ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
You are hardening a 64-bit Windows production server that hosts a monitoring agent written in C++. To mitigate buffer-overflow exploits that attempt to inject shell-code onto the stack or heap, you need a runtime control that marks non-code memory pages as non-executable while still permitting properly flagged JIT-generated code to run. Which protection mechanism should you enable system-wide?
Apply code obfuscation techniques to the monitoring agent binaries
Recompile the application with stack canaries (e.g., compiler /GS option) enabled
Enable system-wide Address Space Layout Randomization (ASLR)
Enable hardware-enforced Data Execution Prevention (DEP) for all processes using the OptOut policy
Hardware-enforced Data Execution Prevention (DEP) is Microsoft's implementation of dynamic execution prevention. DEP uses the CPU's NX/XD bit to label memory pages as non-executable unless they are explicitly allocated with execute permissions (for example, by trusted JIT compilers). This blocks injected shell-code from running even if an attacker can place it in memory. Compiler stack canaries only detect stack-based buffer overflows at function epilogues but do not stop code execution from other data pages. Address Space Layout Randomization merely makes addresses unpredictable; it does not mark pages non-executable. Code obfuscation complicates reverse engineering but provides no runtime enforcement against arbitrary code execution. Therefore, enabling system-wide hardware DEP in OptOut mode is the appropriate choice.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Data Execution Prevention (DEP) and how does it work?
Open an interactive chat with Bash
What is the difference between DEP and ASLR?
Open an interactive chat with Bash
What is the role of a JIT compiler in DEP environments?
Open an interactive chat with Bash
What does hardware-enforced Data Execution Prevention (DEP) do?
Open an interactive chat with Bash
What is the OptOut policy in DEP?
Open an interactive chat with Bash
How does DEP differ from Address Space Layout Randomization (ASLR)?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)