Which Windows process memory region is primarily responsible for storing local variables and return addresses during function calls?

Process Environment Block (PEB)

A tester is analyzing a crash dump from a Windows 10 application. The crash occurred in a function that copies user input into a fixed-size stack buffer. The tester notices that the return address was overwritten with a value that points to a non-executable page. Which mitigation is most likely causing the crash?

CFG blocked the indirect call to the overwritten function pointer.

DEP prevented execution from the stack, so the overwritten return address pointed to a non-executable page.

ASLR randomized the stack address, so the overwritten return address was invalid.

SafeSEH rejected the overwritten SEH handler, causing the crash.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 4

Windows Overflows and Execution Control GXPN Practice Questions (Page 5)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

9concepts

Questions 21–25

21foundation · easy
Which instruction is commonly used in SEH overwrite exploits to transfer control to the attacker's payload?
Select an answer first
22foundation · easy
In an egg hunter exploit, what is the typical size of the 'egg' tag?
Select an answer first
23foundation · easy
Which Windows heap structure is often targeted in older heap overflow techniques to overwrite a function pointer?
Select an answer first
24foundation · easy
Which Windows process memory region is primarily responsible for storing local variables and return addresses during function calls?
Select an answer first
25application · medium
A tester is analyzing a crash dump from a Windows 10 application. The crash occurred in a function that copies user input into a fixed-size stack buffer. The tester notices that the return address was overwritten with a value that points to a non-executable page. Which mitigation is most likely causing the crash?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Windows Overflows and Execution Control GXPN Practice Questions (Page 5)

Questions 21–25

Which instruction is commonly used in SEH overwrite exploits to transfer control to the attacker's payload?

In an egg hunter exploit, what is the typical size of the 'egg' tag?

Which Windows heap structure is often targeted in older heap overflow techniques to overwrite a function pointer?

Which Windows process memory region is primarily responsible for storing local variables and return addresses during function calls?

Keep studying — Exploitation Foundations and Memory Corruption