The correct answer is that the library must be loaded at a fixed address for the ROP chain to succeed. This is because a return-oriented programming exploit bypasses Data Execution Prevention (DEP) by chaining together small instruction sequences called gadgets, which must reside in executable memory at predictable locations. If a dynamically linked library is not affected by ASLR, it means it loads at the same fixed address every time, allowing the tester to hardcode gadget addresses into the ROP chain without needing to leak memory first. On the CompTIA PenTest+ PT0-002 exam, this concept tests your understanding of how ASLR and DEP work together—a common trap is assuming any library will work, but only those loaded at a fixed address provide the reliability needed for the exploit. Remember the mnemonic: "Fixed for the fix"—a fixed address library fixes the ROP chain’s success.
PT0-002 Tools and Code Analysis Practice Question
This PT0-002 practice question tests your understanding of tools and code analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is writing a return-oriented programming (ROP) exploit for a Linux binary to bypass Data Execution Prevention (DEP). The binary has DEP enabled, but the tester identifies a gadget in a dynamically linked library that is not affected by ASLR. Which condition must be true for the ROP chain to succeed?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The library must be loaded at a fixed address
Option A is correct because for a ROP chain to succeed when DEP is enabled, the attacker needs to control the execution flow by chaining together gadgets (small instruction sequences ending with a return) that reside in executable memory regions. If a dynamically linked library is not affected by ASLR, it means it is loaded at a fixed, predictable address, allowing the tester to reliably use gadgets from that library without needing to bypass ASLR for that specific module. This fixed address ensures the ROP chain's addresses are valid across runs, which is essential for the exploit to work.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The library must be loaded at a fixed address
Why this is correct
Correct. If the library does not use ASLR, its base address is predictable, allowing the ROP chain to call gadgets reliably.
Related concept
Read the scenario before looking for a memorised answer.
✗
The stack must be executable
Why it's wrong here
If stack were executable, ROP would not be needed; DEP prevents execution on the stack.
✗
The binary must be compiled with stack canaries
Why it's wrong here
Stack canaries detect buffer overflows but do not affect ROP execution.
✗
The exploit must bypass ASLR for the main binary
Why it's wrong here
If the library is not ASLR-enabled, the gadgets' addresses are fixed regardless of the binary's ASLR status.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume ASLR must be fully bypassed for any exploit to work, but the question specifically isolates a library not affected by ASLR, making the ROP chain viable without bypassing ASLR for the main binary.
Detailed technical explanation
How to think about this question
Under the hood, ROP works by overwriting the saved return address on the stack with the address of a gadget, then subsequent return addresses point to further gadgets, creating a chain. The key is that each gadget ends with a `ret` instruction, which pops the next address from the stack and jumps to it. In a real-world scenario, a common fixed-address library is `libc` on older systems or when using `ld.so` with `LD_PRELOAD` to force a specific load address, or when the binary uses `-no-pie` and the library is loaded at a static address due to legacy compatibility. The subtle behavior is that even if ASLR randomizes the main binary, the library's base address remains constant, allowing the attacker to hardcode gadget offsets.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Tools and Code Analysis — This question tests Tools and Code Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The library must be loaded at a fixed address — Option A is correct because for a ROP chain to succeed when DEP is enabled, the attacker needs to control the execution flow by chaining together gadgets (small instruction sequences ending with a return) that reside in executable memory regions. If a dynamically linked library is not affected by ASLR, it means it is loaded at a fixed, predictable address, allowing the tester to reliably use gadgets from that library without needing to bypass ASLR for that specific module. This fixed address ensures the ROP chain's addresses are valid across runs, which is essential for the exploit to work.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.