exploit mitigations

Reciting the acronyms is the easy part. The scored answer pairs each mitigation with the exploitation step it blocks and the precondition that defeats it, which is why they only work together.

Once data could not run as code, attackers stopped bringing code. The interview checks that you understand code reuse as an idea, and what forward-edge and backward-edge protections each enforce.

W^X says memory is writable or executable, never both. A JIT compiler's whole job is writing code and then running it. How a runtime squares that circle decides how much an attacker gains from a memory bug.