A fuzzing engineer is using AFL to fuzz a closed-source binary that is only available as a black-box executable. They want to use coverage guidance, but they cannot recompile the target. Which instrumentation approach should they use?

Use a generation-based fuzzer without coverage feedback.

Use AddressSanitizer by linking it at runtime.

Use a debugger to trace every execution.

Use AFL's QEMU mode to perform dynamic binary instrumentation.

A security researcher is fuzzing a Rust library that uses unsafe blocks for performance. They are using cargo-fuzz (libFuzzer) and want to detect memory safety issues that do not always crash immediately. Which instrumentation strategy should they enable?

No sanitizer, rely on the fuzzer's crash detection

UndefinedBehaviorSanitizer in addition to AddressSanitizer

When is generation-based fuzzing particularly useful?

When no seed inputs are available

When the fuzzer needs to run without any code instrumentation

When the target only accepts binary inputs

When the input format is complex and requires valid structure to reach deep code paths

What is a key benefit of integrating fuzzing into CI/CD pipelines?

It allows fuzzing to run continuously on every code change, catching regressions early

It guarantees that all vulnerabilities are fixed before release

It reduces the need for code reviews

It eliminates the need for manual security testing

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 3)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 11–15

11expert · hard
A fuzzing engineer is using AFL to fuzz a closed-source binary that is only available as a black-box executable. They want to use coverage guidance, but they cannot recompile the target. Which instrumentation approach should they use?
Select an answer first
12application · medium
A security researcher is fuzzing a Rust library that uses unsafe blocks for performance. They are using cargo-fuzz (libFuzzer) and want to detect memory safety issues that do not always crash immediately. Which instrumentation strategy should they enable?
Select an answer first
13foundation · easy
When is generation-based fuzzing particularly useful?
Select an answer first
14foundation · easy
What is a key benefit of integrating fuzzing into CI/CD pipelines?
Select an answer first
15foundation · easy
Which step in the fuzzing workflow involves selecting the software component to be tested?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.