CISSP Security Architecture and Engineering Practice Question
During a security audit, a vulnerability scanner reports a buffer overflow vulnerability in a legacy application. The application runs on a system with Data Execution Prevention (DEP/NX) enabled and Address Space Layout Randomization (ASLR) active. Which of the following is the most likely impact of these mitigations on a typical stack-based buffer overflow exploit?
⚠ Common exam trap
CISSP often tests whether candidates understand that mitigations like DEP and ASLR raise the difficulty but do not eliminate exploitation — the trap is selecting 'completely prevent.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They make it harder to execute arbitrary code via injected shellcode
DEP/NX marks memory pages as non-executable, so injected shellcode on the stack cannot be executed directly. ASLR randomizes the memory layout, making it difficult for an attacker to reliably jump to existing code (like a ROP gadget or system function). Together they significantly raise the bar for a typical stack-based buffer overflow exploit, though they do not make exploitation impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
They only protect heap-based overflows, not stack-based
Why it's wrong here
Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are designed to protect against memory corruption exploits across various memory regions. DEP specifically marks memory pages, including both the stack and the heap, as non-executable, preventing malicious code from running from these data segments. ASLR randomizes the base addresses of critical program components, such as the stack, heap, and shared libraries, making it difficult to predict their locations regardless of where the overflow occurs.
- ✗
They completely prevent any exploitation of buffer overflows
Why it's wrong here
While Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are powerful mitigations, they do not completely prevent all buffer overflow exploitations. Sophisticated attackers can bypass these protections using techniques like Return-Oriented Programming (ROP), which chains existing legitimate code snippets (gadgets) in memory to achieve arbitrary execution without injecting new code. Additionally, information disclosure vulnerabilities can sometimes be leveraged to defeat ASLR's randomization.
- ✓
They make it harder to execute arbitrary code via injected shellcode
Why this is correct
This statement is correct because Data Execution Prevention (DEP) directly prevents the execution of code from non-executable memory regions, such as the stack and heap, where injected shellcode typically resides. Concurrently, Address Space Layout Randomization (ASLR) randomizes the memory addresses of key program components, making it extremely challenging for an attacker to reliably predict the exact location of their injected shellcode or necessary return addresses. Together, these mechanisms significantly increase the difficulty and complexity of exploiting buffer overflows with injected shellcode.
- ✗
They have no effect on buffer overflow exploits
Why it's wrong here
The assertion that DEP and ASLR have no effect on buffer overflow exploits is incorrect, as they are fundamental operating system-level security mitigations specifically designed to counter such vulnerabilities. Data Execution Prevention (DEP) prevents an attacker from executing malicious code placed in data segments like the stack or heap. Address Space Layout Randomization (ASLR) complicates exploitation by randomizing memory addresses, making it difficult to reliably target specific functions or injected shellcode required for a successful exploit.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.