A fuzzing campaign using libFuzzer on a C++ library is running in a CI environment with limited CPU resources. The team notices that the fuzzer is spending most of its time on a single input that causes a very slow parsing path, but no crash. They want to improve the efficiency of the campaign. What should they do?

Remove the slow input from the corpus to avoid wasting time.

Use a timeout value that kills inputs exceeding a reasonable limit and treats them as hangs.

Increase the timeout for each input to allow the slow path to complete.

Switch to a mutation-based fuzzer that does not track coverage.

A security analyst is evaluating fuzzing approaches for a closed-source legacy application that only has a network interface. The analyst has no source code and no documentation about the protocol. Which fuzzing type is most appropriate for this scenario?

Black-box fuzzing with protocol inference from observed traffic

Grey-box fuzzing with coverage feedback

White-box fuzzing with symbolic execution

Generation-based fuzzing with a formal protocol specification

A product security team is preparing to fuzz a network daemon that parses a proprietary binary protocol. The protocol has a well-defined header followed by variable-length fields, and the team has a large set of legitimate traffic captures. They want to maximize coverage of the parser's state machine while minimizing the effort to build a grammar from scratch. Which approach best meets this goal?

Use a mutation-based fuzzer on the captured traffic with a coverage-guided engine

Use a generation-based fuzzer with a hand-written grammar of the protocol

Use a pure black-box fuzzer that sends random bytes to the network port

Use a white-box fuzzer with symbolic execution on the entire daemon

A security team is fuzzing a network protocol implementation and needs to generate test cases that respect the protocol's state machine (e.g., handshake, data transfer, teardown). Which fuzzing tool feature is most important for this task?

High execution speed to maximize the number of test cases

Support for multiple input formats

Stateful fuzzing support that can model and transition between protocol states

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 7)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 31–35

31expert · hard
A fuzzing campaign using libFuzzer on a C++ library is running in a CI environment with limited CPU resources. The team notices that the fuzzer is spending most of its time on a single input that causes a very slow parsing path, but no crash. They want to improve the efficiency of the campaign. What should they do?
Select an answer first
32application · medium
A security analyst is evaluating fuzzing approaches for a closed-source legacy application that only has a network interface. The analyst has no source code and no documentation about the protocol. Which fuzzing type is most appropriate for this scenario?
Select an answer first
33application · medium
A product security team is preparing to fuzz a network daemon that parses a proprietary binary protocol. The protocol has a well-defined header followed by variable-length fields, and the team has a large set of legitimate traffic captures. They want to maximize coverage of the parser's state machine while minimizing the effort to build a grammar from scratch. Which approach best meets this goal?
Select an answer first
34foundation · easy
Which fuzzing tool is known for its coverage-guided approach and is commonly used for fuzzing file parsers and binary formats?
Select an answer first
35application · medium
A security team is fuzzing a network protocol implementation and needs to generate test cases that respect the protocol's state machine (e.g., handshake, data transfer, teardown). Which fuzzing tool feature is most important for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 7)

Questions 31–35

A security analyst is evaluating fuzzing approaches for a closed-source legacy application that only has a network interface. The analyst has no source code and no documentation about the protocol. Which fuzzing type is most appropriate for this scenario?

Which fuzzing tool is known for its coverage-guided approach and is commonly used for fuzzing file parsers and binary formats?

A security team is fuzzing a network protocol implementation and needs to generate test cases that respect the protocol's state machine (e.g., handshake, data transfer, teardown). Which fuzzing tool feature is most important for this task?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing