What is the first step in the Windows process creation sequence?

The loader maps the executable image into memory.

The caller invokes a process creation API such as CreateProcess.

The kernel creates the process object and its initial thread.

The system initializes the process environment block (PEB).

A security team is hardening a Windows application against exploitation. They have enabled DEP, ASLR, and CFG. An attacker discovers a vulnerability that allows writing to an arbitrary memory address. Which mitigation would most likely prevent the attacker from executing code on the heap?

ASLR (Address Space Layout Randomization)

DEP (Data Execution Prevention)

A security researcher is analyzing a heap-based buffer overflow in a Windows application. They notice that the heap manager uses a lookaside list for small allocations. What is the primary purpose of the lookaside list?

To prevent double-free vulnerabilities

To speed up allocation and deallocation of small chunks

To randomize heap base addresses

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 2

Windows Execution and Memory Foundations GXPN Practice Questions (Page 1)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
What is the first step in the Windows process creation sequence?
Select an answer first
2application · medium
A penetration tester is performing a vulnerability assessment on a Windows system. They want to execute code that directly accesses hardware and modifies page tables. Which execution mode is required?
Select an answer first
3expert · hard
A security team is hardening a Windows application against exploitation. They have enabled DEP, ASLR, and CFG. An attacker discovers a vulnerability that allows writing to an arbitrary memory address. Which mitigation would most likely prevent the attacker from executing code on the heap?
Select an answer first
4application · medium
A penetration tester is exploiting a heap overflow in a Windows application. They want to place a fake chunk header to bypass the heap manager's validation. Which field in the chunk header is used to verify the chunk's size and prevent overlapping chunks?
Select an answer first
5expert · hard
A security researcher is analyzing a heap-based buffer overflow in a Windows application. They notice that the heap manager uses a lookaside list for small allocations. What is the primary purpose of the lookaside list?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Windows Execution and Memory Foundations GXPN Practice Questions (Page 1)

Questions 1–5

What is the first step in the Windows process creation sequence?

A penetration tester is performing a vulnerability assessment on a Windows system. They want to execute code that directly accesses hardware and modifies page tables. Which execution mode is required?

A security team is hardening a Windows application against exploitation. They have enabled DEP, ASLR, and CFG. An attacker discovers a vulnerability that allows writing to an arbitrary memory address. Which mitigation would most likely prevent the attacker from executing code on the heap?

A penetration tester is exploiting a heap overflow in a Windows application. They want to place a fake chunk header to bypass the heap manager's validation. Which field in the chunk header is used to verify the chunk's size and prevent overlapping chunks?

A security researcher is analyzing a heap-based buffer overflow in a Windows application. They notice that the heap manager uses a lookaside list for small allocations. What is the primary purpose of the lookaside list?

Keep studying — Exploitation Foundations and Memory Corruption