312-39 practice question 2 of 35

Wesley is an incident handler in a company named Maddison Tech. One day, he was learning techniques for eradicating the insecure deserialization attacks. What among the following should Wesley avoid from considering?

Full set: 100 questions

Answer options

A: Deserialization of trusted data must cross a trust boundary

B: Understand the security permissions given to serialization and deserialization

C: Allow serialization for security-sensitive classes Correct answer

D: Validate untrusted input, which is to be serialized to ensure that serialized data contain only trusted classes

Correct Answer:

C. Allow serialization for security-sensitive classes

Explanation

To eradicate insecure deserialization vulnerabilities, security best practices focus on distrusting and validating serialized data. Allowing the serialization of security-sensitive classes is a dangerous practice that should be avoided. If an object containing sensitive information (e.g., user credentials, session state, authorization tokens) is serialized, that data can be exposed, captured, or manipulated by an attacker. This directly contradicts the principle of least privilege and secure data handling, creating a significant security risk. Therefore, Wesley should avoid this practice.

Why Incorrect

A. Considering data that crosses a trust boundary as untrusted and requiring validation before deserialization is a fundamental security principle that should be followed.
B. Understanding and limiting the permissions of the code performing deserialization is a crucial mitigation technique to reduce the potential impact of an exploit.
D. Validating untrusted input to ensure it only contains expected and safe classes before deserialization is a primary defense mechanism against these attacks.

References

1. OWASP Foundation. (n.d.). Deserialization Cheat Sheet. OWASP Cheat Sheet Series. Retrieved from owasp.org. The cheat sheet explicitly advises against serializing sensitive data and recommends strict type constraints during deserialization. Section "Guidance for developers" states to avoid deserializing data from untrusted sources and to validate data rigorously.

2. Man, C., & Papamanthou, C. (2019). Mitigating Insecure Deserialization. University of Maryland. This academic paper discusses mitigation strategies, emphasizing input validation and restricting the types of objects that can be deserialized, which aligns with options A, B, and D being correct practices.

Question breakdown

Tests: Eradicating insecure deserialization vulnerabilities
Difficulty: Medium

Key idea: Defending against insecure deserialization means limiting what can be serialized and deserialized, so security-sensitive classes should never be serializable.

How to reach the answer

The question asks which practice Wesley should avoid, so look for the option that weakens security.
Allowing serialization of security-sensitive classes exposes their internal state to tampering and leakage.
Validating untrusted input and understanding serialization permissions are standard recommended controls.
Option A is phrased awkwardly, but it reflects the trust-boundary guidance in EC-Council's material, so C is the answer to avoid.

Each option

AIncorrect. This trust-boundary consideration appears in EC-Council's list of recommended practices, so it is not the one to avoid.
BIncorrect. Understanding the security permissions granted to serialization and deserialization is a recommended control.
CCorrect. Allowing security-sensitive classes to be serialized is a bad practice, because it lets attackers read or manipulate sensitive object state.
DIncorrect. Validating input to ensure serialized data contains only trusted classes is a recommended defense.

Common trap: The odd wording of option A ('trusted data must cross a trust boundary') looks wrong, which can pull candidates away from the clearly insecure option C.

In practice: In Java and .NET applications, teams mark sensitive classes non-serializable and use allow-lists of classes during deserialization. These controls block gadget-chain remote code execution.

Remember: Never allow security-sensitive classes to be serialized, and restrict deserialization to allow-listed trusted classes.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test