A fuzzing engineer is working on a C++ library that uses exceptions and has complex error-handling paths. The engineer wants to find bugs that only occur when certain error conditions are triggered. The engineer is using a coverage-guided fuzzer with AddressSanitizer. Which additional instrumentation or technique would most help discover these error-path bugs?

Run the fuzzer with a debugger attached to catch exceptions.

Enable UndefinedBehaviorSanitizer to catch undefined behavior in error paths.

Add a custom mutator that focuses on boundary values for error conditions.

Use a generation-based fuzzer to produce inputs that trigger exceptions.

A developer is setting up a fuzzing workflow for a new library. They have identified the target function and have a few seed inputs. They want to use libFuzzer. What is the correct order of steps in the fuzzing workflow?

Write a fuzz harness, compile with sanitizers, run the fuzzer, triage crashes.

Run the fuzzer first, then write the harness.

Compile with sanitizers after running the fuzzer.

Triage crashes before running the fuzzer.

Which sanitizer is commonly used with fuzzing to detect memory errors such as use-after-free?

UndefinedBehaviorSanitizer (UBSan)

A fuzzing campaign for a network service has produced thousands of crashes. The crashes appear to be related, but the researcher needs to determine which ones represent distinct root causes. Which step should the researcher take first?

Immediately write a proof-of-concept exploit for the first crash.

Use a crash deduplication tool that groups crashes by stack trace or coverage signature.

Delete all crashes and restart the fuzzer with a different seed corpus.

Re-run each crash with the same seed to confirm reproducibility.

A security team is fuzzing a complex image parser with libFuzzer. They have a large corpus of valid images, but coverage has plateaued. They suspect the fuzzer is stuck in a few deep paths and not exploring other format features. They have limited CPU resources and want to improve coverage. Which strategy is most effective?

Run multiple fuzzer instances with different random seeds and merge their corpora periodically.

Switch to a generation-based fuzzer for image formats.

Reduce the corpus to only the smallest inputs.

Increase the mutation rate to generate more diverse inputs.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 5Objective 3

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 9)

Part of the Endpoint Evasion, Privilege Escalation, and Product Security Testing domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 41–45

41expert · hard
A fuzzing engineer is working on a C++ library that uses exceptions and has complex error-handling paths. The engineer wants to find bugs that only occur when certain error conditions are triggered. The engineer is using a coverage-guided fuzzer with AddressSanitizer. Which additional instrumentation or technique would most help discover these error-path bugs?
Select an answer first
42application · medium
A developer is setting up a fuzzing workflow for a new library. They have identified the target function and have a few seed inputs. They want to use libFuzzer. What is the correct order of steps in the fuzzing workflow?
Select an answer first
43foundation · easy
Which sanitizer is commonly used with fuzzing to detect memory errors such as use-after-free?
Select an answer first
44application · medium
A fuzzing campaign for a network service has produced thousands of crashes. The crashes appear to be related, but the researcher needs to determine which ones represent distinct root causes. Which step should the researcher take first?
Select an answer first
45expert · hard
A security team is fuzzing a complex image parser with libFuzzer. They have a large corpus of valid images, but coverage has plateaued. They suspect the fuzzer is stuck in a few deep paths and not exploring other format features. They have limited CPU resources and want to improve coverage. Which strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Source Code Based Fuzzing Techniques GXPN Practice Questions (Page 9)

Questions 41–45

A developer is setting up a fuzzing workflow for a new library. They have identified the target function and have a few seed inputs. They want to use libFuzzer. What is the correct order of steps in the fuzzing workflow?

Which sanitizer is commonly used with fuzzing to detect memory errors such as use-after-free?

A fuzzing campaign for a network service has produced thousands of crashes. The crashes appear to be related, but the researcher needs to determine which ones represent distinct root causes. Which step should the researcher take first?

Keep studying — Endpoint Evasion, Privilege Escalation, and Product Security Testing