CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enabling ASLR

  Why it's wrong here

  Enabling Address Space Layout Randomization (ASLR) is a memory protection technique that randomizes the memory locations of an executable's code and data segments. This randomization makes it significantly more difficult for attackers to reliably predict memory addresses for exploit development, primarily mitigating memory corruption vulnerabilities like buffer overflows and use-after-free bugs. However, ASLR does not address logical timing issues or concurrent access problems inherent to race conditions, which stem from unsynchronized access to shared resources rather than predictable memory layouts.

• ✗

  Input validation

  Why it's wrong here

  Input validation is a fundamental security control that ensures data received from users or external systems conforms to expected formats, types, and ranges before processing. Its primary purpose is to prevent various injection attacks, such as SQL injection, cross-site scripting (XSS), and command injection, by sanitizing or rejecting malicious input. While crucial for overall application robustness and security, input validation does not inherently prevent race conditions, which arise from the timing of concurrent operations on shared resources rather than the content or maliciousness of the input itself.

• ✓

  Implementing file locking

  Why this is correct

  Implementing file locking is an effective mechanism to prevent race conditions when multiple processes or threads attempt to access and modify the same file concurrently. A file lock ensures that only one process can hold the lock and access the critical section of code involving file operations at any given time. This serialization of access prevents inconsistent states or data corruption that could occur if operations like reading, modifying, and writing were interleaved unpredictably by competing processes, thereby maintaining data integrity.

• ✗

  Using prepared statements

  Why it's wrong here

  Using prepared statements is a database security feature specifically designed to prevent SQL injection attacks. It works by separating the SQL query structure from the user-supplied data, ensuring that user input is always treated as literal data values and cannot be interpreted as executable SQL code. While highly effective against injection vulnerabilities, prepared statements do not provide synchronization mechanisms for concurrent database operations and therefore offer no protection against race conditions, which stem from unsynchronized access to shared data rather than malicious input.

• ✓

  Use of atomic transactions

  Why this is correct

  The use of atomic transactions is a robust method to prevent race conditions in database operations or other multi-step processes. An atomic transaction ensures that a series of operations is treated as a single, indivisible unit: either all operations within the transaction succeed and are committed, or none of them do, and the entire transaction is rolled back. This "all or nothing" property, combined with isolation levels, prevents intermediate, inconsistent states from being visible to other concurrent transactions, thereby eliminating race conditions that could lead to data corruption or logical errors.

Go deeper

Related to this question