While analyzing a Windows executable in x64dbg, a tester sets a breakpoint on a function that processes user input. The tester wants to see the exact bytes being passed to the function and the return address that will be used after the function returns. Which debugger feature should be used?

Inspect the stack window and the register window

Use the disassembly view to follow the call instruction

Enable the trace-into feature to step through every instruction

Set a hardware breakpoint on the function's first instruction

A fuzzing campaign produces a crash in a Linux application. The crash report shows a SIGSEGV at a specific address. The tester wants to determine whether the crash is exploitable and what type of memory corruption occurred. Which step is most appropriate?

Use `file` to check the binary's architecture and protections

Run the application with ASAN and observe the sanitizer output

Submit the crash to a public exploit database

Replay the crashing input under GDB and inspect the register state and stack

What is the purpose of ASLR (Address Space Layout Randomization)?

To randomize the memory addresses of key program areas, making it harder to predict addresses for exploitation

To encrypt the program's code to prevent reverse engineering

To mark memory pages as non-executable

To add a canary value to the stack to detect overflows

EC-CouncilCertified Penetration Testing Professional

Domain 6Objective 1

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 7)

Part of the Advanced Exploitation and IoT domain, which makes up ~17% of our current practice bank.

59questions here

12free pages

16concepts

16 Concepts in This Objective

Reverse Engineering Fundamentals
Static Analysis Techniques
Dynamic Analysis Techniques
Disassembly and Decompilation
Binary File Formats
Fuzzing Fundamentals
Fuzzing Tools and Frameworks
Coverage-Guided Fuzzing
Crash Analysis and Triage
Binary Exploitation Basics
Shellcode Development
Exploit Mitigation Bypass
Return-Oriented Programming (ROP)
Heap Exploitation Techniques
Writing Exploits for IoT Devices
Firmware Analysis and Emulation

Questions 31–35

31application · medium
While analyzing a Windows executable in x64dbg, a tester sets a breakpoint on a function that processes user input. The tester wants to see the exact bytes being passed to the function and the return address that will be used after the function returns. Which debugger feature should be used?
Select an answer first
32application · medium
A fuzzing campaign produces a crash in a Linux application. The crash report shows a SIGSEGV at a specific address. The tester wants to determine whether the crash is exploitable and what type of memory corruption occurred. Which step is most appropriate?
Select an answer first
33application · medium
A penetration tester receives a binary that is suspected to be a Mach-O executable. The tester wants to confirm the file format and inspect its load commands. Which tool is most appropriate?
Select an answer first
34foundation · easy
What is the purpose of ASLR (Address Space Layout Randomization)?
Select an answer first
35foundation · easy
Which fuzzing framework is often used for protocol-based fuzzing and allows defining data models for network protocols?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 7)

Questions 31–35

While analyzing a Windows executable in x64dbg, a tester sets a breakpoint on a function that processes user input. The tester wants to see the exact bytes being passed to the function and the return address that will be used after the function returns. Which debugger feature should be used?

A fuzzing campaign produces a crash in a Linux application. The crash report shows a SIGSEGV at a specific address. The tester wants to determine whether the crash is exploitable and what type of memory corruption occurred. Which step is most appropriate?

A penetration tester receives a binary that is suspected to be a Mach-O executable. The tester wants to confirm the file format and inspect its load commands. Which tool is most appropriate?

What is the purpose of ASLR (Address Space Layout Randomization)?

Which fuzzing framework is often used for protocol-based fuzzing and allows defining data models for network protocols?

Keep studying — Advanced Exploitation and IoT