A developer is integrating fuzzing into the CI/CD pipeline for a new library that parses JSON input. The library is written in C and is used by multiple services. The developer wants to find memory corruption bugs early. Which fuzzing approach is most suitable for this scenario?

Use a grammar-based fuzzer that generates JSON inputs from a formal grammar, but do not use any coverage feedback.

Use libFuzzer with a fuzz target that calls the library's JSON parsing function with the fuzzer-provided input.

Use a network-based fuzzer to send malformed JSON to the services that use the library.

Use a file-based fuzzer like AFL, but only provide a single seed file and no dictionary.

What is a common constraint when writing exploits for IoT devices compared to standard x86 desktops?

IoT devices cannot execute shellcode because they lack a CPU

IoT devices always have ASLR enabled, making exploitation impossible

Different CPU architectures (e.g., ARM, MIPS) require architecture-specific shellcode and ROP gadgets

IoT devices do not have memory corruption vulnerabilities

What is the output of a disassembler when applied to a binary executable?

A list of network connections made by the program

High-level source code in C or Python

The original compiler command used to build the binary

A security researcher is fuzzing a complex file parser that uses a checksum to validate input. The parser is compiled with ASAN. The researcher wants to discover deep parsing bugs. Which fuzzing strategy is most effective?

Use a dictionary of file format keywords

Use a coverage-guided fuzzer without any custom mutations

Use a custom mutator that recalculates the checksum after each mutation

Use a larger initial seed corpus

EC-CouncilCertified Penetration Testing Professional

Domain 6Objective 1

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 6)

Part of the Advanced Exploitation and IoT domain, which makes up ~17% of our current practice bank.

59questions here

12free pages

16concepts

16 Concepts in This Objective

Reverse Engineering Fundamentals
Static Analysis Techniques
Dynamic Analysis Techniques
Disassembly and Decompilation
Binary File Formats
Fuzzing Fundamentals
Fuzzing Tools and Frameworks
Coverage-Guided Fuzzing
Crash Analysis and Triage
Binary Exploitation Basics
Shellcode Development
Exploit Mitigation Bypass
Return-Oriented Programming (ROP)
Heap Exploitation Techniques
Writing Exploits for IoT Devices
Firmware Analysis and Emulation

Questions 26–30

26foundation · easy
Which tool is commonly used to inspect the headers and sections of an ELF binary?
Select an answer first
27application · medium
A developer is integrating fuzzing into the CI/CD pipeline for a new library that parses JSON input. The library is written in C and is used by multiple services. The developer wants to find memory corruption bugs early. Which fuzzing approach is most suitable for this scenario?
Select an answer first
28foundation · easy
What is a common constraint when writing exploits for IoT devices compared to standard x86 desktops?
Select an answer first
29foundation · easy
What is the output of a disassembler when applied to a binary executable?
Select an answer first
30expert · hard
A security researcher is fuzzing a complex file parser that uses a checksum to validate input. The parser is compiled with ASAN. The researcher wants to discover deep parsing bugs. Which fuzzing strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.