- A
Stack canaries
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
- B
Transport Layer Security (TLS)
Why wrong: Incorrect. TLS encrypts network traffic but does not protect against vulnerabilities in the application code itself, such as buffer overflows. It cannot prevent the exploitation of memory corruption bugs.
- C
Code signing
Why wrong: Incorrect. Code signing verifies that the software has not been tampered with and identifies the publisher. It does not provide runtime protection against memory corruption exploits in the running application.
- D
Data Execution Prevention (DEP)
Why wrong: Incorrect. DEP makes memory regions non-executable, which can prevent direct execution of injected shellcode. However, sophisticated attackers can bypass DEP using return-oriented programming (ROP). Stack canaries are generally more effective for detecting the overflow itself, even when DEP is present.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: stack canaries are random values placed on the stack to detect buffer overflows.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Stack canaries
Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.
Key principle: Stack canaries are random values placed on the stack to detect buffer overflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stack canaries
Why this is correct
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
Related concept
Stack canaries are random values placed on the stack to detect buffer overflows.
- ✗
Transport Layer Security (TLS)
Why it's wrong here
Incorrect. TLS encrypts network traffic but does not protect against vulnerabilities in the application code itself, such as buffer overflows. It cannot prevent the exploitation of memory corruption bugs.
When this WOULD be correct
A question asking which control protects data confidentiality during transmission between a client and server, especially over an untrusted network.
- ✗
Code signing
Why it's wrong here
Incorrect. Code signing verifies that the software has not been tampered with and identifies the publisher. It does not provide runtime protection against memory corruption exploits in the running application.
When this WOULD be correct
Code signing would be correct in a scenario where the question asks for a control to ensure that only trusted, unmodified software is executed, such as preventing execution of tampered binaries or malware disguised as legitimate applications.
- ✗
Data Execution Prevention (DEP)
Why it's wrong here
Incorrect. DEP makes memory regions non-executable, which can prevent direct execution of injected shellcode. However, sophisticated attackers can bypass DEP using return-oriented programming (ROP). Stack canaries are generally more effective for detecting the overflow itself, even when DEP is present.
When this WOULD be correct
A question asking which control prevents execution of injected shellcode in a buffer overflow scenario, assuming no ROP or other bypass techniques, would have DEP as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Stack canariesCorrect answer▾
Why this is correct
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
✗Transport Layer Security (TLS)Wrong answer — click to see why▾
Why this is wrong here
TLS encrypts network traffic but does not prevent buffer overflow exploitation; the vulnerability is in the application code, not in transit.
★ When this WOULD be the correct answer
A question asking which control protects data confidentiality during transmission between a client and server, especially over an untrusted network.
Why candidates choose this
Candidates may think TLS provides runtime protection against all attacks or confuse network security controls with application-level exploit mitigations.
✗Code signingWrong answer — click to see why▾
Why this is wrong here
Code signing verifies the integrity and origin of executable code, but it does not detect or prevent runtime exploitation of buffer overflow vulnerabilities. The question asks about detecting and preventing exploitation at runtime, which code signing cannot address.
★ When this WOULD be the correct answer
Code signing would be correct in a scenario where the question asks for a control to ensure that only trusted, unmodified software is executed, such as preventing execution of tampered binaries or malware disguised as legitimate applications.
Why candidates choose this
Candidates may confuse code signing with runtime protection mechanisms, thinking that signed code implies safety from exploitation, or they may overestimate the scope of code signing as a security control.
✗Data Execution Prevention (DEP)Wrong answer — click to see why▾
Why this is wrong here
DEP prevents execution of code in non-executable memory regions, but it does not detect or prevent the buffer overflow itself; the overflow can still corrupt memory and bypass DEP if the attacker uses return-oriented programming (ROP).
★ When this WOULD be the correct answer
A question asking which control prevents execution of injected shellcode in a buffer overflow scenario, assuming no ROP or other bypass techniques, would have DEP as the correct answer.
Why candidates choose this
Candidates may confuse runtime exploit prevention with memory protection mechanisms, thinking DEP stops all buffer overflow exploitation when it only blocks code execution from data pages.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse runtime exploit mitigation (stack canaries) with network security controls (TLS) or software supply chain controls (code signing), leading them to pick a control that does not operate at the memory level during execution.
Detailed technical explanation
How to think about this question
Stack canaries are typically implemented by inserting a random value (e.g., from /dev/urandom) between local variables and the saved return address on the stack. In GCC, the -fstack-protector flag enables this; the canary is checked against a global copy before the function epilogue. A real-world example is the Microsoft EMET tool, which used stack canaries to mitigate exploits like those targeting the MS08-067 vulnerability.
KKey Concepts to Remember
- Stack canaries are random values placed on the stack to detect buffer overflows.
- They are positioned between local variables and the return address.
- If a canary is overwritten, the program terminates, preventing control-flow hijacking.
- Stack canaries are a runtime defense against stack-based buffer overflows.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Stack canaries are random values placed on the stack to detect buffer overflows.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Got this wrong? Here's your next step.
Review stack canaries are random values placed on the stack to detect buffer overflows., then practise related SY0-701 questions on the same topic to reinforce the concept.
- →
Threats, Vulnerabilities, and Mitigations — study guide chapter
Learn the concepts, then practise the questions
- →
Threats, Vulnerabilities, and Mitigations practice questions
Targeted practice on this topic area only
- →
All SY0-701 questions
1,152 questions across all exam domains
- →
Security+ SY0-701 study guide
Full concept coverage aligned to exam objectives
- →
SY0-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SY0-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
General Security Concepts practice questions
Practise SY0-701 questions linked to General Security Concepts.
Threats, Vulnerabilities, and Mitigations practice questions
Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.
Security Architecture practice questions
Practise SY0-701 questions linked to Security Architecture.
Security Operations practice questions
Practise SY0-701 questions linked to Security Operations.
Security Program Management and Oversight practice questions
Practise SY0-701 questions linked to Security Program Management and Oversight.
Security+ social engineering questions
Practise SY0-701 questions linked to Security+ social engineering questions.
Security+ cryptography practice questions
Practise SY0-701 questions linked to Security+ cryptography.
Security+ IAM questions
Practise SY0-701 questions linked to Security+ IAM questions.
Security+ risk management questions
Practise SY0-701 questions linked to Security+ risk management questions.
Security+ incident response questions
Practise SY0-701 questions linked to Security+ incident response questions.
Security+ malware questions
Practise SY0-701 questions linked to Security+ malware questions.
Security+ vulnerability management questions
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practice this exam
Start a free SY0-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SY0-701 question test?
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Stack canaries are random values placed on the stack to detect buffer overflows..
What is the correct answer to this question?
The correct answer is: Stack canaries — Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.
What should I do if I get this SY0-701 question wrong?
Review stack canaries are random values placed on the stack to detect buffer overflows., then practise related SY0-701 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Stack canaries are random values placed on the stack to detect buffer overflows.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More SY0-701 practice questions
- An HR analyst must send a salary file to an external auditor. The auditor only needs names, departments, and salary tota…
- An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically s…
- An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and lega…
- An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domai…
- An investigator needs to make a forensic image of a suspect laptop without changing the original drive contents. Which t…
- An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employe…
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.