CISSP Security Architecture and Engineering Practice Question
A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ASLR
ASLR (Address Space Layout Randomization) randomizes the base addresses of stack, heap, and libraries, making it difficult for an attacker to guess memory addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ASLR
Why this is correct
ASLR (Address Space Layout Randomization) is a memory protection technique that randomly arranges the positions of key data areas, such as the base of the executable, the stack, heap, and libraries, within a process's virtual address space. This randomization makes it significantly more difficult for an attacker to predict target addresses for return-oriented programming (ROP) attacks or to reliably locate malicious code or useful gadgets. By introducing unpredictability, ASLR effectively mitigates the success rate of many memory corruption exploits that rely on known memory layouts.
- ✗
SafeSEH
Why it's wrong here
SafeSEH (Safe Structured Exception Handling) is a compiler and linker feature designed to protect against exploits that overwrite Structured Exception Handler (SEH) records on the stack. It works by creating a list of valid exception handlers during compilation, which the operating system then validates against when an exception occurs. If an attempt is made to invoke an exception handler not on the approved list, the program terminates, preventing an attacker from redirecting execution flow via a corrupted SEH chain. This mechanism focuses on the integrity of exception handling, not the randomization of memory addresses.
- ✗
Stack canaries
Why it's wrong here
Stack canaries are a buffer overflow protection mechanism where a small, secret value (the "canary") is placed on the stack between local variables and control data, such as the return address. Before a function returns, the program checks if this canary value has been altered. If the canary has been overwritten, it indicates a buffer overflow has occurred, and the program is typically terminated to prevent potential exploitation. While effective at detecting stack-based overflows, this technique focuses on integrity checking rather than randomizing memory locations.
- ✗
DEP/NX bit
Why it's wrong here
Data Execution Prevention (DEP), often implemented via the NX (No-Execute) bit, is a system-level memory protection feature that marks certain memory regions as non-executable. Its primary purpose is to prevent an attacker from executing code from data segments of memory, such as the stack or heap, which are typically only intended to store data. If an attempt is made to execute code from a DEP-protected region, the system generates an exception, effectively thwarting many buffer overflow and code injection attacks. However, DEP does not randomize memory addresses; it only enforces execution permissions.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.