nerdexam
CompTIA

SY0-501 · Question #478

A software developer is concerned about DLL hijacking in an application being written. Which of the following is the MOST viable mitigation measure of this type of attack?

The correct answer is B. All calls to different DLLs should be hard-coded in the application. To mitigate DLL hijacking, applications should explicitly define the full path for all DLL calls, preventing malicious DLLs from being loaded from unintended locations.

Submitted by naveen.iyer· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A software developer is concerned about DLL hijacking in an application being written. Which of the following is the MOST viable mitigation measure of this type of attack?

Options

  • AThe DLL of each application should be set individually
  • BAll calls to different DLLs should be hard-coded in the application
  • CAccess to DLLs from the Windows registry should be disabled
  • DThe affected DLLs should be renamed to avoid future hijacking

How the community answered

(32 responses)
  • A
    13% (4)
  • B
    78% (25)
  • C
    6% (2)
  • D
    3% (1)

Why each option

To mitigate DLL hijacking, applications should explicitly define the full path for all DLL calls, preventing malicious DLLs from being loaded from unintended locations.

AThe DLL of each application should be set individually

The statement 'the DLL of each application should be set individually' is vague and does not describe a concrete technical mitigation for preventing DLL hijacking.

BAll calls to different DLLs should be hard-coded in the applicationCorrect

Hard-coding or explicitly specifying the full path for DLL calls, rather than relying on default search paths, prevents an attacker from inserting a malicious DLL with the same name into a vulnerable search location. This ensures the application always loads the intended, legitimate DLL.

CAccess to DLLs from the Windows registry should be disabled

DLLs are primarily loaded from the file system, not directly accessed from the Windows registry for execution, making disabling registry access an ineffective mitigation for file-system-based DLL hijacking.

DThe affected DLLs should be renamed to avoid future hijacking

Renaming legitimate DLLs would break application functionality unless the application's code is also updated, and it doesn't prevent an attacker from placing a malicious DLL under the original expected name or even the new name if known.

Concept tested: Secure DLL loading practices, preventing DLL hijacking

Source: https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security

Topics

#DLL hijacking#application security#secure coding#Windows security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice