What is the purpose of compiler instrumentation in fuzzing?

To add debug symbols to the binary for easier reverse engineering

To remove security protections like ASLR

To insert code that tracks which branches and edges are executed

To optimize the target for faster execution

A penetration tester is fuzzing a file parser that expects a header with a magic number, a length field, and then a payload. The tester has a small corpus of valid files. Using AFL, they want to maximize the chance of finding memory corruption bugs in the payload-processing code. Which approach best balances mutation effectiveness and efficiency?

Generate a large corpus of random files and add them all to the seed directory.

Disable all deterministic mutations and rely only on havoc mutations.

Use the default AFL mutation strategy with the existing corpus and no dictionary.

Provide a dictionary with the magic number and common length-field values, and keep the corpus small.

Which action is an example of mutation-based fuzzing?

Selecting inputs from a public vulnerability database

Using a model of the file format to create valid inputs

Generating inputs from a formal grammar of the protocol

Randomly flipping bits in a valid seed input

What is the main advantage of using code coverage feedback in fuzzing?

It allows the fuzzer to automatically fix discovered vulnerabilities

It eliminates the need for a seed corpus

It guarantees that all bugs will be found

It enables the fuzzer to focus on unexplored parts of the code

What is the primary purpose of fuzzing in security testing?

To replace manual code review with automated static analysis

To prove that software is free of vulnerabilities

To automatically generate and execute malformed or unexpected inputs to uncover crashes and bugs

To identify the root cause of every software bug

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 1)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 1–5

1foundation · easy
What is the purpose of compiler instrumentation in fuzzing?
Select an answer first
2application · medium
A penetration tester is fuzzing a file parser that expects a header with a magic number, a length field, and then a payload. The tester has a small corpus of valid files. Using AFL, they want to maximize the chance of finding memory corruption bugs in the payload-processing code. Which approach best balances mutation effectiveness and efficiency?
Select an answer first
3foundation · easy
Which action is an example of mutation-based fuzzing?
Select an answer first
4foundation · easy
What is the main advantage of using code coverage feedback in fuzzing?
Select an answer first
5foundation · easy
What is the primary purpose of fuzzing in security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.