A penetration tester is fuzzing a file parser that accepts a custom binary format. The format has a magic header, a checksum, and then a series of records. The tester wants to focus fuzzing on the record parsing logic, not the header validation. Which approach is most effective?

Use a black-box fuzzer that sends random bytes to the file parser

Create a seed corpus of valid files and use a mutation-based fuzzer that preserves the header and checksum

Use a generation-based fuzzer that randomly generates headers and records

Use a coverage-guided fuzzer without any seeds

What is the primary advantage of coverage-guided fuzzing over simple mutation-based fuzzing?

It uses feedback from code coverage to focus on unexplored code paths, increasing the likelihood of finding deep bugs.

It is faster because it does not need to instrument the target application.

It requires no initial seed corpus, making it easier to start fuzzing from scratch.

It guarantees that all possible inputs are tested, ensuring complete coverage of the input space.

A security engineer is evaluating fuzzing tools for a project that has both a C++ library and a Python wrapper. The library is performance-critical and has been fuzzed with libFuzzer, but the Python wrapper is new and untested. The team wants to fuzz the Python wrapper's input handling. Which tool is most appropriate?

Use libFuzzer to fuzz the Python wrapper by writing a C++ harness

Use Atheris, a coverage-guided fuzzer for Python, to fuzz the wrapper directly

Use AFL with a Python script that reads from stdin

Use Peach Fuzzer with a Python-specific grammar

A fuzzing campaign on a database engine produced a crash that only occurs when a specific sequence of SQL statements is executed. The crash is a heap buffer overflow in the query optimizer. The team wants to determine if the crash is exploitable. What is the most important next step?

Run the crashing input under a debugger to confirm the exact overflow and identify the vulnerable function.

Check if the crash can be triggered remotely without authentication.

Immediately report the crash to the vendor as a critical vulnerability.

Try to develop a proof-of-concept exploit to prove exploitability.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 2)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 6–10

6application · medium
A penetration tester is fuzzing a file parser that accepts a custom binary format. The format has a magic header, a checksum, and then a series of records. The tester wants to focus fuzzing on the record parsing logic, not the header validation. Which approach is most effective?
Select an answer first
7foundation · easy
What is the primary advantage of coverage-guided fuzzing over simple mutation-based fuzzing?
Select an answer first
8expert · hard
A security engineer is evaluating fuzzing tools for a project that has both a C++ library and a Python wrapper. The library is performance-critical and has been fuzzed with libFuzzer, but the Python wrapper is new and untested. The team wants to fuzz the Python wrapper's input handling. Which tool is most appropriate?
Select an answer first
9foundation · easy
A security tester is fuzzing a network protocol parser that expects inputs following a strict, well-defined structure. Which fuzzing technique is most appropriate for generating valid yet malformed inputs that the parser will accept?
Select an answer first
10application · medium
A fuzzing campaign on a database engine produced a crash that only occurs when a specific sequence of SQL statements is executed. The crash is a heap buffer overflow in the query optimizer. The team wants to determine if the crash is exploitable. What is the most important next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 2)

Questions 6–10

A penetration tester is fuzzing a file parser that accepts a custom binary format. The format has a magic header, a checksum, and then a series of records. The tester wants to focus fuzzing on the record parsing logic, not the header validation. Which approach is most effective?

What is the primary advantage of coverage-guided fuzzing over simple mutation-based fuzzing?

A security tester is fuzzing a network protocol parser that expects inputs following a strict, well-defined structure. Which fuzzing technique is most appropriate for generating valid yet malformed inputs that the parser will accept?

A fuzzing campaign on a database engine produced a crash that only occurs when a specific sequence of SQL statements is executed. The crash is a heap buffer overflow in the query optimizer. The team wants to determine if the crash is exploitable. What is the most important next step?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing