Which scripting approach is commonly used to automate privilege escalation on a compromised Linux host?

Writing a script that changes the hostname

Using a script to reboot the system

Running a script that checks for misconfigured sudo permissions

Creating a script that lists running processes

You have a Python script that automates post-exploitation tasks across multiple hosts. The script sometimes fails due to network timeouts, and you need to improve its reliability without significantly increasing runtime. Which approach is most effective?

Add retry logic with exponential backoff for network operations.

Catch all exceptions and continue without logging.

Increase the timeout value for all network operations to 60 seconds.

Run all operations in parallel using threads.

You are developing an exploit for a service that uses a custom protocol. The protocol requires a 4-byte length prefix followed by the payload. The payload contains shellcode that must be aligned to a 16-byte boundary. Which scripting approach correctly crafts the packet?

Use `struct.pack('>I', len(payload))` and send the payload as-is without padding.

Use `socket.send(payload)` without a length prefix.

Use Python's `struct.pack('<I', len(payload))` followed by `payload.ljust(16 * ((len(payload) + 15) // 16), b'\x90')` to pad the payload to a multiple of 16 bytes.

Use `payload.encode('utf-8')` and prepend the length as a string.

You are automating a vulnerability scan using Nessus and need to parse the results to identify hosts with critical vulnerabilities. The scan output is in .nessus format. Which scripting approach is most efficient?

Write a Python script that uses the `xml.etree.ElementTree` module to parse the .nessus XML file and filter for CVSS scores above 9.0.

Manually open the .nessus file in a text editor and note the critical hosts.

Use a PowerShell script that reads the file as text and uses `Select-String` to find critical vulnerabilities.

Use `grep` in a shell script to search for 'critical' in the .nessus file.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 7)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which scripting approach is commonly used to automate privilege escalation on a compromised Linux host?
Select an answer first
32foundation · easy
Which Python module provides hashing algorithms like SHA-256 and MD5?
Select an answer first
33expert · hard
You have a Python script that automates post-exploitation tasks across multiple hosts. The script sometimes fails due to network timeouts, and you need to improve its reliability without significantly increasing runtime. Which approach is most effective?
Select an answer first
34expert · hard
You are developing an exploit for a service that uses a custom protocol. The protocol requires a 4-byte length prefix followed by the payload. The payload contains shellcode that must be aligned to a 16-byte boundary. Which scripting approach correctly crafts the packet?
Select an answer first
35application · medium
You are automating a vulnerability scan using Nessus and need to parse the results to identify hosts with critical vulnerabilities. The scan output is in .nessus format. Which scripting approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.