SSCP Systems and Application Security — 15 Questions

Question 1

During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?

Accepted Answer

Disable Telnet and FTP services, and apply all critical security patches.. System hardening involves removing unnecessary services, applying patches, and following benchmarks like CIS or DISA STIGs. Disabling Telnet and FTP and applying all critical patches directly addresses the discovered issues.

Answer

Move the server to a more secure network segment and implement network access controls.

Answer

Enable SELinux and configure a host-based firewall using iptables.

Answer

Install a host-based intrusion detection system (HIDS) to monitor for attacks.

Question 2

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) and AppLocker are used for application whitelisting. WDAC provides more robust control.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 3

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

Accepted Answer

Enable and configure auditd with rules to capture login events. The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.

Answer

Use PAM to log authentication events to /var/log/secure

Answer

Set up SELinux to audit login attempts

Answer

Configure syslog to monitor /var/log/auth.log

Question 4

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 5

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks exploit vulnerabilities in the hypervisor. Keeping the hypervisor patched and disabling unnecessary VM guest tools reduces attack surface.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 6

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. The chmod command changes file permissions. The octal mode 600 sets read/write for owner, no permissions for group and others.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 7

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating user input into SQL queries allows injection attacks. Injection is a top vulnerability.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 8

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 9

A Windows system administrator needs to enforce a security policy that prevents users from installing unauthorized software. Which feature should be configured via Group Policy?

Accepted Answer

AppLocker. AppLocker can be configured via Group Policy to allow or deny applications based on rules, preventing unauthorized software installation.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 10

Which of the following is a primary security concern when using VM snapshots in a virtualized environment?

Accepted Answer

Snapshots may contain unpatched vulnerabilities if not regularly updated. VM snapshots capture the state at a point in time. If the snapshot is not updated with patches, reverting to it can reintroduce vulnerabilities that were previously fixed.

Answer

Snapshots can be used to bypass authentication

Answer

Snapshots can be exported and stolen

Answer

Snapshots consume excessive storage space

Question 11

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls sudo privileges. It can be edited with visudo. A NOPASSWD entry would allow passwordless sudo.

Answer

/etc/shadow

Answer

/etc/group

Answer

/etc/passwd

Question 12

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In PaaS, the provider manages the runtime, middleware, and OS; the customer is responsible for application-level security, including code and data.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 13

A security engineer is hardening a Windows server. Which TWO actions should be taken to reduce the attack surface? (Select TWO.)

Accepted Answer

Disable unnecessary services and accounts. Removing unnecessary accounts and services, and applying patches are core hardening steps. Disabling auto-run prevents malware from executing automatically.

Answer

Increase the number of active user accounts for auditing

Answer

Enable auto-run for removable media to improve user convenience

Answer

Install additional third-party software for monitoring

Question 14

A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Web Application Firewall (WAF). Web Application Firewall (WAF) blocks common attacks like injection and XSS. Input validation prevents injection. Code signing ensures software integrity. Disabling auto-run is unrelated.

Answer

Disable auto-run on user workstations

Answer

Use a host-based intrusion detection system on the database server

Question 15

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that provide MAC. iptables is a firewall, not MAC. PAM is for authentication. auditd is for auditing.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)