- A
Stack canaries
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
- B
Transport Layer Security (TLS)
Why wrong: Incorrect. TLS encrypts network traffic but does not protect against vulnerabilities in the application code itself, such as buffer overflows. It cannot prevent the exploitation of memory corruption bugs.
- C
Code signing
Why wrong: Incorrect. Code signing verifies that the software has not been tampered with and identifies the publisher. It does not provide runtime protection against memory corruption exploits in the running application.
- D
Data Execution Prevention (DEP)
Why wrong: Incorrect. DEP makes memory regions non-executable, which can prevent direct execution of injected shellcode. However, sophisticated attackers can bypass DEP using return-oriented programming (ROP). Stack canaries are generally more effective for detecting the overflow itself, even when DEP is present.
Quick Answer
Stack canaries are the correct choice because they provide a runtime detection mechanism specifically designed to catch buffer overflow exploitation before an attacker can hijack execution flow. When a function like strcpy() writes beyond a buffer’s boundary on the stack, it overwrites adjacent memory, including a small, randomly generated value—the canary—placed between the buffer and the return address. Before the function returns, the program checks whether the canary has been altered; if it has, the program immediately terminates, blocking arbitrary code execution. On the Security+ SY0-701 exam, this concept tests your understanding of runtime defenses against memory corruption vulnerabilities, often appearing in questions about secure coding practices or system hardening. A common trap is confusing stack canaries with input validation or ASLR—remember that canaries detect corruption at runtime, while validation prevents the overflow from occurring. Memory tip: think of a “canary in a coal mine”—if the canary is dead, the stack has been poisoned.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: stack canaries are random values placed on the stack to detect buffer overflows.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Stack canaries
Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.
Key principle: Stack canaries are random values placed on the stack to detect buffer overflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stack canaries
Why this is correct
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
Related concept
Stack canaries are random values placed on the stack to detect buffer overflows.
- ✗
Transport Layer Security (TLS)
Why it's wrong here
Incorrect. TLS encrypts network traffic but does not protect against vulnerabilities in the application code itself, such as buffer overflows. It cannot prevent the exploitation of memory corruption bugs.
- ✗
Code signing
Why it's wrong here
Incorrect. Code signing verifies that the software has not been tampered with and identifies the publisher. It does not provide runtime protection against memory corruption exploits in the running application.
- ✗
Data Execution Prevention (DEP)
Why it's wrong here
Incorrect. DEP makes memory regions non-executable, which can prevent direct execution of injected shellcode. However, sophisticated attackers can bypass DEP using return-oriented programming (ROP). Stack canaries are generally more effective for detecting the overflow itself, even when DEP is present.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse runtime exploit mitigation (stack canaries) with network security controls (TLS) or software supply chain controls (code signing), leading them to pick a control that does not operate at the memory level during execution.
Detailed technical explanation
How to think about this question
Stack canaries are typically implemented by inserting a random value (e.g., from /dev/urandom) between local variables and the saved return address on the stack. In GCC, the -fstack-protector flag enables this; the canary is checked against a global copy before the function epilogue. A real-world example is the Microsoft EMET tool, which used stack canaries to mitigate exploits like those targeting the MS08-067 vulnerability.
KKey Concepts to Remember
- Stack canaries are random values placed on the stack to detect buffer overflows.
- They are positioned between local variables and the return address.
- If a canary is overwritten, the program terminates, preventing control-flow hijacking.
- Stack canaries are a runtime defense against stack-based buffer overflows.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Stack canaries are random values placed on the stack to detect buffer overflows.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Got this wrong? Here's your next step.
Review stack canaries are random values placed on the stack to detect buffer overflows., then practise related SY0-701 questions on the same topic to reinforce the concept.
- →
Threats, Vulnerabilities, and Mitigations — study guide chapter
Learn the concepts, then practise the questions
- →
Threats, Vulnerabilities, and Mitigations practice questions
Targeted practice on this topic area only
- →
All SY0-701 questions
1,152 questions across all exam domains
- →
Security+ SY0-701 study guide
Full concept coverage aligned to exam objectives
- →
SY0-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SY0-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
General Security Concepts practice questions
Practise SY0-701 questions linked to General Security Concepts.
Threats, Vulnerabilities, and Mitigations practice questions
Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.
Security Architecture practice questions
Practise SY0-701 questions linked to Security Architecture.
Security Operations practice questions
Practise SY0-701 questions linked to Security Operations.
Security Program Management and Oversight practice questions
Practise SY0-701 questions linked to Security Program Management and Oversight.
Security+ social engineering questions
Practise SY0-701 questions linked to Security+ social engineering questions.
Security+ cryptography practice questions
Practise SY0-701 questions linked to Security+ cryptography.
Security+ IAM questions
Practise SY0-701 questions linked to Security+ IAM questions.
Security+ risk management questions
Practise SY0-701 questions linked to Security+ risk management questions.
Security+ incident response questions
Practise SY0-701 questions linked to Security+ incident response questions.
Security+ malware questions
Practise SY0-701 questions linked to Security+ malware questions.
Security+ vulnerability management questions
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practice this exam
Start a free SY0-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SY0-701 question test?
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Stack canaries are random values placed on the stack to detect buffer overflows..
What is the correct answer to this question?
The correct answer is: Stack canaries — Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.
What should I do if I get this SY0-701 question wrong?
Review stack canaries are random values placed on the stack to detect buffer overflows., then practise related SY0-701 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Stack canaries are random values placed on the stack to detect buffer overflows.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More SY0-701 practice questions
- An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary tota…
- An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically s…
- An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and lega…
- An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domai…
- An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which t…
- An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employe…
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.