SSCP Practice Test 19 — 15 Questions

Question 1

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable and configure auditd with rules to capture login events. The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.

Answer

Use PAM to log authentication events to /var/log/secure

Answer

Set up SELinux to audit login attempts

Answer

Configure syslog to monitor /var/log/auth.log

Question 2

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Accepted Answer

SQL injection. Injection flaws occur when untrusted data is sent to an interpreter. SQL, OS command, and LDAP injection are classic examples.

Answer

Broken authentication

Answer

Cross-Site Scripting (XSS)

Question 3

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that provide MAC. iptables is a firewall, not MAC. PAM is for authentication. auditd is for auditing.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)

Question 4

During a code review, a developer identifies that a web application directly concatenates user input into SQL queries without sanitization. This vulnerability is classified under which OWASP Top 10 category?

Accepted Answer

Injection. SQL injection occurs when untrusted data is sent to an interpreter as part of a command. It is a classic injection flaw, which is the top category in OWASP.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 5

A Windows system administrator needs to enforce a security policy that prevents users from installing unauthorized software. Which feature should be configured via Group Policy?

Accepted Answer

AppLocker. AppLocker can be configured via Group Policy to allow or deny applications based on rules, preventing unauthorized software installation.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 6

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) and AppLocker are used for application whitelisting. WDAC provides more robust control.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 7

During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper access control checks. Injection involves sending malicious data. Broken Authentication relates to authentication flaws. Security Misconfiguration involves improper setup.

Answer

Broken Authentication

Answer

Security Misconfiguration

Answer

Injection

Question 8

A security analyst is reviewing OWASP Top 10 vulnerabilities in a web application. Which TWO are injection-related attacks? (Select TWO.)

Accepted Answer

Cross-Site Scripting (XSS). SQL injection is a classic injection; Cross-Site Scripting (XSS) is also a form of injection (script injection).

Answer

Security Misconfiguration

Answer

Cross-Site Request Forgery (CSRF)

Answer

Insecure Direct Object References (IDOR)

Question 9

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating user input into SQL queries allows injection attacks. Injection is a top vulnerability.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 10

Which Windows feature provides mandatory integrity controls and helps prevent unauthorized changes to system settings by requiring administrator approval?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) prompts for consent or credentials before allowing actions that require administrative privileges, helping to prevent unauthorized changes.

Answer

Windows Defender Application Control

Answer

Security Audit Policy

Answer

Group Policy

Question 11

A security analyst notices that a Linux server has an unusual number of failed login attempts for the root account. To strengthen authentication security while preserving administrative access, which of the following configurations would be most effective?

Accepted Answer

Implement account lockout via PAM module pam_tally2. PAM (Pluggable Authentication Modules) can enforce account lockout after a number of failed attempts. This mitigates brute-force attacks while allowing legitimate administrators to unlock accounts if needed.

Answer

Configure SELinux to enforce mandatory access control on the /etc/shadow file

Answer

Change the root password every 30 days

Answer

Disable root login entirely and require sudo for all administrative tasks

Question 12

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker provides application whitelisting capabilities in Windows, allowing administrators to control which applications can run based on rules.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 13

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy enforces security settings across Active Directory domain-joined systems. Local Security Policy only affects the local machine. UAC controls elevation. Security Audit Policies are part of Group Policy but not the overarching feature.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)

Question 14

An administrator wants to ensure that a Linux web server only allows the www-data user to run specific commands with elevated privileges. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. sudoers file controls which users can run commands with sudo and limits commands. PAM handles authentication, not command authorization. SELinux policies control MAC, not sudo. chmod sets file permissions but does not grant specific command execution.

Answer

/etc/pam.d/

Answer

/etc/chmod.conf

Answer

/etc/selinux/config

Question 15

Refer to the exhibit. A network engineer is configuring a site-to-site VPN. The remote peer is using AES-256 encryption and SHA-1 for integrity. Which configuration parameter is likely misconfigured?

Accepted Answer

Group 5. The remote peer is using AES-256 encryption and SHA-1 for integrity, which are both supported in an IPsec transform-set. However, the exhibit shows that the local peer is configured with Group 5 (Diffie-Hellman 1536-bit), while the remote peer likely expects a different DH group (e.g., Group 2 or Group 14). DH group mismatch during Phase 1 (IKE) negotiation causes the VPN tunnel to fail, even if encryption and integrity algorithms match.

Answer

Transform-set

Answer

Pre-shared key

Answer

IKE lifetime