CAS-001 · Question #49
A software vendor has had several zero-day attacks against its software, due to previously unknown security defects being exploited by attackers. The attackers have been able to perform operations…
The correct answer is A. Application sandboxing. The attack scenario describes zero-day exploits where attackers run operations at the same trust level as the application - meaning the exploit inherits the application's full privileges. Application sandboxing (A) directly addresses this by isolating the application in a…
Question
A software vendor has had several zero-day attacks against its software, due to previously unknown security defects being exploited by attackers. The attackers have been able to perform operations at the same security level as the trusted application. The vendor product management team has decided to re-design the application with security as a priority. Which of the following is a design principle that should be used to BEST prevent these types of attacks?
Options
- AApplication sandboxing
- BInput validation
- CPenetration testing
- DCode reviews
How the community answered
(22 responses)- A64% (14)
- B18% (4)
- C14% (3)
- D5% (1)
Explanation
The attack scenario describes zero-day exploits where attackers run operations at the same trust level as the application - meaning the exploit inherits the application's full privileges. Application sandboxing (A) directly addresses this by isolating the application in a restricted execution environment, limiting what it can access even if exploited (principle of least privilege at the process level). This is an architectural design principle that contains damage. Input validation (B) helps prevent injection attacks but does not limit what a successful exploit can do. Penetration testing (C) is a detection/assessment activity, not a design principle. Code reviews (D) can find known patterns of defects but are not architectural containment. Sandboxing is the design-level answer to 'what if the app is compromised?'
Topics
Community Discussion
No community discussion yet for this question.