A team is fuzzing a library that parses a custom binary format with a checksum at the end. The fuzzer is generating many inputs that fail the checksum and are rejected before reaching the parser. What is the best way to improve the fuzzer's effectiveness?

Use a mutation-based fuzzer that randomly flips bits in the checksum field as well.

Remove the checksum validation from the parser to allow all inputs through.

Use a grammar-based generator that computes the correct checksum for each generated input.

Increase the mutation rate to change more bytes in the input.

A software company wants to integrate fuzzing into its CI/CD pipeline so that every code change is tested for memory corruption bugs before release. The team already has a unit test suite and a build system that produces a test binary. Which approach is the most practical for continuous fuzzing?

Run a full AFL campaign for 24 hours in CI on every commit

Use a cloud-based fuzzing service only during release candidates

Run a short libFuzzer campaign with a seed corpus in CI on every commit

Replace all unit tests with fuzzing to save time

Why is it important to reliably reproduce a crash found during fuzzing?

To verify the root cause and confirm that a fix resolves the issue.

To prove that the fuzzer is working correctly.

To generate more test cases from the crash input.

To increase the fuzzer's execution speed.

When analyzing a target application for fuzzing, what is the main purpose of identifying input vectors?

To identify the operating system and hardware architecture the application runs on.

To understand the different types of data the application processes and how they are structured.

To locate the application's configuration files and default settings.

To determine the performance bottlenecks in the application's code.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 2

Product Security Testing and Fuzzing Foundations GXPN Practice Questions (Page 9)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 41–45

41foundation · easy
Which fuzzing tool is designed to be integrated directly into the compiler toolchain and is commonly used for fuzzing individual functions within a codebase?
Select an answer first
42application · medium
A team is fuzzing a library that parses a custom binary format with a checksum at the end. The fuzzer is generating many inputs that fail the checksum and are rejected before reaching the parser. What is the best way to improve the fuzzer's effectiveness?
Select an answer first
43application · medium
A software company wants to integrate fuzzing into its CI/CD pipeline so that every code change is tested for memory corruption bugs before release. The team already has a unit test suite and a build system that produces a test binary. Which approach is the most practical for continuous fuzzing?
Select an answer first
44foundation · easy
Why is it important to reliably reproduce a crash found during fuzzing?
Select an answer first
45foundation · easy
When analyzing a target application for fuzzing, what is the main purpose of identifying input vectors?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.