nerdexam
CompTIA

SY0-301 · Question #140

Sara, an application developer, implemented error and exception handling alongside input validation. Which of the following does this help prevent?

The correct answer is A. Buffer overflow. Input validation combined with error and exception handling are the primary defenses against buffer overflow attacks, which occur when unchecked input exceeds allocated memory boundaries. These coding practices enforce bounds checking and prevent memory corruption exploits.

Threats, vulnerabilities, and mitigations

Question

Sara, an application developer, implemented error and exception handling alongside input validation. Which of the following does this help prevent?

Options

  • ABuffer overflow
  • BPop-up blockers
  • CCross-site scripting
  • DFuzzing

How the community answered

(35 responses)
  • A
    77% (27)
  • B
    3% (1)
  • C
    14% (5)
  • D
    6% (2)

Why each option

Input validation combined with error and exception handling are the primary defenses against buffer overflow attacks, which occur when unchecked input exceeds allocated memory boundaries. These coding practices enforce bounds checking and prevent memory corruption exploits.

ABuffer overflowCorrect

Buffer overflows occur when an application writes more data to a buffer than it can hold because input size is not validated, allowing an attacker to overwrite adjacent memory and potentially execute arbitrary code. Input validation enforces length and type constraints on all incoming data, while proper error and exception handling ensures that out-of-bounds conditions are caught and handled gracefully rather than allowing memory corruption to propagate.

BPop-up blockers

Pop-up blockers are a browser-level feature that suppresses unwanted browser windows and are entirely unrelated to server-side or application-level coding practices like input validation and exception handling.

CCross-site scripting

Cross-site scripting (XSS) is primarily prevented through output encoding and content security policies - while input validation helps reduce attack surface, XSS is an output-context vulnerability distinct from the memory-safety issue of buffer overflows.

DFuzzing

Fuzzing is a security testing technique used to discover vulnerabilities by feeding random input to an application - it is a testing methodology that developers use, not something that error handling and input validation prevent.

Concept tested: Input validation and exception handling preventing buffer overflows

Source: https://owasp.org/www-community/vulnerabilities/Buffer_Overflow

Topics

#buffer overflow#input validation#error handling#secure coding

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice