You are reverse engineering a Windows PE file that has been modified to hide its imports. The file uses dynamic API resolution by calling GetProcAddress with a hash of the function name. You need to determine which APIs the file calls. Which approach is most effective?

Analyze the .text section for calls to GetProcAddress and resolve the hash values.

Use a PE parser to extract the export table of the file.

Use a debugger to set a breakpoint on LoadLibrary and log the DLL names.

Inspect the import table for the function names.

During Windows process creation, what is the role of the Windows loader (e.g., ntdll.dll)?

It enforces security policies and checks the digital signature of the executable.

It allocates the process's virtual address space and sets up the page tables.

It creates the initial thread and starts executing the main function.

It maps the PE image into memory and resolves imports.

A penetration tester is developing a Windows kernel exploit. They need to read and write to physical memory directly. Which approach is most appropriate?

Call NtQuerySystemInformation from user mode

Execute code in kernel mode via a vulnerable driver

Use a debugger to modify page tables from user mode

Use a user-mode application with VirtualAllocEx

In the Windows heap, what is a 'chunk'?

A header that stores metadata about the heap

A contiguous region of memory allocated to the heap by the virtual memory manager

A unit of memory that is allocated or freed within a heap segment

A list of free memory blocks in the heap

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 2

Windows Execution and Memory Foundations GXPN Practice Questions (Page 7)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 31–35

31expert · hard
You are reverse engineering a Windows PE file that has been modified to hide its imports. The file uses dynamic API resolution by calling GetProcAddress with a hash of the function name. You need to determine which APIs the file calls. Which approach is most effective?
Select an answer first
32foundation · easy
During Windows process creation, what is the role of the Windows loader (e.g., ntdll.dll)?
Select an answer first
33expert · hard
A penetration tester is developing a Windows kernel exploit. They need to read and write to physical memory directly. Which approach is most appropriate?
Select an answer first
34foundation · easy
In a 64-bit Windows process, what is the typical size of the user-mode virtual address space?
Select an answer first
35foundation · easy
In the Windows heap, what is a 'chunk'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.