What is the key principle behind coverage-guided fuzzing?

Randomly generating inputs without any feedback

Manually crafting inputs based on the source code

Using feedback from code coverage to guide input mutations toward unexplored code paths

Using a debugger to step through each input

A security engineer is tasked with analyzing a proprietary binary to understand its network communication protocol. The engineer has no documentation. The goal is to identify the protocol's message structure and any hardcoded secrets. Which combination of techniques is most effective?

Use a hex editor to view the binary's raw bytes and manually identify the protocol structure.

Use a disassembler to find network-related function calls (e.g., send, recv) and then use a debugger to set breakpoints on these functions to observe the data being sent and received.

Use a decompiler to convert the binary to C code and then read the decompiled code to understand the protocol.

Use a network sniffer to capture traffic from the binary, but do not analyze the binary itself.

A penetration tester is exploiting a buffer overflow in a Linux application. The application is compiled with a stack canary, NX, and ASLR. The tester has found a way to leak the canary value and an address from the stack. Which exploit strategy is most appropriate?

Use the leaked canary to overwrite the canary correctly, then use a ROP chain to call system('/bin/sh').

Use the leaked stack address to calculate the ASLR base and then overwrite the return address with a 'jmp esp' gadget.

Overwrite the canary with the leaked value and then inject shellcode directly onto the stack.

Ignore the canary and use a brute-force attack to guess the canary value.

EC-CouncilCertified Penetration Testing Professional

Domain 6Objective 1

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 12)

Part of the Advanced Exploitation and IoT domain, which makes up ~17% of our current practice bank.

59questions here

12free pages

16concepts

16 Concepts in This Objective

Reverse Engineering Fundamentals
Static Analysis Techniques
Dynamic Analysis Techniques
Disassembly and Decompilation
Binary File Formats
Fuzzing Fundamentals
Fuzzing Tools and Frameworks
Coverage-Guided Fuzzing
Crash Analysis and Triage
Binary Exploitation Basics
Shellcode Development
Exploit Mitigation Bypass
Return-Oriented Programming (ROP)
Heap Exploitation Techniques
Writing Exploits for IoT Devices
Firmware Analysis and Emulation

Questions 56–59

56foundation · easy
What is the key principle behind coverage-guided fuzzing?
Select an answer first
57application · medium
A security engineer is tasked with analyzing a proprietary binary to understand its network communication protocol. The engineer has no documentation. The goal is to identify the protocol's message structure and any hardcoded secrets. Which combination of techniques is most effective?
Select an answer first
58application · medium
A penetration tester is exploiting a buffer overflow in a Linux application. The application is compiled with a stack canary, NX, and ASLR. The tester has found a way to leak the canary value and an address from the stack. Which exploit strategy is most appropriate?
Select an answer first
59application · medium
A penetration tester is analyzing a vulnerable C program. The program has a format string vulnerability in a function that logs user input. The tester wants to read data from the stack to leak a canary value. Which format specifier should the tester use?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 12)

Questions 56–59

What is the key principle behind coverage-guided fuzzing?

A security engineer is tasked with analyzing a proprietary binary to understand its network communication protocol. The engineer has no documentation. The goal is to identify the protocol's message structure and any hardcoded secrets. Which combination of techniques is most effective?

A penetration tester is exploiting a buffer overflow in a Linux application. The application is compiled with a stack canary, NX, and ASLR. The tester has found a way to leak the canary value and an address from the stack. Which exploit strategy is most appropriate?

A penetration tester is analyzing a vulnerable C program. The program has a format string vulnerability in a function that logs user input. The tester wants to read data from the stack to leak a canary value. Which format specifier should the tester use?

Keep studying — Advanced Exploitation and IoT