CompTIA CASP+ (CAS-004) — Question 258

A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public facing applications. Which of the following should the company implement on the public-facing servers?

Answer options

• A. WAF
• B. ASLR
• C. NX
• D. HSM

Correct answer: B

Explanation

ASLR (Address Space Layout Randomization) is effective against return-oriented programming as it helps randomize memory addresses, making it difficult for attackers to predict the location of their target code. WAF (Web Application Firewall) primarily protects against web application attacks but does not specifically address memory corruption vulnerabilities like return-oriented programming. NX (No-eXecute) helps prevent execution of code in certain memory regions, but ASLR provides a more comprehensive defense by randomizing addresses. HSM (Hardware Security Module) is not relevant to this type of attack.