CAS-002 · Question #201
A system administrator is troubleshooting a possible denial of service on a sensitive system. The system seems to run properly for a few hours after it is restarted, but then it suddenly stops…
The correct answer is A. The system does not implement proper garbage collection. The process log shows memory consumption growing from 20K to 8.0G over several hours, which is a classic indicator of a memory leak caused by improper garbage collection.
Question
A system administrator is troubleshooting a possible denial of service on a sensitive system. The system seems to run properly for a few hours after it is restarted, but then it suddenly stops processing transactions. The system administrator suspects an internal DoS caused by a disgruntled developer who is currently seeking a new job while still working for the company. After looking into various system logs, the system administrator looks at the following output from the main system service responsible for processing incoming transactions. DATE/TIMEPIDCOMMAND%CPUMEM 031020141030002055com.proc10.2920K 031020141100002055com.proc12.35.2M 031020141230002055com.proc22.022M 031020141300002055com.proc33.01.6G 031020141330002055com.proc30.28.0G Which of the following is the MOST likely cause for the DoS?
Options
- AThe system does not implement proper garbage collection.
- BThe system is susceptible to integer overflow.
- CThe system does not implement input validation.
- DThe system does not protect against buffer overflows properly.
How the community answered
(26 responses)- A65% (17)
- B19% (5)
- C4% (1)
- D12% (3)
Why each option
The process log shows memory consumption growing from 20K to 8.0G over several hours, which is a classic indicator of a memory leak caused by improper garbage collection.
The process log shows memory growing continuously from 20K to 8.0G across several hours without ever being released - the hallmark of a memory leak where objects are allocated but never reclaimed. This pattern is directly caused by improper or intentionally disabled garbage collection, which prevents the runtime from freeing unused memory. A disgruntled developer could deliberately introduce this condition to exhaust system resources and eventually crash the service.
Integer overflow produces incorrect arithmetic results or crashes at the point of a specific calculation, not a pattern of continuous memory growth visible over hours of runtime.
Input validation failures typically manifest as injection attacks or data corruption errors at the point of input, not as steadily increasing memory consumption across time.
Buffer overflow attacks corrupt memory or crash a process at the moment of the overflow event, not as a gradual, sustained increase in allocated memory shown in the log.
Concept tested: Memory leak identification via process resource monitoring
Source: https://owasp.org/www-community/vulnerabilities/Memory_leak
Topics
Community Discussion
No community discussion yet for this question.