How do regression tests that include previously found crash inputs help improve product security?

They ensure that fixed vulnerabilities do not reappear in future releases.

They provide a way to measure the performance of the fuzzer.

They replace the need for ongoing fuzzing campaigns.

They automatically generate new fuzzing test cases.

What is the primary purpose of using a seed corpus in fuzzing?

To ensure that the fuzzer only tests inputs that are known to be safe.

To provide a set of valid inputs that the fuzzer can mutate to generate new test cases.

To automatically generate grammar-based test cases without any manual effort.

To replace the need for code coverage analysis during the fuzzing campaign.

A team is fuzzing a file archiver that supports multiple formats (ZIP, RAR, 7z). They have limited time and want to focus on the format most likely to contain vulnerabilities. Which factor should they consider first?

The complexity of the format specification and the amount of code dedicated to parsing it.

The ease of generating valid test cases for the format.

The popularity of the format among users.

The availability of existing fuzzing harnesses for the format.

When analyzing a target application for fuzzing, what is the primary purpose of identifying entry points?

To map out the internal data flow and code paths within the application.

To determine where the application accepts external input that can be manipulated by an attacker.

To identify the programming language and compiler used to build the application.

To determine the licensing and legal restrictions on fuzzing the application.

A fuzzing campaign using libFuzzer is running on a library that parses image files. The fuzzer has found several crashes, but the team is unsure if they are all caused by the same bug. What is the most efficient way to determine this?

Run each crashing input through the fuzzer again to see if it crashes consistently.

Report all crashes to the development team and let them decide.

Manually inspect each crashing input to see if they look similar.

Use a tool that automatically clusters crashes based on stack traces.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 6)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 26–30

26foundation · easy
How do regression tests that include previously found crash inputs help improve product security?
Select an answer first
27foundation · easy
What is the primary purpose of using a seed corpus in fuzzing?
Select an answer first
28expert · hard
A team is fuzzing a file archiver that supports multiple formats (ZIP, RAR, 7z). They have limited time and want to focus on the format most likely to contain vulnerabilities. Which factor should they consider first?
Select an answer first
29foundation · easy
When analyzing a target application for fuzzing, what is the primary purpose of identifying entry points?
Select an answer first
30application · medium
A fuzzing campaign using libFuzzer is running on a library that parses image files. The fuzzer has found several crashes, but the team is unsure if they are all caused by the same bug. What is the most efficient way to determine this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.