CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Data Execution Prevention (DEP)

  Why it's wrong here

  Data Execution Prevention (DEP) is a security feature that marks memory pages as non-executable, preventing malicious code from running in data-only memory regions. Its primary purpose is to mitigate buffer overflow attacks and other exploits that attempt to inject and execute arbitrary code. DEP does not address side-channel attacks, which exploit information leakage through indirect means like timing or power consumption, rather than direct code execution or memory corruption.

• ✗

  Address Space Layout Randomization (ASLR)

  Why it's wrong here

  Address Space Layout Randomization (ASLR) is a memory-protection technique that randomly arranges the positions of key data areas, such as the base of the executable and the positions of the stack, heap, and libraries, in a process's address space. This randomization makes it significantly more difficult for an attacker to predict target addresses for memory corruption exploits like return-to-libc attacks. ASLR does not prevent side-channel attacks, which rely on observing system behavior (e.g., timing, power) rather than knowing specific memory layouts.

• ✗

  Input validation

  Why it's wrong here

  Input validation is a fundamental security practice that ensures data received from external sources conforms to expected formats, types, and ranges before being processed by an application. It primarily prevents injection attacks, such as SQL injection, cross-site scripting (XSS), and command injection, by sanitizing or rejecting malformed input. While crucial for overall security, input validation does not directly mitigate side-channel attacks, which exploit information leakage during legitimate processing rather than through malicious input content.

• ✓

  Constant-time algorithms

  Why this is correct

  Constant-time algorithms are specifically designed to execute in a predictable amount of time, regardless of the secret data being processed or the input values. By eliminating data-dependent branches, memory access patterns, or loop iterations, these algorithms prevent timing variations that could otherwise be observed by an attacker to infer sensitive information, such as cryptographic keys. This approach directly counters timing side-channel attacks by removing the observable timing differences.

• ✓

  Noise injection in power consumption

  Why this is correct

  Noise injection in power consumption involves deliberately introducing random fluctuations or "noise" into a device's power draw during sensitive operations. This technique aims to obscure the subtle power variations that correlate with data processing, which are typically exploited by power analysis side-channel attacks to extract cryptographic keys or other secrets. By masking these data-dependent power signatures, it becomes significantly harder for an attacker to perform successful differential or simple power analysis.

Go deeper

Related to this question