GAQM Exam CPEH-001 Topic 5 Question 84 Discussion

Actual exam question for GAQM's CPEH-001 exam

Question #: 84
Topic #: 5

StackGuard (as used by Immunix), ssp/ProPolice (as used by OpenBSD), and Microsoft's /GS option use _____ defense against buffer overflow attacks.

ACanary

BHex editing

CFormat checking

DNon-executing stack

Show Suggested Answer

Suggested Answer: A

Canaries or canary words are known values that are placed between a buffer and control data on the stack to monitor buffer overflows. When the buffer overflows, it will clobber the canary, making the overflow evident. This is a reference to the historic practice of using canaries in coal mines, since they would be affected by toxic gases earlier than the miners, thus providing a biological warning system.

by Kayleigh at Apr 12, 2024, 10:55 PM

Limited Time Offer

25%

Off

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Solange

10 days ago

Hold up, I think I've got it. What if it's a trick question, and the real answer is D? I mean, the non-executing stack is a pretty fundamental defense against buffer overflows, right? Hmm, this is getting tricky.

upvoted 0 times

...

Joseph

12 days ago

Alright, let's think this through. StackGuard, ProPolice, and /GS – they all use the same underlying defense, and that's the canary. I mean, it's right there in the question. A all the way, no need to overthink it.

upvoted 0 times

...

Kimbery

13 days ago

You know, I'm kind of torn on this one. The canary seems like the obvious answer, but I've heard about those non-executable stacks too. Maybe that's the trick they're going for here? Guess I'll have to weigh the options carefully.

upvoted 0 times

...

Pearlene

14 days ago

Hah! Hex editing? Really? As if anyone would try to defend against buffer overflows with that. No, this is clearly a question about modern, sophisticated techniques. Gotta be the canary, no doubt about it.

upvoted 0 times

...

Carline

16 days ago

Hmm, I'm not so sure. Canary sounds like the right answer, but I can't help but wonder if there's a trick here. What if they're trying to throw us off with something like format checking? Gotta keep my wits about me for this one.

upvoted 0 times

...

Yaeko

18 days ago

Ah, the age-old buffer overflow attack. This question is really testing our knowledge of defensive techniques against this menace. I'm guessing the answer is A, Canary. Those little sentinels are the backbone of these anti-buffer overflow measures.

upvoted 0 times

...