A security engineer is fuzzing a C library that parses network packets. They are using libFuzzer with AddressSanitizer and notice that the fuzzer spends most of its time re-executing the same shallow parsing paths, rarely reaching the deeper state-machine logic that handles packet reassembly. The engineer wants to improve path exploration without rewriting the parser. Which action is most likely to increase coverage of the deeper logic?

Add seed inputs that represent complete, valid packet reassembly sequences.

Increase the maximum input length so the fuzzer can generate larger packets.

Switch from libFuzzer to AFL and use its deterministic mutation stage.

Add a dictionary of valid protocol keywords and magic bytes to guide mutations.

A software company wants to add fuzzing to their CI/CD pipeline for a C++ library. They need fast feedback on every commit but also want to run a longer fuzzing campaign nightly. Which approach best meets both needs?

Only run fuzzing nightly, not in CI.

Use a single long-running fuzzer that never stops.

Run the same fuzzing command in CI and nightly, with the same timeout.

Run a short smoke test with a small corpus in CI, and a longer campaign with a larger corpus nightly.

A fuzzing campaign for a network service has produced a crash that appears to be a heap buffer overflow. The crash is reproducible, but the analyst is unsure whether it is exploitable. The analyst has access to the source code and can rebuild with different sanitizers. Which combination of actions would best determine exploitability?

Rebuild with AddressSanitizer and run the crash to get a detailed stack trace and heap allocation history.

Rebuild with MemorySanitizer to check for uninitialized memory.

Use a fuzzer's crash deduplication tool to group the crash with others.

Run the crash under a debugger without sanitizers.

A team is integrating fuzzing into their CI pipeline. They have a large corpus of historical test files, but the fuzzing job takes too long and often times out. They want to maintain good coverage while reducing runtime. What is the best first step?

Randomly delete half of the corpus files.

Increase the CI timeout and run the fuzzer for longer.

Switch to a different fuzzer engine.

Minimize the corpus using the fuzzer's built-in minimization feature.

A developer is fuzzing a parser for a binary format that includes a checksum field. Mutation-based fuzzing with AFL is not reaching code after the checksum verification because mutated inputs fail the checksum. The developer wants to reach that deeper code. Which approach is most effective?

Add the checksum field to the AFL dictionary.

Use a generation-based fuzzer that computes the correct checksum for each generated input.

Disable the checksum check in the parser.

Use a larger seed corpus with many different checksum values.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 4)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 16–20

16application · medium
A security engineer is fuzzing a C library that parses network packets. They are using libFuzzer with AddressSanitizer and notice that the fuzzer spends most of its time re-executing the same shallow parsing paths, rarely reaching the deeper state-machine logic that handles packet reassembly. The engineer wants to improve path exploration without rewriting the parser. Which action is most likely to increase coverage of the deeper logic?
Select an answer first
17application · medium
A software company wants to add fuzzing to their CI/CD pipeline for a C++ library. They need fast feedback on every commit but also want to run a longer fuzzing campaign nightly. Which approach best meets both needs?
Select an answer first
18expert · hard
A fuzzing campaign for a network service has produced a crash that appears to be a heap buffer overflow. The crash is reproducible, but the analyst is unsure whether it is exploitable. The analyst has access to the source code and can rebuild with different sanitizers. Which combination of actions would best determine exploitability?
Select an answer first
19application · medium
A team is integrating fuzzing into their CI pipeline. They have a large corpus of historical test files, but the fuzzing job takes too long and often times out. They want to maintain good coverage while reducing runtime. What is the best first step?
Select an answer first
20expert · hard
A developer is fuzzing a parser for a binary format that includes a checksum field. Mutation-based fuzzing with AFL is not reaching code after the checksum verification because mutated inputs fail the checksum. The developer wants to reach that deeper code. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 4)

Questions 16–20

A software company wants to add fuzzing to their CI/CD pipeline for a C++ library. They need fast feedback on every commit but also want to run a longer fuzzing campaign nightly. Which approach best meets both needs?

A team is integrating fuzzing into their CI pipeline. They have a large corpus of historical test files, but the fuzzing job takes too long and often times out. They want to maintain good coverage while reducing runtime. What is the best first step?

A developer is fuzzing a parser for a binary format that includes a checksum field. Mutation-based fuzzing with AFL is not reaching code after the checksum verification because mutated inputs fail the checksum. The developer wants to reach that deeper code. Which approach is most effective?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing