CISSP Security Architecture and Engineering Practice Question
A software vulnerability allows an attacker to overwrite a return address on the stack to execute arbitrary code. What mitigation technique randomizes the memory layout to prevent the attacker from predicting target addresses?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ASLR (Address Space Layout Randomization)
ASLR (Address Space Layout Randomization) randomizes the base addresses of executable regions, making it harder to exploit buffer overflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ASLR (Address Space Layout Randomization)
Why this is correct
ASLR (Address Space Layout Randomization) actively randomizes the base memory addresses of key program components like the executable, libraries, stack, and heap each time a program loads. This randomization makes it significantly more challenging for an attacker to reliably predict the exact memory locations of critical data or functions they intend to overwrite or jump to. By introducing unpredictability into the memory layout, ASLR directly hinders exploits that rely on fixed or predictable memory addresses.
- ✗
Stack canary
Why it's wrong here
A stack canary is a secret, randomly generated value placed on the stack between local variables and the return address. Its primary function is to detect buffer overflows by verifying its integrity before a function returns. If the canary value has been altered, indicating a buffer overflow, the program can terminate safely, preventing the attacker from hijacking control flow, though it doesn't prevent the initial overwrite attempt itself.
- ✗
Data Execution Prevention (DEP)
Why it's wrong here
Data Execution Prevention (DEP) is a system-level security feature that marks memory pages as either executable or non-executable. Its core purpose is to prevent the execution of code from data-only memory regions, such as the stack or heap, thereby thwarting common buffer overflow attacks that inject and execute shellcode. While DEP effectively stops code execution from these areas, it does not randomize memory addresses or prevent an attacker from overwriting data values.
- ✗
NX bit (No-Execute)
Why it's wrong here
The No-Execute (NX) bit is a hardware-based CPU feature that enables the operating system to designate memory pages as non-executable. This hardware-enforced distinction prevents the processor from executing any instructions located in data segments, such as those used for the stack or heap. The NX bit is fundamental to DEP's functionality, directly preventing the execution of malicious code injected into data buffers, but it does not offer protection against address prediction or data corruption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.