Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A fuzzing campaign has produced a crash that only occurs when Address Space Layout Randomization (ASLR) is disabled. The crash is a buffer overflow that overwrites a return address. The team wants to determine if the bug is exploitable on a modern system with ASLR enabled. Which analysis is most important?

   • AVerify that the overflow can overwrite more than 8 bytes
   • BConfirm that the crash is a write primitive rather than a read primitive
   • CCheck if the crash occurs on all versions of the operating system
   • DDetermine if the overflow can be used to redirect execution to a location that bypasses ASLR, such as a JOP/ROP chain or a leaked pointer
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A fuzzing campaign on a network daemon produced a crash that is difficult to reproduce. The crash log shows a segmentation fault in a function that parses a specific option in a configuration file. The team suspects a race condition because the crash only occurs under high load. What is the most appropriate next step?

   • AIgnore the crash because it is not reproducible and likely a false positive.
   • BSubmit the crash to the vendor without further analysis.
   • CRe-run the fuzzer with the same seed and hope the crash reproduces.
   • DUse a debugger to run the daemon with the crashing input under the same load conditions to capture a backtrace.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A product security team wants to implement continuous fuzzing for a large codebase with multiple components. They have limited CI resources and need to prioritize which components to fuzz. Which approach is most effective?

   • AFuzz only the components that are easy to set up with existing harnesses.
   • BRun fuzzing only on the components that have changed in the latest commit.
   • CPrioritize components that parse untrusted input, have a history of vulnerabilities, or are critical to security.
   • DFuzz all components equally on every commit to ensure full coverage.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security researcher is fuzzing a PDF parser. They have a collection of valid PDF files but want to specifically test the parser's handling of malformed cross-reference tables. Which fuzzing technique is most appropriate?

   • AUse a mutation-based fuzzer with a dictionary of PDF keywords and structure-aware mutations
   • BUse a pure generation-based fuzzer that creates random PDFs from scratch
   • CUse a coverage-guided fuzzer without any seeds or dictionary
   • DUse a black-box fuzzer that sends random bytes to the parser
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A fuzzing campaign using AFL is running on a multi-core server. The team wants to maximize throughput and coverage. They have 16 cores available. What is the best way to configure the fuzzing campaign?

   • ARun 16 independent AFL instances, each with its own output directory and no synchronization.
   • BRun a single AFL instance with 16 threads to share the corpus.
   • CRun 16 AFL instances in parallel using AFL's parallel mode with a shared output directory and a master/slave setup.
   • DRun one AFL instance and use the -t option to set a higher timeout for each input.
   Reveal Solution Discussion Select an answer first