nerdexam
CompTIA

CAS-002 · Question #861

A security administrator is assessing a new application. The application uses an API that is supposed to encrypt text strings that are stored in memory. How might the administrator test that the…

The correct answer is D. Initiate a core dump of the application. A core dump captures a snapshot of the application's memory space, enabling direct inspection of stored data to verify whether strings are encrypted or in plaintext.

Research and Analysis

Question

A security administrator is assessing a new application. The application uses an API that is supposed to encrypt text strings that are stored in memory. How might the administrator test that the strings are indeed encrypted in memory?

Options

  • AUse fuzzing techniques to examine application inputs
  • BRun nmap to attach to application memory
  • CUse a packet analyzer to inspect the strings
  • DInitiate a core dump of the application
  • EUse an HTTP interceptor to capture the text strings

How the community answered

(50 responses)
  • A
    14% (7)
  • B
    6% (3)
  • C
    20% (10)
  • D
    58% (29)
  • E
    2% (1)

Why each option

A core dump captures a snapshot of the application's memory space, enabling direct inspection of stored data to verify whether strings are encrypted or in plaintext.

AUse fuzzing techniques to examine application inputs

Fuzzing submits malformed or random inputs to test for crashes and unexpected behavior, not to inspect the contents of memory at runtime.

BRun nmap to attach to application memory

nmap is a network discovery and port scanning tool and has no capability to attach to or read application process memory.

CUse a packet analyzer to inspect the strings

A packet analyzer captures data traveling over the network interface and cannot access strings that are stored within the memory space of a local process.

DInitiate a core dump of the applicationCorrect

Initiating a core dump forces the operating system to write the full contents of the process's memory - including all heap and stack allocations - to a file for offline analysis. A security administrator can then read that file to determine whether the API is storing sensitive text strings as ciphertext or as readable plaintext, directly validating the encryption claim without needing network access or input manipulation.

EUse an HTTP interceptor to capture the text strings

An HTTP interceptor captures HTTP request and response traffic between a client and server in transit and cannot inspect in-memory variables held within the application process.

Concept tested: Core dump analysis for in-memory data security testing

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#memory forensics#core dump#encryption validation#application security testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice