PEN-200 Buffer Overflow Fundamentals Practice Question
What role does the 'padding' play in a buffer overflow payload structure?
⚠ Common exam trap
Candidates often confuse padding with the shellcode or return address, assuming padding executes code rather than serving purely as filler bytes to align the memory layout correctly for a successful overwrite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It ensures the return address is correctly aligned for overwriting.
Padding is the data placed between the start of the buffer and the return address. Its purpose is to exactly fill the buffer space so that the subsequent bytes in the payload land precisely on the return address. Without correct padding, the return address would be overwritten by the wrong bytes, causing the program to jump to an unintended and invalid location, leading to a crash rather than code execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It acts as a NOP sled for the payload.
Why it's wrong here
Padding is not the same as a NOP sled. While padding fills space, its primary function is structural alignment to reach the return address. A NOP sled is explicitly designed to be executable space, whereas padding can consist of any data as long as it reaches the target return address offset.
- ✗
It prevents the stack from overflowing too quickly.
Why it's wrong here
Padding does not limit or control the stack overflow; it actually contributes to filling the stack buffer. The goal is to overflow the buffer intentionally. Padding is simply the filler data used to reach the specific memory location where the return address is stored, not a protective mechanism for the stack.
- ✓
It ensures the return address is correctly aligned for overwriting.
Why this is correct
Padding is essential to reach the exact offset of the saved return address on the stack. By filling the buffer with the correct amount of data, you ensure that the following bytes in your payload correctly overwrite the return address, allowing you to redirect the CPU execution flow precisely as intended.
- ✗
It is used to encode the shellcode against detection.
Why it's wrong here
Padding is not related to shellcode encoding or evasion. Encoding is performed using tools like msfvenom to obfuscate the shellcode and bypass signature detection. Padding serves a purely functional role in memory layout management, ensuring the exploit reaches the target return address without corrupting other critical data on the stack.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.