GIAC Exploit Researcher and Advanced
Penetration Tester (GXPN) Questions And
Correct Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant Download Pdf
1. Which type of vulnerability allows an attacker to overwrite a
program’s memory beyond the intended boundary of a buffer?
A. SQL Injection
B. Cross-Site Scripting
C. Buffer Overflow
D. Directory Traversal
Answer: C. Buffer Overflow
Rationale: A buffer overflow occurs when a program writes more data
into a buffer than it was designed to hold. This excess data can
overwrite adjacent memory locations, potentially altering program
execution and allowing attackers to inject and execute malicious code.
, 2. Which CPU register typically contains the address of the next
instruction to be executed?
A. EAX
B. ESP
C. EIP
D. EDX
Answer: C. EIP
Rationale: The Extended Instruction Pointer (EIP) register in x86
architecture holds the memory address of the next instruction to
execute. Control of EIP is often the primary goal during exploit
development because redirecting it allows execution of attacker-
controlled code.
3. What is the primary purpose of shellcode in exploit development?
A. Encrypting network traffic
B. Executing arbitrary instructions on the target system
C. Generating passwords
D. Compressing payloads
Answer: B. Executing arbitrary instructions on the target system
,Rationale: Shellcode is a small piece of machine code used as a
payload in exploitation. Once execution control is obtained, shellcode
performs actions such as spawning a shell, creating reverse
connections, or executing commands.
4. What does ASLR stand for?
A. Address Space Layout Randomization
B. Application Security Layer Routing
C. Automated Security Logging Routine
D. Advanced System Link Registry
Answer: A. Address Space Layout Randomization
Rationale: ASLR randomizes memory address locations used by system
and application processes. This prevents attackers from predicting
memory addresses required for successful exploitation.
5. What technique allows attackers to execute code by chaining
together small snippets of existing code in memory?
A. Heap spraying
B. Return-Oriented Programming
, C. Cross-site scripting
D. Port scanning
Answer: B. Return-Oriented Programming
Rationale: Return-Oriented Programming (ROP) bypasses protections
such as NX by chaining short instruction sequences called gadgets that
already exist in executable memory.
6. What protection mechanism marks memory regions as non-
executable?
A. DEP
B. TLS
C. DNSSEC
D. SMB
Answer: A. DEP
Rationale: Data Execution Prevention (DEP) prevents execution of code
from memory regions marked as data-only. Attackers must bypass DEP
to run injected shellcode.
Penetration Tester (GXPN) Questions And
Correct Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant Download Pdf
1. Which type of vulnerability allows an attacker to overwrite a
program’s memory beyond the intended boundary of a buffer?
A. SQL Injection
B. Cross-Site Scripting
C. Buffer Overflow
D. Directory Traversal
Answer: C. Buffer Overflow
Rationale: A buffer overflow occurs when a program writes more data
into a buffer than it was designed to hold. This excess data can
overwrite adjacent memory locations, potentially altering program
execution and allowing attackers to inject and execute malicious code.
, 2. Which CPU register typically contains the address of the next
instruction to be executed?
A. EAX
B. ESP
C. EIP
D. EDX
Answer: C. EIP
Rationale: The Extended Instruction Pointer (EIP) register in x86
architecture holds the memory address of the next instruction to
execute. Control of EIP is often the primary goal during exploit
development because redirecting it allows execution of attacker-
controlled code.
3. What is the primary purpose of shellcode in exploit development?
A. Encrypting network traffic
B. Executing arbitrary instructions on the target system
C. Generating passwords
D. Compressing payloads
Answer: B. Executing arbitrary instructions on the target system
,Rationale: Shellcode is a small piece of machine code used as a
payload in exploitation. Once execution control is obtained, shellcode
performs actions such as spawning a shell, creating reverse
connections, or executing commands.
4. What does ASLR stand for?
A. Address Space Layout Randomization
B. Application Security Layer Routing
C. Automated Security Logging Routine
D. Advanced System Link Registry
Answer: A. Address Space Layout Randomization
Rationale: ASLR randomizes memory address locations used by system
and application processes. This prevents attackers from predicting
memory addresses required for successful exploitation.
5. What technique allows attackers to execute code by chaining
together small snippets of existing code in memory?
A. Heap spraying
B. Return-Oriented Programming
, C. Cross-site scripting
D. Port scanning
Answer: B. Return-Oriented Programming
Rationale: Return-Oriented Programming (ROP) bypasses protections
such as NX by chaining short instruction sequences called gadgets that
already exist in executable memory.
6. What protection mechanism marks memory regions as non-
executable?
A. DEP
B. TLS
C. DNSSEC
D. SMB
Answer: A. DEP
Rationale: Data Execution Prevention (DEP) prevents execution of code
from memory regions marked as data-only. Attackers must bypass DEP
to run injected shellcode.
