A team is fuzzing a PDF parser. They have a large corpus of valid PDF files, but the fuzzer is spending too much time mutating the file structure (e.g., cross-reference tables) and not enough time on the content streams that contain the actual parsing logic. What is the best way to improve the seed corpus?

Minimize the corpus by removing files that do not add new coverage, and add seeds that specifically target content stream features.

Increase the mutation rate so the fuzzer changes more bytes per input.

Randomly select a subset of the corpus to reduce the number of seeds.

Use the entire corpus as-is because more seeds always improve coverage.

What is the primary goal of crash triage in the context of fuzzing?

To delete all crash artifacts to save storage space.

To rerun the fuzzer with the same seed corpus to see if the crash repeats.

To determine the root cause and exploitability of each crash.

To automatically fix the bugs that caused the crashes.

Which test case generation approach is most effective for fuzzing a complex file format with a well-defined specification, such as a PDF or a network protocol?

Brute-force enumeration of all possible inputs

Using only coverage feedback without a grammar

Random mutation of a single seed

A product security team is fuzzing a closed-source binary that runs as a Windows service and listens on a named pipe. They have no source code, but they have administrative access to the host and can attach a debugger. They want to maximize the number of unique crashes while minimizing the time spent on non-actionable hangs. Which approach is most effective?

Use a black-box fuzzer that sends random data to the named pipe without any coverage feedback

Use a white-box fuzzer with symbolic execution on the entire service

Use a grey-box fuzzer with DynamoRIO or Intel PT to get coverage feedback, and set a per-input timeout

Use a generation-based fuzzer with a hand-written grammar of the named pipe protocol

A security researcher is fuzzing a network protocol that uses a session ID in each packet. The session ID is a 32-bit integer that must be valid for the packet to be processed. The researcher has a grammar for the protocol. What is the best way to generate test cases that explore the session ID handling?

Use a white-box fuzzer that symbolically executes the session ID validation code.

Use a grammar-based generator that produces valid session IDs from the protocol specification.

Use a coverage-guided fuzzer without a grammar, relying on random bytes.

Use a mutation-based fuzzer that randomly changes the session ID in captured packets.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 4)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 16–20

16expert · hard
A team is fuzzing a PDF parser. They have a large corpus of valid PDF files, but the fuzzer is spending too much time mutating the file structure (e.g., cross-reference tables) and not enough time on the content streams that contain the actual parsing logic. What is the best way to improve the seed corpus?
Select an answer first
17foundation · easy
What is the primary goal of crash triage in the context of fuzzing?
Select an answer first
18foundation · easy
Which test case generation approach is most effective for fuzzing a complex file format with a well-defined specification, such as a PDF or a network protocol?
Select an answer first
19expert · hard
A product security team is fuzzing a closed-source binary that runs as a Windows service and listens on a named pipe. They have no source code, but they have administrative access to the host and can attach a debugger. They want to maximize the number of unique crashes while minimizing the time spent on non-actionable hangs. Which approach is most effective?
Select an answer first
20application · medium
A security researcher is fuzzing a network protocol that uses a session ID in each packet. The session ID is a 32-bit integer that must be valid for the packet to be processed. The researcher has a grammar for the protocol. What is the best way to generate test cases that explore the session ID handling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 4)

Questions 16–20

What is the primary goal of crash triage in the context of fuzzing?

Which test case generation approach is most effective for fuzzing a complex file format with a well-defined specification, such as a PDF or a network protocol?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing