A penetration tester is fuzzing a library that parses XML. The tester has a set of valid XML files and wants to find bugs that occur only when certain deeply nested elements are present. The tester is using a coverage-guided fuzzer. Which strategy will most likely discover those deep bugs?

Use a large dictionary of XML tags and attribute names to guide mutations.

Use a generation-based fuzzer that produces random XML without a schema.

Provide seed files that contain deeply nested XML structures and enable coverage feedback.

Rely on the fuzzer's default mutation engine without any seed corpus.

A development team maintains a JSON-based configuration parser. They want to fuzz it in CI to catch crashes early. The parser is strict: it rejects malformed JSON before any processing. Which fuzzing approach is most effective for reaching the parser's semantic validation logic?

Use AFL with a dictionary of JSON keywords like 'true', 'false', and 'null'.

Use a random byte fuzzer that ignores the JSON format entirely.

Use libFuzzer with a corpus of valid JSON files and rely on its built-in mutation engine.

Use a generation-based fuzzer that constructs inputs from a JSON grammar.

A development team maintains a web application that accepts JSON-based API requests. They want to integrate fuzzing into their CI/CD pipeline to catch parser bugs before deployment. The team has a formal JSON schema that defines all valid request structures. Which fuzzing strategy is most appropriate for this scenario?

Coverage-guided fuzzing with a random byte stream as input.

Mutation-based fuzzing of a few example JSON requests.

Manual test case creation for each API endpoint.

Generation-based fuzzing using the JSON schema to produce valid and boundary-case requests.

In the fuzzing workflow, what is the purpose of crash triage?

To measure code coverage achieved by the fuzzer

To generate new seed inputs for the next fuzzing campaign

To automatically fix the bugs found by the fuzzer

To determine the root cause, exploitability, and severity of each crash

What is the first step in analyzing a crash found by a fuzzer?

Patch the vulnerable code immediately

Reproduce the crash with the exact input that triggered it

Delete the crash input to avoid false positives

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 2)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 6–10

6application · medium
A penetration tester is fuzzing a library that parses XML. The tester has a set of valid XML files and wants to find bugs that occur only when certain deeply nested elements are present. The tester is using a coverage-guided fuzzer. Which strategy will most likely discover those deep bugs?
Select an answer first
7application · medium
A development team maintains a JSON-based configuration parser. They want to fuzz it in CI to catch crashes early. The parser is strict: it rejects malformed JSON before any processing. Which fuzzing approach is most effective for reaching the parser's semantic validation logic?
Select an answer first
8application · medium
A development team maintains a web application that accepts JSON-based API requests. They want to integrate fuzzing into their CI/CD pipeline to catch parser bugs before deployment. The team has a formal JSON schema that defines all valid request structures. Which fuzzing strategy is most appropriate for this scenario?
Select an answer first
9foundation · easy
In the fuzzing workflow, what is the purpose of crash triage?
Select an answer first
10foundation · easy
What is the first step in analyzing a crash found by a fuzzer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.