CEH Vulnerability Analysis and System Hacking Practice Question
Which THREE of the following are common indicators of a buffer overflow vulnerability?
⚠ Common exam trap
Candidates often confuse exploitation techniques (like ROP) with vulnerability indicators, but ROP is a post-exploitation method, not a sign that a buffer overflow exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unexpected program crashes or segmentation faults
A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unexpected program crashes or segmentation faults
Why this is correct
A buffer overflow writes data beyond the intended buffer's boundaries, corrupting adjacent memory. This corruption can overwrite critical program data, function pointers, or the stack frame itself. When the program attempts to access or execute corrupted instructions or data, it leads to an illegal memory access, triggering a segmentation fault or an unexpected program termination.
- ✓
Access violation errors when writing to memory
Why this is correct
Buffer overflows specifically involve writing data past the allocated size of a buffer. When this write operation attempts to access memory pages that are not mapped to the process or are marked as read-only, the operating system's memory management unit detects an unauthorized access attempt. This triggers an access violation error, indicating a critical memory integrity issue.
- ✗
Use of return-oriented programming (ROP)
Why it's wrong here
Return-oriented programming (ROP) is an advanced exploitation technique used *after* a buffer overflow has successfully corrupted the stack, typically to bypass Data Execution Prevention (DEP). ROP involves chaining together small snippets of existing code (gadgets) within the program's memory to achieve arbitrary code execution. Therefore, ROP itself is a *consequence* or *method of exploitation*, not an initial indicator that a buffer overflow *is occurring*.
- ✗
High CPU usage
Why it's wrong here
High CPU usage indicates that a process is consuming significant processing power, which can be caused by numerous factors such as inefficient algorithms, infinite loops, heavy computational tasks, or even other types of malware. While a program might enter an infinite loop or perform excessive computations *after* a buffer overflow has been exploited, high CPU usage is not a direct or specific indicator of the buffer overflow event itself, which primarily involves memory corruption.
- ✓
Overwritten adjacent memory regions
Why this is correct
The fundamental mechanism of a buffer overflow is writing more data into a buffer than it was designed to hold. This excess data spills over into contiguous memory locations immediately following the buffer. This overwriting can corrupt other variables, data structures, or even critical control flow information like return addresses on the stack, directly demonstrating the overflow condition.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.