hardMultiple SelectObjective-mapped
CISSP Practice Question: Which THREE of the following are valid…
Which THREE of the following are valid countermeasures against buffer overflow attacks?
⚠ Common exam trap
Many candidates confuse general security controls (like input validation or encryption) with specific memory protection mechanisms, leading them to select options that are good practices but not direct countermeasures against buffer overflow attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stack canaries
Stack canaries are correct because they place a known value (canary) between the buffer and control data on the stack. Before a function returns, the canary is checked; if it has been overwritten (indicating a buffer overflow), the program terminates, preventing code execution. This directly detects stack-based buffer overflows before they can hijack the return address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stack canaries
Why this is correct
Stack canaries are a security mechanism that places a small, random value, known as a canary, on the stack between the buffer and critical control data, such as the return address. Before a function returns, the program checks if this canary value has been modified. If the canary has been overwritten, it indicates a buffer overflow has occurred, and the program can then terminate safely to prevent malicious code execution.
- ✗
Full disk encryption
Why it's wrong here
Full disk encryption protects data at rest by encrypting the entire storage device, making data unreadable without the correct decryption key. However, a buffer overflow is a runtime memory corruption vulnerability that occurs within the active memory space (RAM) of a running program. This attack vector operates entirely independently of how data is stored on disk, thus full disk encryption provides no direct protection against manipulating program execution flow in memory.
- ✓
Address space layout randomization (ASLR)
Why this is correct
Address Space Layout Randomization (ASLR) is a memory protection technique that randomly arranges the base addresses of key data regions, such as the stack, heap, and libraries, within a process's virtual memory space. This randomization makes it significantly more challenging for an attacker to predict the exact memory locations of their shellcode or return-oriented programming (ROP) gadgets. By introducing unpredictability, ASLR hinders the reliability and success rate of many buffer overflow exploitation attempts.
- ✓
Non-executable stack and heap (NX bit)
Why this is correct
The Non-Executable (NX) bit, also known as Data Execution Prevention (DEP), is a hardware-enforced security feature that marks certain memory regions, typically the stack and heap, as non-executable. This prevents an attacker from executing malicious code that has been injected into these data segments, even if they successfully manage to overwrite a return address to point to their payload. The NX bit effectively neutralizes common shellcode injection techniques by ensuring that data cannot be treated as executable instructions.
- ✗
Input validation using allowlists
Why it's wrong here
Input validation using allowlists is a critical security practice that ensures only expected and safe data formats or values are processed by an application. While it helps prevent many types of injection attacks and maintains data integrity, it primarily addresses the *content* of the input, not its *size* relative to allocated memory buffers. Therefore, even if input adheres to an allowlist, a buffer overflow can still occur if the program fails to perform proper bounds checking when copying or processing the input, allowing excessive data to overwrite adjacent memory.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.