GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) Practice Test
Gana confianza para GIAC Exploit Researcher and Advanced Penetration Tester (GXPN). Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
Advanced GIAC certification for exploit research and sophisticated penetration testing techniques. Administered by GIAC. Key domains include Bypassing Linux Exploit Mitigations, Bypassing Windows Memory Protections, Endpoint Control Evasions and Escalation and Establishing Network Access. The exam consists of 60 questions over 180 minutes.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
Which checksec output line provides the MOST direct indicator that a Linux binary has stack-cookie protection enabled?
"La línea de salida de checksec que proporciona el indicador más directo de que un binario de Linux tiene protección de cookie de pila habilitada es 'Canary found' / 'Pila: Canary found', lo que indica que gcc se invocó con -fstack-protector(-strong/-all) y que los símbolos __stack_chk_fail y __stack_chk_guard están presentes en el binario.
A red team identifies that an internal CA issues end-entity certificates with the basicConstraints extension marked critical but with cA:TRUE inadvertently set on some leaf certs. Which MOST severe outcome should the finding emphasize, and what NIST control directly addresses it?
Un equipo de rojo identifica que un CA interno emite certificados de entidad final con la extensión basicConstraints marcada como crítica pero con cA:TRUE configurada accidentalmente en algunos certificados hoja. El resultado más grave que debería enfatizar la observación es que cA:TRUE en una hoja convierte la hoja en un CA. Cualquier poseedor de esa clave puede emitir certificados subordinados que se vinculan a la raíz original, lo que permite ataques MITM y falsificación de cadena de suministro de certificados contra cualquier RP que confíe en la raíz. El NIST SP 800-57 Parte 1/3 y las Requisitos Básicos del Foro de CA/Browser requieren una separación estricta de perfiles de CA de perfiles de entidad final. El control de NIST IA-5(2) (Autenticación basada en PKI) y SC-17 (Certificados de Infraestructura de Clave Pública) cubren la asistencia de perfil de certificado. La distractor B confunde pathLenConstraint con una compromiso de clave privada. C invoca la estampilla OCSP, sin relación. D hace referencia a la registro de CT, útil pero no detiene directamente el abuso.
An open-source library is being onboarded to OSS-Fuzz. Which file at the project root is REQUIRED by OSS-Fuzz to declare fuzzers, build steps, and sanitizers?
Los proyectos de OSS-Fuzz contienen un archivo "project.yaml" que describe el lenguaje, sanitizadores, motores de fumigación y direcciones de correo electrónico de contacto, además de un archivo "Dockerfile" y "build.sh" que construyen el harnes. La combinación es requerida para que ClusterFuzz ingiera el proyecto. El distractor B nombra "fuzz.json" (no hay tal convención). C nombra "Cargo.toml" (cártel de Rust). D nombra "Makefile" solo, lo que es insuficiente.
On a multi-tenant data center fabric, a tester observes that the access switch accepts double-tagged 802.1Q frames where the outer tag matches the native VLAN of the trunk. Which attack is recognized, and what is the canonical fix?
Este es el clásico ataque de doble etiquetado de VLAN (VLAN hopping). Cuando la etiqueta exterior es igual a la VLAN nativa del tronco, el primer switch elimina la etiqueta exterior y envía el frame etiquetado interiormente al segundo switch, que entonces confía en la etiqueta interior y coloca el frame en la VLAN objetivo. La solución canónica es (a) nunca utilizar una VLAN accesible para usuarios como VLAN nativa de un tronco, (b) etiquetar explícitamente la VLAN nativa ("vlan dot1q tag native"), y (c) deshabilitar DTP/auto-negociación en puertos de acceso. La distracción A lo nombra incorrectamente como inundación de MAC. C invoca la inyección de CDP. D invoca la manipulación del árbol de árboles, todas relacionadas con el patrón de doble etiquetado.
Which property does AES-GCM-SIV (RFC 8452) provide that AES-GCM does NOT, making it preferable when nonce-uniqueness cannot be guaranteed across distributed encryptors?
AES-GCM-SIV (IV sintético, RFC 8452) proporciona resistencia a la reutilización de nonce: si un nonce se repite accidentalmente, el único leak es si dos ciphertexts cifran el mismo plaintext (una fuga de cifrado determinista) y se preserva la autenticidad. AES-GCM bajo la reutilización de nonce causa una fuga catastrófica de la clave de autenticación (permitiendo la falsificación universal) y revela el XOR del plaintext. La opción A es incorrecta: GCM-SIV no es segura contra la computación cuántica más allá de GCM. La opción B es incorrecta: la autenticación AEAD está presente en ambas. C describe el compromiso, que es una propiedad separada abordada por las construcciones AEAD-Commit o CTX, no por GCM-SIV en sí.
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
01Bypassing Linux Exploit Mitigations
This domain covers the identification of various Linux stack protections and the specific methods used to bypass them during professional security assessments to ensure coverage of potential vulnerabilities within the target environment.
02Bypassing Windows Memory Protections
This domain focuses on identifying Windows stack protections and describing the specific technical methods required to bypass these memory-based security controls during advanced penetration testing engagements to validate system integrity and security.
03Endpoint Control Evasions and Escalation
This domain involves applying various advanced techniques to bypass or break out of common endpoint protections and restrictions encountered during penetration testing to achieve unauthorized access or escalate privileges within the target system.
04Establishing Network Access
This domain covers the enumeration and bypass of network access controls and complex segmentation architectures to gain initial network connectivity and move laterally through the target environment during a security assessment engagement.
05Infrastructure Manipulation and Exploitation
This domain addresses how routing and traffic control can be influenced to exploit network infrastructure, focusing on manipulating data paths to intercept or redirect traffic for the purpose of gaining unauthorized access.
06Linux Execution, Memory, and Shellcode Foundations
This domain covers Linux memory organization, management fundamentals, low-level binary execution, and the application of shellcode to demonstrate how these components interact during the exploitation of software vulnerabilities in a Linux environment.
07Network Interception and Traffic Manipulation
This domain focuses on the process of intercepting, observing, and altering traffic flows within a network environment to identify potential weaknesses in communication protocols and exploit them for unauthorized data access.
08Practical Cryptography
This domain covers the identification of flaws in cryptographic implementations and methods for exploiting those weaknesses to compromise sensitive data or bypass security controls that rely on encryption for their protection.
09Practical Scripting for Offensive Operations
This domain involves creating new scripts and adapting existing ones to meet specific, objective-focused offensive operation requirements, ensuring that penetration testers can automate tasks and improve efficiency during complex security assessments.
10Product Security Testing and Fuzzing Foundations
This domain covers the construction of fuzzing grammars and the application of fuzzing techniques for product security testing to identify unknown vulnerabilities in software applications and network services before they are exploited.
11Return Oriented Stack-Based Exploits
This domain focuses on creating simple return-oriented chains to achieve execution control, demonstrating how to bypass modern security protections by reusing existing code snippets within the target application's memory space effectively.
12Source Code Based Fuzzing Techniques
This domain covers the use of available source code to improve the efficiency of fuzzing and ensure better code coverage during security testing, allowing for identification of potential software flaws.
13Windows Execution and Memory Foundations
This domain covers the low-level Windows execution process, including run-time and execution-time protections, providing the necessary knowledge to understand how Windows manages memory and executes processes in a secure environment.
14Windows Overflows and Execution Control
This domain focuses on gaining execution control by leveraging internal Windows mechanisms, such as structured exception handling, to bypass security controls and execute arbitrary code within the context of a target process.