GPEN Metasploit Practice Question
During a penetration test, a tester obtains a Meterpreter session on a Windows host but the session dies immediately after the initial connection. The tester suspects that the payload is being terminated by endpoint protection. Which Meterpreter feature should the tester use to migrate the session into a more stable process?
⚠ Common exam trap
Test-takers frequently confuse backgrounding a session with migrating it; backgrounding only returns to the console and does not change the hosting process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
migrate
When a Meterpreter session is unstable because the hosting process is being terminated, migrating to a stable process is the appropriate step. The migrate command injects the Meterpreter payload into another process, ideally a long-running one like explorer.exe. Backgrounding, loading extensions, or killing the session do not address the root cause of instability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
load
Why it's wrong here
load is used to load Meterpreter extensions such as stdapi or priv. It does not migrate the session or change the underlying process. Loading an extension may add functionality, but it does not resolve a session that is being terminated by endpoint protection.
- ✗
sessions -k
Why it's wrong here
sessions -k is a Metasploit console command that kills a session. It is the opposite of what is needed. It does not migrate or stabilize the session; it terminates it. This would not help the tester maintain access to the compromised host.
- ✗
background
Why it's wrong here
background sends the current Meterpreter session to the background and returns to the Metasploit console. It does not move the session to another process or improve stability. The session remains running in the same process, so if that process is terminated, the session still dies.
- ✓
migrate
Why this is correct
The migrate command in Meterpreter moves the session into another running process on the target. By migrating into a stable, long-running process such as explorer.exe, the tester can avoid having the payload terminated when the original process exits or is flagged by endpoint protection. This directly addresses the unstable session issue.
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.