312-50V9 · Question #279
Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention (DEP) error has taken place. Which of the following is most likely taking place?
The correct answer is D. Malicious code is attempting to execute instruction in a non-executable memory region. DEP errors indicate that code attempted to run in a memory region marked as non-executable, which is a common sign of a buffer overflow or code injection attack being blocked by the OS.
Question
Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention (DEP) error has taken place. Which of the following is most likely taking place?
Options
- AA race condition is being exploited, and the operating system is containing the malicious process.
- BA page fault is occurring, which forces the operating system to write data from the hard drive.
- CMalware is executing in either ROM or a cache memory area.
- DMalicious code is attempting to execute instruction in a non-executable memory region.
How the community answered
(27 responses)- A4% (1)
- B4% (1)
- C7% (2)
- D85% (23)
Why each option
DEP errors indicate that code attempted to run in a memory region marked as non-executable, which is a common sign of a buffer overflow or code injection attack being blocked by the OS.
Race conditions involve timing conflicts between concurrent processes and are unrelated to the DEP mechanism, which specifically monitors memory execution permissions.
A page fault occurs when the OS must retrieve memory-mapped data from disk, which is a normal memory management event entirely separate from DEP enforcement.
DEP does not monitor ROM or CPU cache; it enforces execute permissions on virtual memory pages allocated in RAM.
Data Execution Prevention is a hardware and software security feature that marks memory regions such as the stack and heap as non-executable. When malicious code - such as shellcode injected via a buffer overflow - attempts to execute instructions from one of these protected regions, the OS raises a DEP violation and terminates the offending process.
Concept tested: Data Execution Prevention memory protection
Source: https://learn.microsoft.com/en-us/windows/win32/memory/data-execution-prevention
Topics
Community Discussion
No community discussion yet for this question.