A tester is explaining why ROP is effective against NX. Which statement is correct?

ROP uses existing executable code, so it does not need to execute code on the stack.

ROP uses the PLT to call functions, which bypasses NX.

ROP uses the heap to store shellcode, which is executable.

ROP disables NX by modifying the page permissions.

You are constructing a ROP chain for a 32-bit binary. You have a `pop; pop; ret` gadget at 0x08048456 and a `pop; ret` gadget at 0x0804843c. You need to call a function that takes two arguments. What is the correct stack layout?

function_address, 0x08048456, arg1, arg2

0x0804843c, arg1, arg2, function_address

arg1, arg2, 0x08048456, function_address

0x08048456, arg1, arg2, function_address

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 3

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 2)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
Which tool is commonly used to automatically search a binary or library for ROP gadgets?
Select an answer first
7application · easy
A tester is explaining why ROP is effective against NX. Which statement is correct?
Select an answer first
8application · medium
A tester is crafting a ROP chain for a 64-bit binary. The chain needs to call a function with four arguments. The tester has found 'pop rdi; ret', 'pop rsi; pop r15; ret', 'pop rdx; ret', and 'pop rcx; ret' gadgets. What is the correct order to set the arguments?
Select an answer first
9foundation · easy
Which mitigation does return-to-libc (ret2libc) primarily bypass?
Select an answer first
10application · medium
You are constructing a ROP chain for a 32-bit binary. You have a `pop; pop; ret` gadget at 0x08048456 and a `pop; ret` gadget at 0x0804843c. You need to call a function that takes two arguments. What is the correct stack layout?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 2)

Questions 6–10

Which tool is commonly used to automatically search a binary or library for ROP gadgets?

A tester is explaining why ROP is effective against NX. Which statement is correct?

A tester is crafting a ROP chain for a 64-bit binary. The chain needs to call a function with four arguments. The tester has found 'pop rdi; ret', 'pop rsi; pop r15; ret', 'pop rdx; ret', and 'pop rcx; ret' gadgets. What is the correct order to set the arguments?

Which mitigation does return-to-libc (ret2libc) primarily bypass?

You are constructing a ROP chain for a 32-bit binary. You have a `pop; pop; ret` gadget at 0x08048456 and a `pop; ret` gadget at 0x0804843c. You need to call a function that takes two arguments. What is the correct stack layout?

Keep studying — Exploitation Foundations and Memory Corruption