What is a common exploitation implication of a vulnerability in kernel mode?

It is less severe than a user-mode vulnerability because the kernel is isolated.

It only allows denial of service, not code execution.

It can lead to full system compromise because kernel mode has high privileges.

It only affects the current user's session and cannot impact other users.

You are analyzing a Windows executable that has been packed with a custom packer. The packer decrypts the original code at runtime. You need to find the original entry point (OEP) to analyze the unpacked code. Which PE section is most likely to contain the OEP after unpacking?

The .reloc section, which contains relocation data.

The .rsrc section, which contains resources.

The .text section, which is the code section.

The .data section, which contains initialized data.

A security researcher is fuzzing a Windows application and observes that a heap overflow overwrites the metadata of an adjacent chunk. Which Windows heap protection feature is specifically designed to detect such corruption when the chunk is freed?

Heap metadata encoding with a random key

Address Space Layout Randomization (ASLR)

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 2

Windows Execution and Memory Foundations GXPN Practice Questions (Page 4)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 16–20

16application · medium
A penetration tester is analyzing a Windows process and wants to understand how the loader resolves imported functions. Which table is populated with the actual addresses of imported functions when a DLL is loaded?
Select an answer first
17application · medium
A malware analyst is examining a PE file and wants to identify which DLLs the executable imports. Which section of the PE file should be examined?
Select an answer first
18foundation · easy
What is a common exploitation implication of a vulnerability in kernel mode?
Select an answer first
19application · easy
You are analyzing a Windows executable that has been packed with a custom packer. The packer decrypts the original code at runtime. You need to find the original entry point (OEP) to analyze the unpacked code. Which PE section is most likely to contain the OEP after unpacking?
Select an answer first
20application · medium
A security researcher is fuzzing a Windows application and observes that a heap overflow overwrites the metadata of an adjacent chunk. Which Windows heap protection feature is specifically designed to detect such corruption when the chunk is freed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Windows Execution and Memory Foundations GXPN Practice Questions (Page 4)

Questions 16–20

A penetration tester is analyzing a Windows process and wants to understand how the loader resolves imported functions. Which table is populated with the actual addresses of imported functions when a DLL is loaded?

A malware analyst is examining a PE file and wants to identify which DLLs the executable imports. Which section of the PE file should be examined?

What is a common exploitation implication of a vulnerability in kernel mode?

You are analyzing a Windows executable that has been packed with a custom packer. The packer decrypts the original code at runtime. You need to find the original entry point (OEP) to analyze the unpacked code. Which PE section is most likely to contain the OEP after unpacking?

A security researcher is fuzzing a Windows application and observes that a heap overflow overwrites the metadata of an adjacent chunk. Which Windows heap protection feature is specifically designed to detect such corruption when the chunk is freed?

Keep studying — Exploitation Foundations and Memory Corruption