A penetration tester successfully exploits a buffer overflow vulnerability in a network service and obtains a root shell. During the debrief, the client asks how they can detect this type of exploitation attempt. Which defensive technology is most effective at detecting exploitation of memory corruption vulnerabilities?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because buffer overflow exploitation often produces network-level patterns detectable by IDS signatures, and modern EDR tools with exploit prevention capabilities detect memory-level anomalies such as ROP chains, shellcode execution in non-executable regions (bypassing DEP), and abnormal process behavior post-exploitation. A is wrong because WAFs protect web applications; a network service buffer overflow is a separate attack vector.
Full explanation below image
Full Explanation
B is correct because buffer overflow exploitation often produces network-level patterns detectable by IDS signatures, and modern EDR tools with exploit prevention capabilities detect memory-level anomalies such as ROP chains, shellcode execution in non-executable regions (bypassing DEP), and abnormal process behavior post-exploitation. A is wrong because WAFs protect web applications; a network service buffer overflow is a separate attack vector. C is wrong because vulnerability scanners identify the vulnerability proactively but are not detection tools for active exploitation. D is wrong because successful authentication log analysis detects credential-based attacks; exploit-based root access bypasses normal authentication entirely.