A penetration tester is fuzzing a custom binary protocol parser. They have a set of seed inputs captured from real network traffic. After running the fuzzer for several hours, they have thousands of unique crashes. What is the most important next step in the fuzzing workflow?

Delete the seed corpus to avoid bias.

Immediately report all crashes to the vendor.

Triage the crashes to identify root cause and filter out duplicates.

Increase the fuzzing time to get even more crashes.

A company wants to add fuzzing to its CI/CD pipeline for a library that is used by multiple products. The library has a large API surface and many input formats. The team has limited CI resources and wants to maximize the coverage of the library's code with the available time. Which approach is most effective?

Run a single long fuzzing campaign on one input format per release.

Create multiple fuzzing targets for each input format and run them in parallel with a time limit.

Use a generation-based fuzzer with a grammar for all input formats.

Create a single fuzzing target that accepts a generic byte stream and run it for a short time.

A security analyst is fuzzing a binary file parser that has a checksum field. The analyst notices that most mutated inputs are rejected early because the checksum is invalid. Which mutation strategy should the analyst use to improve the fuzzer's ability to reach deeper parsing logic?

Use a generation-based fuzzer that creates inputs from a grammar.

Disable the checksum validation in the target code.

Increase the mutation rate to produce more inputs.

Use a custom mutator that recalculates the checksum after each mutation.

Which type of bug is fuzzing most commonly designed to uncover?

Configuration mistakes in deployment scripts

Memory corruption vulnerabilities such as buffer overflows

Authentication bypasses in web applications

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 10)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 46–50

46application · medium
A penetration tester is fuzzing a custom binary protocol parser. They have a set of seed inputs captured from real network traffic. After running the fuzzer for several hours, they have thousands of unique crashes. What is the most important next step in the fuzzing workflow?
Select an answer first
47expert · hard
A company wants to add fuzzing to its CI/CD pipeline for a library that is used by multiple products. The library has a large API surface and many input formats. The team has limited CI resources and wants to maximize the coverage of the library's code with the available time. Which approach is most effective?
Select an answer first
48application · medium
A developer is integrating fuzzing into their CI pipeline. They want to detect memory leaks and use-after-free errors in their C code. Which sanitizer should they enable?
Select an answer first
49application · medium
A security analyst is fuzzing a binary file parser that has a checksum field. The analyst notices that most mutated inputs are rejected early because the checksum is invalid. Which mutation strategy should the analyst use to improve the fuzzer's ability to reach deeper parsing logic?
Select an answer first
50foundation · easy
Which type of bug is fuzzing most commonly designed to uncover?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 10)

Questions 46–50

A penetration tester is fuzzing a custom binary protocol parser. They have a set of seed inputs captured from real network traffic. After running the fuzzer for several hours, they have thousands of unique crashes. What is the most important next step in the fuzzing workflow?

A developer is integrating fuzzing into their CI pipeline. They want to detect memory leaks and use-after-free errors in their C code. Which sanitizer should they enable?

A security analyst is fuzzing a binary file parser that has a checksum field. The analyst notices that most mutated inputs are rejected early because the checksum is invalid. Which mutation strategy should the analyst use to improve the fuzzer's ability to reach deeper parsing logic?

Which type of bug is fuzzing most commonly designed to uncover?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing