Courseiva
hardMultiple ChoiceObjective-mapped

CISSP Practice Question: A financial services company uses a custom web…

A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:

A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes. B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default. C. Encrypt all serialized objects using AES-256 before sending them to the client. D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?

⚠ Common exam trap

Test-takers frequently choose encryption (Option C) thinking it secures the data in transit, but encryption does not address the deserialization logic flaw—the vulnerability remains after decryption, and the attacker can still trigger RCE if they control the serialized stream.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.

Replacing Java serialization with JSON is the most effective and sustainable remediation because it eliminates the root cause of the vulnerability—insecure deserialization of untrusted data. JSON deserialization does not inherently allow arbitrary code execution, and disabling polymorphic deserialization prevents type‐confusion attacks. A whitelist filter (Option A) is a good mitigation but can be bypassed if incomplete and requires ongoing maintenance. A WAF (Option D) is a compensating control that does not fix the underlying flaw and can often be evaded with obfuscated payloads; it also affects availability and latency. Encryption (Option C) protects confidentiality but does not prevent deserialization attacks, as the data is still insecure after decryption.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.

    Why it's wrong here

    Implementing a custom deserialization filter, such as Java's ObjectInputFilter, can be an effective security control by explicitly whitelisting only the classes permitted for deserialization. However, this approach is complex to maintain and prone to errors; incorrectly configured filters, or a failure to update them when new legitimate classes are introduced, can lead to either denial of service or security bypasses. It requires deep understanding of all serialized objects and their dependencies, making it a high-maintenance solution that can still be vulnerable if not perfectly managed.

  • Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.

    Why this is correct

    Replacing Java's native ObjectInputStream/ObjectOutputStream serialization with a safer, data-centric format like JSON, using a library such as Jackson, fundamentally mitigates deserialization vulnerabilities. JSON serialization typically processes data into simple types (e.g., maps, lists, primitives) rather than directly instantiating arbitrary objects, thereby breaking common gadget chains. Crucially, configuring Jackson to disallow polymorphic deserialization by default prevents attackers from specifying arbitrary object types via @class properties, eliminating a primary vector for remote code execution.

  • Encrypt all serialized objects using AES-256 before sending them to the client.

    Why it's wrong here

    Encrypting serialized objects with AES-256 protects the confidentiality and integrity of the data during transmission, preventing eavesdropping or tampering. However, encryption does not prevent deserialization vulnerabilities; the application must still decrypt the data before it can be deserialized. Once decrypted, any malicious payload embedded within the serialized object will still be processed by the application's deserialization mechanism, allowing the attacker's code to execute as if the data were never encrypted.

  • Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

    Why it's wrong here

    A Web Application Firewall (WAF) provides a valuable layer of perimeter defense by inspecting HTTP traffic and blocking requests that match known attack signatures. While a WAF can mitigate *known* deserialization attacks by filtering specific malicious payloads, it does not address the underlying vulnerability in the application's deserialization logic. It is a reactive, signature-based solution that can be bypassed by novel or obfuscated deserialization gadget chains, leaving the application susceptible to zero-day exploits.

Quick reference

Symmetric Encryption Algorithm Comparison

AlgorithmKey SizeBlock SizeStatusNotes
AES-128128-bit128-bitCurrent standardNIST approved; WPA3, TLS
AES-256256-bit128-bitCurrent standardPreferred for sensitive / govt data
3DES112-bit effective64-bitDeprecated (2023)Replaced by AES
DES56-bit64-bitBrokenCracked in < 24 h; never deploy
ChaCha20256-bitStream cipherCurrentTLS 1.3, WireGuard

About these practice questions

This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.