Security Architecture and Engineering →mediumMultiple Choice

CISSP Security Architecture and Engineering Practice Question

An organization is evaluating a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in a file access routine. The routine checks if a user has permission to open a file, then later opens the file. Which of the following best describes the potential exploitation?

⚠ Common exam trap

CISSP often tests whether candidates can distinguish TOCTOU (a race condition) from other vulnerability classes like buffer overflow or crypto weakness — the key is the timing gap between check and use.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An attacker modifies the file after the permission check but before the open operation

TOCTOU is a race condition where the state checked (permission) can change between the check and the use (open). An attacker swaps or modifies the file — often via a symlink — after the permission check passes but before the open executes, causing the program to operate on a different resource than the one authorized.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
An attacker exploits a weak cryptographic algorithm
Why it's wrong here
Exploiting a weak cryptographic algorithm involves breaking the mathematical security of an encryption scheme, such as using a known vulnerability in DES or MD5 to decrypt data or forge signatures. This attack focuses on the computational complexity of the algorithm itself, rather than a timing window between system operations. Therefore, it is fundamentally different from a Time of Check to Time of Use (TOCTOU) race condition, which exploits a temporal gap in a multi-step process.
✓
An attacker modifies the file after the permission check but before the open operation
Why this is correct
This scenario precisely describes a Time of Check to Time of Use (TOCTOU) vulnerability, where a system first checks a resource's state, such as file permissions, and then later uses that resource, like opening the file. An attacker exploits the brief interval between these two operations to maliciously alter the file, for instance, by replacing a legitimate file with a symlink to a sensitive system file. This allows the attacker to bypass the initial security check and gain unauthorized access or control over the system's subsequent actions.
✗
An attacker performs a buffer overflow to gain elevated privileges
Why it's wrong here
A buffer overflow attack occurs when a program attempts to write more data into a fixed-size memory buffer than it was designed to hold, overwriting adjacent memory locations. This can lead to overwriting critical program data, return addresses, or function pointers, potentially allowing an attacker to inject and execute arbitrary code with the privileges of the vulnerable process. This is a memory corruption vulnerability, distinct from TOCTOU, which is a race condition exploiting a timing window in sequential operations.
✗
An attacker intercepts the network traffic to steal credentials
Why it's wrong here
Intercepting network traffic to steal credentials, often referred to as a Man-in-the-Middle (MITM) attack, involves an attacker positioning themselves between two communicating parties to eavesdrop, alter, or inject data. The attacker typically spoofs identities or redirects traffic to capture sensitive information like usernames and passwords as they traverse the network. This is a network-level attack focused on communication integrity and confidentiality, entirely separate from a TOCTOU race condition that exploits a timing flaw within a single system's sequential operations.

Go deeper

CISSP Security Architecture and Engineering Practice Question

Why each option matters

Option-by-option breakdown

Related to this question