Implementing privilege escalation and using buffer overflow exploits are examples of administrative controls used to secure computer systems.

• A. True
• B. False
• C. They are defensive but not control measures
• D. Only in hardware security

Answer: (B)

Privilege escalation and buffer overflow exploits are attacker techniques, not protective controls. Administrative controls are policy- and process-based measures that manage security—things like access control policies, how users are provisioned and terminated, separation of duties, security training, incident response planning, and audit trails. Since these examples describe methods an attacker uses to compromise a system, they don’t qualify as administrative controls.

That said, strong administrative controls can help prevent or mitigate such attacks when paired with solid technical controls. Enforcing least privilege reduces the potential impact of escalation, while secure coding practices, input validation, and memory-safe languages lessen buffer overflow risks. Regular patching and vulnerability management address underlying flaws. But the actions themselves—exploiting privileges or overflowing memory—are not administrative controls.