A product security team wants to ensure that a previously fixed fuzzing bug does not reappear in future releases. They have a regression test that reproduces the bug. What is the most effective way to integrate this into their development process?

Use a different fuzzer to verify the fix

Delete the crashing input after the fix to keep the corpus clean

Only run the regression test manually before each release

Add the crashing input to the fuzzing seed corpus and run it as a unit test in CI

A fuzzing campaign has produced a crash that appears to be a null pointer dereference in a library function. The crash is reproducible but only when the input contains a specific sequence of bytes. The team wants to determine if the crash is exploitable. Which analysis step is most important?

Examine the crash context to see if an attacker can control the pointer value or the memory layout

Count how many times the crash occurs in the fuzzing campaign

Check if the crash occurs on all operating systems

Verify that the input file is valid according to the format specification

When a fuzzer finds a crash, what is the most important artifact to collect for later analysis?

The total number of test cases executed before the crash.

The system's CPU and memory usage during the crash.

The fuzzer's execution speed at the time of the crash.

The exact input that caused the crash.

A product security team wants to add fuzzing to their regression testing for a library that parses TLS certificates. They have a set of known crash inputs from previous fuzzing campaigns. What is the best way to use these inputs in regression testing?

Discard the crash inputs because they are no longer relevant after the fix.

Only keep the crash inputs that are easy to understand.

Use the crash inputs only in manual testing, not in automated regression.

Add the crash inputs to the test suite and verify that they no longer cause crashes.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 3)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which fuzzing approach requires access to the source code of the target application to generate test cases?
Select an answer first
12application · medium
A product security team wants to ensure that a previously fixed fuzzing bug does not reappear in future releases. They have a regression test that reproduces the bug. What is the most effective way to integrate this into their development process?
Select an answer first
13application · medium
A fuzzing campaign has produced a crash that appears to be a null pointer dereference in a library function. The crash is reproducible but only when the input contains a specific sequence of bytes. The team wants to determine if the crash is exploitable. Which analysis step is most important?
Select an answer first
14foundation · easy
When a fuzzer finds a crash, what is the most important artifact to collect for later analysis?
Select an answer first
15application · medium
A product security team wants to add fuzzing to their regression testing for a library that parses TLS certificates. They have a set of known crash inputs from previous fuzzing campaigns. What is the best way to use these inputs in regression testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.