SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?
⚠ Common exam trap
Many candidates confuse runtime exploit mitigation (stack canaries) with network security controls (TLS) or software supply chain controls (code signing), leading them to pick a control that does not operate at the memory level during execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stack canaries
Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stack canaries
Why this is correct
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
- ✗
Transport Layer Security (TLS)
Why it's wrong here
Transport Layer Security (TLS) is incorrect because it secures data only while it is in transit over a network, using encryption and integrity checks to prevent eavesdropping or tampering between client and server. It does not inspect or modify application behavior at runtime, and it has no mechanism to detect or prevent a buffer overflow, which is a memory corruption flaw that occurs when a program writes beyond the bounds of an allocated buffer in its own address space. TLS operates at the session/presentation layer of the OSI model, whereas buffer overflows are exploited at the process memory level, so TLS is completely orthogonal to this type of vulnerability.
When this WOULD be correct
A question asking which control protects data confidentiality during transmission between a client and server, especially over an untrusted network.
- ✗
Code signing
Why it's wrong here
Code signing is incorrect because it is a static assurance mechanism that verifies the authenticity and integrity of the software binary via a digital signature, confirming that the code was signed by a trusted publisher and has not been altered since signing. However, it provides no runtime protection; once the signed executable is loaded into memory and executing, the CPU and OS do not perform any additional checks based on the signature to prevent memory corruption. A stack-based buffer overflow occurs during program execution due to a failure to validate input length, and code signing cannot detect or block that runtime event because it is not an active defensive control like a stack canary that protects the stack at runtime.
When this WOULD be correct
Code signing would be correct in a scenario where the question asks for a control to ensure that only trusted, unmodified software is executed, such as preventing execution of tampered binaries or malware disguised as legitimate applications.
- ✗
Data Execution Prevention (DEP)
Why it's wrong here
Incorrect. DEP makes memory regions non-executable, which can prevent direct execution of injected shellcode. However, sophisticated attackers can bypass DEP using return-oriented programming (ROP). Stack canaries are generally more effective for detecting the overflow itself, even when DEP is present.
When this WOULD be correct
A question asking which control prevents execution of injected shellcode in a buffer overflow scenario, assuming no ROP or other bypass techniques, would have DEP as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Stack canariesCorrect answer▾
Why this is correct
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
✗Transport Layer Security (TLS)Wrong answer — click to see why▾
Why this is wrong here
TLS encrypts network traffic but does not prevent buffer overflow exploitation; the vulnerability is in the application code, not in transit.
★ When this WOULD be the correct answer
A question asking which control protects data confidentiality during transmission between a client and server, especially over an untrusted network.
Why candidates choose this
Candidates may think TLS provides runtime protection against all attacks or confuse network security controls with application-level exploit mitigations.
✗Code signingWrong answer — click to see why▾
Why this is wrong here
Code signing verifies the integrity and origin of executable code, but it does not detect or prevent runtime exploitation of buffer overflow vulnerabilities. The question asks about detecting and preventing exploitation at runtime, which code signing cannot address.
★ When this WOULD be the correct answer
Code signing would be correct in a scenario where the question asks for a control to ensure that only trusted, unmodified software is executed, such as preventing execution of tampered binaries or malware disguised as legitimate applications.
Why candidates choose this
Candidates may confuse code signing with runtime protection mechanisms, thinking that signed code implies safety from exploitation, or they may overestimate the scope of code signing as a security control.
✗Data Execution Prevention (DEP)Wrong answer — click to see why▾
Why this is wrong here
DEP prevents execution of code in non-executable memory regions, but it does not detect or prevent the buffer overflow itself; the overflow can still corrupt memory and bypass DEP if the attacker uses return-oriented programming (ROP).
★ When this WOULD be the correct answer
A question asking which control prevents execution of injected shellcode in a buffer overflow scenario, assuming no ROP or other bypass techniques, would have DEP as the correct answer.
Why candidates choose this
Candidates may confuse runtime exploit prevention with memory protection mechanisms, thinking DEP stops all buffer overflow exploitation when it only blocks code execution from data pages.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.