Mitigation Controls CS0-003 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is rewriting a legacy C application that processes user-supplied data into a fixed-size buffer. The team wants to eliminate the possibility of a buffer overflow that could allow an attacker to overwrite adjacent memory. Which coding practice should be adopted?

   • AUse the gets() function to read input because it automatically adjusts the buffer size to fit the data.
   • BReplace unsafe functions like strcpy() with safer alternatives that accept a maximum length, such as strlcpy() or strncpy(), and add explicit bounds checks before every write.
   • CIncrease the buffer size to a very large value so that an overflow is unlikely to occur.
   • DDisable compiler warnings and rely on the operating system to prevent memory corruption.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which memory region does DEP typically mark as non-executable to prevent overflow-based code execution?

   • AThe page table
   • BThe stack
   • CThe registry
   • DThe code segment
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which mitigation technique is specifically designed to randomize the base addresses of loaded libraries and the stack?

   • AInput validation
   • BDEP
   • CASLR
   • DStack canaries
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary function of Data Execution Prevention (DEP)?

   • ATo randomize memory addresses on each boot
   • BTo mark memory regions as non-executable unless explicitly required
   • CTo encrypt data stored in memory
   • DTo detect and log buffer overflow attempts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing the hardening guidelines for a Windows server that hosts a legacy application written in C. The application has a known buffer overflow vulnerability, but the vendor will not release a patch for several months. Which mitigation control should the analyst enable to reduce the risk of an attacker successfully executing code from the overflow?

   • AEnable Data Execution Prevention (DEP) for the application.
   • BDisable Address Space Layout Randomization (ASLR) to simplify memory management.
   • CRun the application as a domain administrator to ensure it has full access to system resources.
   • DSet the application's stack size to zero to prevent any buffer from being created.
   Reveal Solution Discussion Select an answer first