Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the main difference between disassembly and decompilation?

   • ADisassembly produces assembly code, while decompilation attempts to produce higher-level source code
   • BDisassembly requires execution, while decompilation does not
   • CDisassembly is used for ELF files, while decompilation is used for PE files
   • DDisassembly is dynamic analysis, while decompilation is static analysis
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester receives a suspicious Linux executable from a client's compromised server. The tester needs to determine whether the binary contains embedded configuration data, such as IP addresses or encryption keys, without executing it. The binary is statically linked and stripped. Which approach is most effective for this task?

   • AUse objdump to disassemble the .text section and manually read every assembly instruction to find immediate values that look like IP addresses.
   • BRun the binary under GDB and set breakpoints on string comparison functions to observe runtime arguments.
   • CLoad the binary in Ghidra, auto-analyze it, and use the 'RunScript' feature to execute a Python script that simulates the binary's main function.
   • DUse the 'strings' utility to extract printable character sequences and then cross-reference them with the ELF section headers using readelf.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of reverse engineering a binary executable in a penetration testing context?

   • ATo understand the program's functionality, logic, and potential vulnerabilities without having the source code
   • BTo identify the programming language used and recover the original source code exactly
   • CTo optimize the binary's performance by removing unnecessary instructions
   • DTo convert the binary into a high-level language like C for recompilation on other platforms
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A fuzzing engineer is using AFL to fuzz a complex file parser. The parser has a deep nesting structure, and the initial seed corpus is small. The fuzzing campaign is not finding many new code paths. Which strategy is most likely to improve coverage?

   • ASwitch to a grammar-based fuzzer that generates inputs from a formal specification of the file format.
   • BIncrease the number of parallel fuzzing instances (e.g., from 4 to 16) to increase the mutation rate.
   • CUse a dictionary of common keywords and magic values to help the fuzzer generate more valid inputs.
   • DProvide a larger and more diverse seed corpus, including files with different structures and edge cases.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security researcher is fuzzing a custom network protocol parser. The parser expects a specific header followed by a variable-length payload. The researcher wants to maximize code coverage and discover crashes efficiently. Which fuzzing approach is most appropriate?

   • AUse AFL with a dictionary of protocol keywords and a seed corpus of valid packets
   • BUse a simple mutation fuzzer that flips bits in a single valid packet
   • CRun a fuzzer without any seed inputs to test the parser's robustness
   • DGenerate random bytes of varying lengths and feed them directly to the parser
   Reveal Solution Discussion Select an answer first