1|Page
GFACT exam, GFACT certification 2025,
cybersecurity fundamentals, GIAC GFACT questions,
information security exam, GFACT practice test,
verified answers
When a program runs on a computer, it temporaliy loads code
into memory that contains information about the program. The
code is deleted when the program is closed. What is the instance
of this code called?
A) Process
B) Kernel
C) BIOS
D) Application
Hint: Every time you run a program on your computer, a
"BLANK" is created in memory. When you close the program,
the "BLANK" is killed. - ANSWER-Process
What is a requirement for cross-site request forgery to work?
,2|Page
A) The victim must be authenticated with the target site
B) The Attacker must have root privileges on the victim's system
C) The victim must be a member of the IIS_USER group
D) The attacker must steal the victim's cookie
Hint: CSRF involves an authenticated user clicking on a link
that an attacker plants. This link will cause the victim's browser
to perform an action using their authenticated credentials. -
ANSWER-The victim must be authenticated with the target site
Which of the following commands will set or modify an
environment variable?
A) export
B)grep
C)nano
Hint: The "Blank" command is used to set or modify an
environmental variable. - ANSWER-export
,3|Page
In which directory are Linux logs generally found?
A)var
B)bin
C)boot
D)mnt
Hint: The "blank" folder contains system files that tend to
increase in size over time (hence it's a "blank" size folder).
Things like log files, the mail directory, and so on, go here. -
ANSWER-var
What type of exploit is described below?
CVE-2019-9874: Deserialization of Untrusted Data in the
Sitecore.Security.AnitCSRF (aka anti CSRF) module in Sitecore
CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an
unauthenticated attacker to execute arbitrary code by sending a
serialized .NET object in the HTTP POST parameter
__CSRFTOKEN.
A) RCE
, 4|Page
B) Heap corruption
C) Information disclosure
D) Buffer over-read
E) File Inclusion
F)SQLi
Hint: "Blank" bugs allow an attacker to achieve "arbitrary code
execution." This, in effect, allows them to assume control of a
target system. They can come in many flavors but are often seen
as the most high-risk category of attack. - ANSWER-RCE
Which buffer overflow mitigation places a value before the
return pointer in the stack?
A) Canary
B) Parameterized query
C) Random session token
D) Format String
Hint: The stack "blank" is a value that sits before the return
pointer in the stack. When the program's execution hits the
return instruction, before the return pointer is loaded into EIP,
GFACT exam, GFACT certification 2025,
cybersecurity fundamentals, GIAC GFACT questions,
information security exam, GFACT practice test,
verified answers
When a program runs on a computer, it temporaliy loads code
into memory that contains information about the program. The
code is deleted when the program is closed. What is the instance
of this code called?
A) Process
B) Kernel
C) BIOS
D) Application
Hint: Every time you run a program on your computer, a
"BLANK" is created in memory. When you close the program,
the "BLANK" is killed. - ANSWER-Process
What is a requirement for cross-site request forgery to work?
,2|Page
A) The victim must be authenticated with the target site
B) The Attacker must have root privileges on the victim's system
C) The victim must be a member of the IIS_USER group
D) The attacker must steal the victim's cookie
Hint: CSRF involves an authenticated user clicking on a link
that an attacker plants. This link will cause the victim's browser
to perform an action using their authenticated credentials. -
ANSWER-The victim must be authenticated with the target site
Which of the following commands will set or modify an
environment variable?
A) export
B)grep
C)nano
Hint: The "Blank" command is used to set or modify an
environmental variable. - ANSWER-export
,3|Page
In which directory are Linux logs generally found?
A)var
B)bin
C)boot
D)mnt
Hint: The "blank" folder contains system files that tend to
increase in size over time (hence it's a "blank" size folder).
Things like log files, the mail directory, and so on, go here. -
ANSWER-var
What type of exploit is described below?
CVE-2019-9874: Deserialization of Untrusted Data in the
Sitecore.Security.AnitCSRF (aka anti CSRF) module in Sitecore
CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an
unauthenticated attacker to execute arbitrary code by sending a
serialized .NET object in the HTTP POST parameter
__CSRFTOKEN.
A) RCE
, 4|Page
B) Heap corruption
C) Information disclosure
D) Buffer over-read
E) File Inclusion
F)SQLi
Hint: "Blank" bugs allow an attacker to achieve "arbitrary code
execution." This, in effect, allows them to assume control of a
target system. They can come in many flavors but are often seen
as the most high-risk category of attack. - ANSWER-RCE
Which buffer overflow mitigation places a value before the
return pointer in the stack?
A) Canary
B) Parameterized query
C) Random session token
D) Format String
Hint: The stack "blank" is a value that sits before the return
pointer in the stack. When the program's execution hits the
return instruction, before the return pointer is loaded into EIP,
