GIAC GXPN Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GXPN certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GXPN Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Exploit Researcher and Advanced Penetration Tester exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GXPN Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GXPN Sample Questions:
01. During a test you reach a stable MITM position by ARP poisoning and capture a client's complete, properly negotiated TLS 1.2 session to a bank — the full handshake and every record. The suite used an ephemeral ECDHE key exchange, and you have no further access to either endpoint.
What can you correctly conclude about the captured application data?
a) It can be recovered with a CBC padding-oracle attack run offline against the captured ciphertext, decrypting the records a byte at a time.
b) It stays confidential: a properly negotiated TLS session cannot be read from a passive capture without the keys, and the ephemeral exchange means even later obtaining the server's private key would not recover it.
c) It can be decrypted offline later if you obtain the server's long-term private key, since the entire handshake including the key-exchange messages was captured intact.
d) It is already readable in your capture, because holding the MITM position means the TLS session is effectively terminating at your host as it relays.
02. Two testers want to reset a long-lived TCP session between two routers. Tester A is on-path and can observe the segments in flight. Tester B is entirely off-path: B can spoof source addresses toward the routers but cannot see any of the traffic. Both testers already know the connection's four-tuple.
What is the essential additional obstacle that makes injecting an accepted RST much harder for Tester B than for Tester A?
a) B must brute-force the TLS session key protecting the router session before any forged reset at the transport layer will be accepted.
b) B must spoof both routers' MAC addresses so the intervening switch will forward the forged reset onto the correct port.
c) B must guess a sequence number that lands inside the receiver's window without ever seeing the connection, while A simply reads the live sequence numbers from the captured traffic.
d) B must first poison the two routers' ARP caches to reach an on-path position, which is unavailable from off-path on a different network.
03. A web application decrypts AES-CBC ciphertext supplied by the client and returns a distinguishable error whenever the recovered padding is malformed.
A tester turns this behaviour into a padding oracle. What does a successful CBC padding-oracle attack recover?
a) The cipher's internal round subkeys, exposing the full AES key schedule.
b) The plaintext of the targeted ciphertext, one byte at a time.
c) The AES key, reconstructed byte by byte from the same valid-padding signal the attack relies on.
d) The IV of every ciphertext the server has ever decrypted under this key.
04. On a managed endpoint you have installed your own root CA into the system trust store and stood up an intercepting TLS proxy on-path. Ordinary browser traffic to most sites is intercepted successfully. One first-party application, however, refuses to connect through the proxy — yet it connects normally when the proxy is removed, and your CA is trusted system-wide.
Which explanation best accounts for that application failing only through the proxy?
a) The application pins the server's certificate or public key against a copy built into the app and ignores the system trust store, so your CA-signed substitute is rejected.
b) HSTS is in force for the application's domain, so the client rewrites http links to https and refuses any cleartext fallback, and it additionally rejects a certificate that chains through a recently installed local CA rather than a public one.
c) The ARP cache entries for the application's server expired, so its traffic is no longer routed through your on-path position.
d) The application negotiated a forward-secret ECDHE cipher suite, which prevents the proxy from decrypting the session even though your certificate is trusted.
05. Your shellcode is delivered through a strcpy-style bug that stops copying at the first null byte, so the payload must contain no 0x00. You need to zero the accumulator, but the obvious instruction mov eax, 0 assembles with a four-byte zero immediate and therefore embeds null bytes.
Which single-instruction replacement produces the same zeroed register while assembling to bytes that contain no null?
a) Keep mov eax, 0 but prepend a NOP sled so an imprecise landing still reaches the instruction.
b) and eax, 0
c) xor eax, eax
d) push 0 followed by pop eax
06. On 32-bit Windows a stack overflow can overwrite an SEH registration record, and you can reliably trigger an exception in the vulnerable function.
Which two conditions must hold for the overwritten handler to actually receive control?
(Choose two.)
a) The handler address resolves into a module compiled without SafeSEH, so no handler allow-list rejects it.
b) SEHOP is disabled, or the SEH chain has been reconstructed to terminate validly, so chain-integrity validation does not catch the overwrite.
c) DEP must be disabled on the process, because otherwise the corrupted handler pointer supposedly cannot be dereferenced or dispatched into existing code at all.
d) The /GS cookie has been leaked through an over-read and rewritten with its correct value, so the epilogue check passes when the vulnerable function finally returns.
07. An overflow gives you control of execution, but the vulnerable buffer is far too small to hold your full payload. You place the large payload elsewhere in the process's address space, prefixed with a unique marker, and drop a very small stub into the tiny buffer.
What does that small stub — an egg hunter — actually do?
a) It executes a call-and-pop sequence to recover the current instruction pointer so the payload can reference its own data using relative addresses.
b) It scans the process's mapped memory for the unique marker (the egg) that prefixes the real payload, safely testing each region for validity so it does not fault on unmapped pages, and transfers control to the payload once the marker is found.
c) It is a decoder stub that reverses an encoding applied to the payload sitting adjacent to it, walking forward from its own location to restore the original instruction bytes in place and then falling through into them once every byte has been decoded.
d) It is a run of no-operation instructions placed before the payload so that an imprecise jump slides down into the real shellcode.
08. You are reasoning about how a dynamically linked ELF executable is prepared for execution on Linux, versus a statically linked one. Which TWO statements are correct?
(Choose two.)
a) A statically linked ELF also invokes the dynamic linker at startup to bind its C-library symbols before main runs, since even a static binary must resolve the standard library's entry points through the loader's interpreter at load time.
b) A dynamically linked ELF names a program interpreter (the dynamic linker/loader); the kernel maps that interpreter and transfers control to it, and it maps the required shared objects into the process's address space.
c) For a position-independent executable, the linker fixes every symbol's final address at build time, so no load-time relocation is needed.
d) The loader applies relocations to adjust addresses that could not be finalized at link time, using relocation entries the ELF records for that purpose.
09. Microsoft documents the PowerShell execution policy as a convenience feature rather than a security control. Which statement best explains why the execution policy is not a security boundary?
a) It relies on a symmetric key stored in the registry that any local process can read and reuse to re-sign a script the policy had blocked.
b) It applies only to scripts that carry an Authenticode signature and silently ignores every unsigned script already present on disk.
c) A local user can bypass it through ordinary supported means, so it prevents accidents rather than attackers.
d) It can be modified only from an elevated administrator session, leaving a standard user entirely unable to change it.
10. DEP and ASLR are both enforced and you have no memory-disclosure primitive. The target process loads one legacy module that was compiled without ASLR support and therefore lands at a fixed base every run.
What makes a reliable return-oriented DEP bypass possible here?
a) Heap-spray many copies of the gadgets so that a corrupted pointer lands among them regardless of where the module base was randomized.
b) Source every gadget from the non-ASLR module, whose fixed base makes its gadget offsets predictable without any leak.
c) Brute-force the randomized base of a loaded system DLL, relying on the claim that 64-bit image rebasing collapses the address space to low entropy.
d) Use a NOP sled to absorb the randomized portion of each gadget address.
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: c |
Question: 03 Answer: b |
Question: 04 Answer: a |
Question: 05 Answer: c |
|
Question: 06 Answer: a, b |
Question: 07 Answer: b |
Question: 08 Answer: b, d |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: For any error in GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
