CAS-005 · Question #488
A security analyst discovers a compromised internal server and finds that the attack vector was an application. When extracting a memory dump with the application process content, the analyst…
The correct answer is A. Implement address space layout randomization and canary stacks. The memory dump shows repeated /x90 (NOP sled), which is indicative of a buffer overflow exploit. Implementing address space layout randomization (ASLR) and stack canaries is the best defense, as they prevent attackers from reliably predicting memory addresses and detecting…
Question
A security analyst discovers a compromised internal server and finds that the attack vector was an application. When extracting a memory dump with the application process content, the analyst observes the following:
Which of the following solutions should the analyst recommend to best address this issue and avoid reoccurrence?
Options
- AImplement address space layout randomization and canary stacks.
- BReduce the buffer size to allow for less stored data.
- CImprove character filtering and input validation for user inputs.
- DAllow only the use of digitally signed and validated libraries.
How the community answered
(46 responses)- A78% (36)
- B7% (3)
- C4% (2)
- D11% (5)
Explanation
The memory dump shows repeated /x90 (NOP sled), which is indicative of a buffer overflow exploit. Implementing address space layout randomization (ASLR) and stack canaries is the best defense, as they prevent attackers from reliably predicting memory addresses and detecting stack-based buffer overflows, thereby mitigating this type of attack.
Community Discussion
No community discussion yet for this question.