hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial services company uses a custom web…
A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:
A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes. B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default. C. Encrypt all serialized objects using AES-256 before sending them to the client. D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.
The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?
⚠ Common exam trap
Test-takers frequently choose encryption (Option C) thinking it secures the data in transit, but encryption does not address the deserialization logic flaw—the vulnerability remains after decryption, and the attacker can still trigger RCE if they control the serialized stream.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
Replacing Java serialization with JSON is the most effective and sustainable remediation because it eliminates the root cause of the vulnerability—insecure deserialization of untrusted data. JSON deserialization does not inherently allow arbitrary code execution, and disabling polymorphic deserialization prevents type‐confusion attacks. A whitelist filter (Option A) is a good mitigation but can be bypassed if incomplete and requires ongoing maintenance. A WAF (Option D) is a compensating control that does not fix the underlying flaw and can often be evaded with obfuscated payloads; it also affects availability and latency. Encryption (Option C) protects confidentiality but does not prevent deserialization attacks, as the data is still insecure after decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.
Why it's wrong here
Implementing a custom deserialization filter, such as Java's ObjectInputFilter, can be an effective security control by explicitly whitelisting only the classes permitted for deserialization. However, this approach is complex to maintain and prone to errors; incorrectly configured filters, or a failure to update them when new legitimate classes are introduced, can lead to either denial of service or security bypasses. It requires deep understanding of all serialized objects and their dependencies, making it a high-maintenance solution that can still be vulnerable if not perfectly managed.
- ✓
Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
Why this is correct
Replacing Java's native ObjectInputStream/ObjectOutputStream serialization with a safer, data-centric format like JSON, using a library such as Jackson, fundamentally mitigates deserialization vulnerabilities. JSON serialization typically processes data into simple types (e.g., maps, lists, primitives) rather than directly instantiating arbitrary objects, thereby breaking common gadget chains. Crucially, configuring Jackson to disallow polymorphic deserialization by default prevents attackers from specifying arbitrary object types via @class properties, eliminating a primary vector for remote code execution.
- ✗
Encrypt all serialized objects using AES-256 before sending them to the client.
Why it's wrong here
Encrypting serialized objects with AES-256 protects the confidentiality and integrity of the data during transmission, preventing eavesdropping or tampering. However, encryption does not prevent deserialization vulnerabilities; the application must still decrypt the data before it can be deserialized. Once decrypted, any malicious payload embedded within the serialized object will still be processed by the application's deserialization mechanism, allowing the attacker's code to execute as if the data were never encrypted.
- ✗
Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.
Why it's wrong here
A Web Application Firewall (WAF) provides a valuable layer of perimeter defense by inspecting HTTP traffic and blocking requests that match known attack signatures. While a WAF can mitigate *known* deserialization attacks by filtering specific malicious payloads, it does not address the underlying vulnerability in the application's deserialization logic. It is a reactive, signature-based solution that can be bypassed by novel or obfuscated deserialization gadget chains, leaving the application susceptible to zero-day exploits.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.