CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  An attacker exploits a weak cryptographic algorithm

  Why it's wrong here

  Exploiting a weak cryptographic algorithm involves breaking the mathematical security of an encryption scheme, such as using a known vulnerability in DES or MD5 to decrypt data or forge signatures. This attack focuses on the computational complexity of the algorithm itself, rather than a timing window between system operations. Therefore, it is fundamentally different from a Time of Check to Time of Use (TOCTOU) race condition, which exploits a temporal gap in a multi-step process.

• ✓

  An attacker modifies the file after the permission check but before the open operation

  Why this is correct

  This scenario precisely describes a Time of Check to Time of Use (TOCTOU) vulnerability, where a system first checks a resource's state, such as file permissions, and then later uses that resource, like opening the file. An attacker exploits the brief interval between these two operations to maliciously alter the file, for instance, by replacing a legitimate file with a symlink to a sensitive system file. This allows the attacker to bypass the initial security check and gain unauthorized access or control over the system's subsequent actions.

• ✗

  An attacker performs a buffer overflow to gain elevated privileges

  Why it's wrong here

  A buffer overflow attack occurs when a program attempts to write more data into a fixed-size memory buffer than it was designed to hold, overwriting adjacent memory locations. This can lead to overwriting critical program data, return addresses, or function pointers, potentially allowing an attacker to inject and execute arbitrary code with the privileges of the vulnerable process. This is a memory corruption vulnerability, distinct from TOCTOU, which is a race condition exploiting a timing window in sequential operations.

• ✗

  An attacker intercepts the network traffic to steal credentials

  Why it's wrong here

  Intercepting network traffic to steal credentials, often referred to as a Man-in-the-Middle (MITM) attack, involves an attacker positioning themselves between two communicating parties to eavesdrop, alter, or inject data. The attacker typically spoofs identities or redirects traffic to capture sensitive information like usernames and passwords as they traverse the network. This is a network-level attack focused on communication integrity and confidentiality, entirely separate from a TOCTOU race condition that exploits a timing flaw within a single system's sequential operations.

Go deeper

Related to this question