You are automating a web application scan with Burp Suite and need to extract all unique parameters from the scan results. The results are in a Burp project file. Which scripting approach is most efficient?

Use `grep` to search for 'param' in the project file.

Manually open the Burp project file in a text editor and note the parameters.

Use a PowerShell script that reads the file as text and uses `Select-String` to find parameters.

Use a Python script that reads the Burp project XML file and parses it with `xml.etree.ElementTree` to extract parameter names.

You have a Python script that sends a large number of HTTP requests to a web server. The script is slow because it sends requests sequentially. You need to improve performance without overwhelming the server. Which approach is best?

Use a thread pool with a limited number of concurrent workers.

Use asyncio to send all requests concurrently.

Increase the timeout for each request.

Use multiprocessing to send requests in parallel processes.

Which optimization technique is most appropriate for a Python script that repeatedly performs the same expensive computation inside a loop?

Increasing the number of loop iterations

Moving the computation outside the loop and storing the result in a variable

Adding more comments to the code

You are writing a Python script to generate a payload that must be encrypted with AES-256-CBC before being sent to a C2 server. The key is derived from a passphrase. Which approach correctly implements this?

Use `os.urandom(32)` as the key and send the key along with the payload.

Use `hashlib.pbkdf2_hmac('sha256', passphrase, salt, 100000)` to derive a 32-byte key, then use `Crypto.Cipher.AES` in CBC mode with a random IV.

Use `hashlib.md5(passphrase).digest()` to derive a 16-byte key and use AES in ECB mode.

Use `passphrase.encode('utf-8')` directly as the key and use AES in CTR mode.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 8)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 36–40

36application · medium
You are automating a web application scan with Burp Suite and need to extract all unique parameters from the scan results. The results are in a Burp project file. Which scripting approach is most efficient?
Select an answer first
37expert · hard
You have a Python script that sends a large number of HTTP requests to a web server. The script is slow because it sends requests sequentially. You need to improve performance without overwhelming the server. Which approach is best?
Select an answer first
38foundation · easy
Which optimization technique is most appropriate for a Python script that repeatedly performs the same expensive computation inside a loop?
Select an answer first
39application · medium
You are writing a Python script to generate a payload that must be encrypted with AES-256-CBC before being sent to a C2 server. The key is derived from a passphrase. Which approach correctly implements this?
Select an answer first
40foundation · easy
Which Python module provides low-level socket programming to create custom TCP connections?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.