A security researcher is fuzzing a network service that uses TLS. The service has a custom application protocol after the TLS handshake. The researcher has a valid client certificate and can complete the handshake. They want to fuzz the application protocol messages. Which approach is most effective?

Use a black-box fuzzer that replays captured TLS sessions with mutations

Use a generation-based fuzzer that generates complete TLS records with random application data

Use a stateful fuzzer that can perform the TLS handshake and then mutate application-layer messages

Use a stateless fuzzer that sends random bytes to the TLS port

A software company wants to integrate fuzzing into its CI/CD pipeline for a library that parses JSON configuration files. The team has a small set of seed files and wants to catch regressions quickly on every commit. Which integration strategy best balances speed and coverage?

Use a mutation-based fuzzer that generates random inputs without any seed corpus to avoid maintenance.

Run a short regression fuzzing job with a limited time budget and a saved corpus from previous runs.

Run a full coverage-guided fuzzing campaign for 24 hours on every commit before merging.

Only run fuzzing manually before major releases to avoid slowing down the CI pipeline.

In the context of product security testing, what is the primary purpose of fuzzing?

To verify that an application's features work as intended under normal, expected input conditions.

To measure the performance and scalability of an application under high load and stress conditions.

To manually review source code for common coding mistakes that could lead to security vulnerabilities.

To automatically discover vulnerabilities by providing unexpected or malformed inputs to an application and observing its behavior.

A security team is fuzzing a network service that parses a text-based protocol with strict grammar rules, such as SMTP commands. They have a grammar specification and want to generate test cases that are both syntactically valid and likely to trigger parser edge cases. Which technique is most appropriate?

Grammar-based generation that produces valid commands with random variations in parameters.

Mutation-based fuzzing of captured valid SMTP sessions.

Coverage-guided fuzzing without a grammar, using random bytes as input.

White-box fuzzing that symbolically executes the parser to derive all possible inputs.

During a fuzzing campaign, what is the primary purpose of monitoring the target application for crashes and hangs?

To measure the performance of the fuzzer in terms of executions per second.

To identify inputs that cause the application to fail, which may indicate security vulnerabilities.

To ensure that the fuzzer is not consuming too much CPU or memory.

To verify that the fuzzer is generating a diverse set of test cases.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 5)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 21–25

21expert · hard
A security researcher is fuzzing a network service that uses TLS. The service has a custom application protocol after the TLS handshake. The researcher has a valid client certificate and can complete the handshake. They want to fuzz the application protocol messages. Which approach is most effective?
Select an answer first
22application · medium
A software company wants to integrate fuzzing into its CI/CD pipeline for a library that parses JSON configuration files. The team has a small set of seed files and wants to catch regressions quickly on every commit. Which integration strategy best balances speed and coverage?
Select an answer first
23foundation · easy
In the context of product security testing, what is the primary purpose of fuzzing?
Select an answer first
24application · medium
A security team is fuzzing a network service that parses a text-based protocol with strict grammar rules, such as SMTP commands. They have a grammar specification and want to generate test cases that are both syntactically valid and likely to trigger parser edge cases. Which technique is most appropriate?
Select an answer first
25foundation · easy
During a fuzzing campaign, what is the primary purpose of monitoring the target application for crashes and hangs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 5)

Questions 21–25

A software company wants to integrate fuzzing into its CI/CD pipeline for a library that parses JSON configuration files. The team has a small set of seed files and wants to catch regressions quickly on every commit. Which integration strategy best balances speed and coverage?

In the context of product security testing, what is the primary purpose of fuzzing?

During a fuzzing campaign, what is the primary purpose of monitoring the target application for crashes and hangs?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing