A penetration tester is evaluating a file parser for a proprietary format. They want to find memory corruption bugs that could be exploited. Which type of bug is fuzzing most likely to uncover?

Business logic errors in a payment system

Authentication bypass in the login flow

SQL injection in a web application

Buffer overflows in the parsing logic

A software company wants to add fuzzing to its CI pipeline for a command-line tool that processes user-supplied files. The team wants to catch regressions quickly but also wants to avoid slowing down the build significantly. Which approach best balances these goals?

Run a full fuzzing campaign for 24 hours on every commit.

Use a fuzzer that only performs mutation without coverage feedback.

Run fuzzing only on release branches.

Run a short fuzzing session with a minimized corpus and a fixed time limit on every commit.

A fuzzing engineer has a large corpus of seed files for a PDF parser. The corpus contains many files that exercise the same code paths. The engineer wants to reduce the corpus to the smallest set that still achieves the same coverage. Which tool or technique should the engineer use?

Manually delete files that appear similar in size.

Concatenate all files into one large seed.

Run the corpus through a coverage-guided fuzzer's built-in corpus minimization feature.

Use a random sampling of the corpus.

What does determining the exploitability of a crash involve?

Checking if the crash is caused by a known vulnerability

Determining the exact line of code that caused the crash

Assessing whether the crash can be turned into a working exploit

Measuring the performance impact of the crash

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 5)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 21–25

21application · medium
A penetration tester is evaluating a file parser for a proprietary format. They want to find memory corruption bugs that could be exploited. Which type of bug is fuzzing most likely to uncover?
Select an answer first
22application · medium
A software company wants to add fuzzing to its CI pipeline for a command-line tool that processes user-supplied files. The team wants to catch regressions quickly but also wants to avoid slowing down the build significantly. Which approach best balances these goals?
Select an answer first
23application · medium
A fuzzing engineer has a large corpus of seed files for a PDF parser. The corpus contains many files that exercise the same code paths. The engineer wants to reduce the corpus to the smallest set that still achieves the same coverage. Which tool or technique should the engineer use?
Select an answer first
24foundation · easy
Which fuzzing framework is designed to be used with LLVM's sanitizer coverage and is often integrated into build systems?
Select an answer first
25foundation · easy
What does determining the exploitability of a crash involve?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.