During a memory forensics investigation, an analyst wants to determine whether a specific virtual page is resident in physical memory. Which Windows structure should the analyst examine?

The Process Environment Block (PEB)

The Page Table Entry (PTE) for that virtual page

The Thread Environment Block (TEB)

A malware analyst is analyzing a packed executable. The entry point points to a small stub that decompresses the original code. Which PE section is most likely to contain the packed code after unpacking?

.data section, which is writable but non-executable

.rsrc section, which contains resources

.text section, which is marked executable and writable

.reloc section, which contains relocations

In a 32-bit Windows process, the virtual address space is typically divided into two main regions. What is the default split between the user-mode and kernel-mode portions?

2 GB user-mode and 2 GB kernel-mode

3 GB user-mode and 1 GB kernel-mode

4 GB user-mode and 0 GB kernel-mode

1 GB user-mode and 3 GB kernel-mode

You are analyzing a heap overflow in a 64-bit Windows application. The application uses the default heap, and you have noticed that the heap manager uses a lookaside list for small allocations. You have overwritten the metadata of a chunk that is currently in the lookaside list. What is the most likely immediate effect?

The heap manager will detect the corruption and terminate the process.

The heap manager will move the chunk to the free list and perform a safe unlink.

The next allocation from the lookaside list will return a corrupted pointer, leading to an arbitrary write.

The heap manager will call the application's error handler to handle the corruption.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 2

Windows Execution and Memory Foundations GXPN Practice Questions (Page 3)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 11–15

11application · medium
During a memory forensics investigation, an analyst wants to determine whether a specific virtual page is resident in physical memory. Which Windows structure should the analyst examine?
Select an answer first
12expert · hard
A malware analyst is analyzing a packed executable. The entry point points to a small stub that decompresses the original code. Which PE section is most likely to contain the packed code after unpacking?
Select an answer first
13foundation · easy
In a 32-bit Windows process, the virtual address space is typically divided into two main regions. What is the default split between the user-mode and kernel-mode portions?
Select an answer first
14application · medium
You are analyzing a heap overflow in a 64-bit Windows application. The application uses the default heap, and you have noticed that the heap manager uses a lookaside list for small allocations. You have overwritten the metadata of a chunk that is currently in the lookaside list. What is the most likely immediate effect?
Select an answer first
15application · medium
A penetration tester is analyzing a process that loads a DLL at runtime. They want to understand how the loader resolves the DLL's exported functions. Which table in the DLL is consulted to map an exported function name to its address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Windows Execution and Memory Foundations GXPN Practice Questions (Page 3)

Questions 11–15

During a memory forensics investigation, an analyst wants to determine whether a specific virtual page is resident in physical memory. Which Windows structure should the analyst examine?

A malware analyst is analyzing a packed executable. The entry point points to a small stub that decompresses the original code. Which PE section is most likely to contain the packed code after unpacking?

In a 32-bit Windows process, the virtual address space is typically divided into two main regions. What is the default split between the user-mode and kernel-mode portions?

A penetration tester is analyzing a process that loads a DLL at runtime. They want to understand how the loader resolves the DLL's exported functions. Which table in the DLL is consulted to map an exported function name to its address?

Keep studying — Exploitation Foundations and Memory Corruption