What is the purpose of fuzz testing in security testing?

• A. To validate unit test coverage.
• B. To uncover crashes, hangs, memory leaks by sending random data.
• C. To optimize performance.
• D. To ensure branding compliance.

Answer: (B)

Fuzz testing in security testing is about exploring how a system behaves when it receives random, unexpected, or malformed inputs. The main aim is to uncover conditions like crashes, hangs, or memory leaks that can reveal vulnerabilities or robustness problems in input handling, parsing, or memory management. By continuously injecting unpredictable data, fuzzing can expose bugs such as buffer overflows or invalid memory access that attackers could exploit. This is why it’s considered a security-focused technique: it seeks weaknesses exposed by improper input handling rather than verifying code paths or performance. In contrast, other goals like validating unit test coverage measure how well individual components are tested, optimizing performance aims for speed or resource use, and branding compliance checks adherence to branding rules—none of which are the focus of fuzz testing.