CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using a privileged account to run the application

  Why it's wrong here

  Using a privileged account to run an application significantly escalates the potential impact of a successful buffer overflow exploit, rather than mitigating it. If an attacker successfully exploits a buffer overflow to achieve arbitrary code execution, the malicious code will inherit the elevated permissions of the privileged account. This allows the attacker to perform system-wide compromises, install rootkits, or access sensitive data that would otherwise be protected.

• ✗

  Disabling stack protection

  Why it's wrong here

  Disabling stack protection removes crucial security mechanisms designed to prevent or detect buffer overflow exploits, thereby increasing vulnerability. Stack protection features, such as non-executable stack bits (part of DEP) or stack canaries, are specifically engineered to make it harder for attackers to inject and execute malicious code or overwrite critical return addresses. Removing these safeguards directly exposes the application to exploitation, making it easier for an attacker to achieve control.

• ✗

  Stack canaries and NOP sleds

  Why it's wrong here

  Stack canaries are a defensive mechanism that places a known value on the stack to detect if a buffer overflow has occurred before a return address can be overwritten, thus preventing exploitation. Conversely, a NOP sled (No Operation sled) is an *exploit technique* used by attackers to increase the reliability of executing injected shellcode by providing a range of 'no operation' instructions that will eventually lead to the malicious payload. Therefore, combining these two concepts as a unified mitigation strategy is contradictory, as one is a defense and the other is an offensive aid.

• ✓

  Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)

  Why this is correct

  Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are fundamental and effective mitigations against buffer overflow vulnerabilities. DEP marks memory regions, such as the stack and heap, as non-executable, preventing an attacker from executing injected shellcode directly from these areas. ASLR randomizes the memory locations of key program components, making it significantly more difficult for an attacker to predict the exact addresses needed to launch successful return-oriented programming (ROP) attacks or jump to injected code.

Go deeper

Related to this question