You need to generate a hash of a file to verify its integrity before and after transmission. The file is large, and you want to ensure the hash is computed efficiently. Which approach is best?

Use base64 encoding to represent the file and hash the encoded string.

Load the entire file into memory and compute the hash.

Use Python's hashlib to compute SHA-256 in chunks.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 4)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 16–20

16application · medium
After gaining access to a Linux server, you need to automate the collection of system information and the exfiltration of specific files. You want to avoid installing any new tools on the target. Which approach is most appropriate?
Select an answer first
17application · medium
You are writing a PowerShell script to automate the creation of local user accounts on multiple Windows servers. The script must run without manual intervention and log any errors. Which approach is best?
Select an answer first
18foundation · easy
Which Python construct is most appropriate for iterating over a list of IP addresses and performing a connection attempt to each one in sequence?
Select an answer first
19application · medium
During an internal penetration test, you need to enumerate all SMB shares accessible with a set of harvested credentials across 200 hosts. You want to avoid spawning new processes per host and keep the output in a structured format for later parsing. Which approach best meets these requirements?
Select an answer first
20application · medium
You need to generate a hash of a file to verify its integrity before and after transmission. The file is large, and you want to ensure the hash is computed efficiently. Which approach is best?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.