PEN-200 Buffer Overflow Fundamentals Practice Question
You are exploiting a 32-bit Linux buffer overflow and have overwritten EIP with the address of a `JMP ESP` instruction located in a non-ASLR module. However, when you run the exploit, the program crashes with a segmentation fault, and no shell is obtained. You verify that the offset is correct and the JMP ESP address is accurate. What is the most likely reason for the failure?
⚠ Common exam trap
The trap here is focusing on payload corruption instead of considering memory protection mechanisms like NX, which prevent execution even with a correct control-flow hijack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The stack is not executable, so the shellcode placed on the stack cannot run.
The most likely reason is that the stack is non-executable (NX enabled). Even with a correct JMP ESP and offset, the CPU cannot execute shellcode on the stack, leading to a segmentation fault. This is a common obstacle on modern Linux systems. The other options are ruled out because the scenario confirms the offset and JMP ESP address are correct, and bad characters would not prevent the JMP ESP from executing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The shellcode contains bad characters that were not filtered, causing it to be truncated.
Why it's wrong here
Bad characters in shellcode can corrupt the payload, but if the shellcode were truncated, the JMP ESP would still execute, and the CPU would attempt to run the corrupted shellcode. The result might be a crash, but the scenario emphasizes that the JMP ESP address is accurate and offset is correct; the most likely cause is NX, not bad characters. Bad characters would typically be identified during testing.
- ✗
The JMP ESP instruction address contains a null byte, which terminates the string copy.
Why it's wrong here
A null byte in the JMP ESP address would prevent the address from being written correctly, likely causing EIP to be overwritten with a truncated value. However, the scenario states that the JMP ESP address is accurate and the offset is correct, so null bytes are not the issue. The crash is due to execution failure, not address corruption.
- ✗
The offset to EIP was miscalculated, so the return address is overwritten with an incorrect value.
Why it's wrong here
The scenario explicitly states that the offset is correct, so this cannot be the cause. If the offset were wrong, the JMP ESP address would not be placed at the return address, and EIP would not be controlled. Since the JMP ESP address is accurate, the offset must be correct. The failure is due to non-executable stack.
- ✓
The stack is not executable, so the shellcode placed on the stack cannot run.
Why this is correct
Modern Linux systems often have the NX (No-eXecute) bit enabled, marking the stack as non-executable. Even if EIP is redirected to JMP ESP, the jump lands on the stack where shellcode resides, but the CPU refuses to execute it due to NX. This results in a segmentation fault. To bypass NX, you would need to use return-oriented programming (ROP) or another technique to mark the stack executable or call mprotect.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.