SSCP Systems and Application Security — 20 Questions

Question 1

A security administrator is configuring Windows Firewall with Advanced Security for a web server. The requirement is to allow inbound HTTPS traffic but block all other inbound traffic. Which of the following rule configurations best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an inbound allow rule for HTTPS and create a block rule for all other ports. The correct configuration to allow only inbound HTTPS traffic is to create an explicit inbound allow rule for HTTPS (TCP port 443) and an explicit inbound block rule for all other ports. This ensures that only HTTPS is permitted, while all other inbound traffic is blocked, adhering to the principle of least privilege. Option A is incorrect because Windows Firewall does not support 'excluding' ports from a block rule; you must use allow rules. Option B is incorrect because setting the default inbound action to block is a global setting that may affect other services, and it is not a specific rule; the question asks for a rule configuration, not a global setting change. Option C is incorrect because it addresses outbound traffic, not inbound.

Answer

Create an inbound block rule for all ports and then exclude HTTPS

Answer

Create an inbound allow rule for HTTPS and set the firewall default action to block

Answer

Create an outbound allow rule for HTTPS only

Question 2

An organization using cloud IAM wants to grant a compute instance permissions to access a cloud storage bucket without storing long-term credentials on the instance. Which IAM feature should be used?

Accepted Answer

IAM role assigned to the compute instance. IAM roles for compute instances allow the instance to assume a role and obtain temporary credentials from a security token service, avoiding the need for long-term keys.

Answer

Service-level access policies

Answer

Long-term user access keys

Answer

Resource-based policies on the storage bucket

Question 3

During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?

Accepted Answer

Disable Telnet and FTP services, and apply all critical security patches.. System hardening involves removing unnecessary services, applying patches, and following benchmarks like CIS or DISA STIGs. Disabling Telnet and FTP and applying all critical patches directly addresses the discovered issues.

Answer

Move the server to a more secure network segment and implement network access controls.

Answer

Enable SELinux and configure a host-based firewall using iptables.

Answer

Install a host-based intrusion detection system (HIDS) to monitor for attacks.

Question 4

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) and AppLocker are used for application whitelisting. WDAC provides more robust control.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 5

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

Accepted Answer

Enable and configure auditd with rules to capture login events. The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.

Answer

Use PAM to log authentication events to /var/log/secure

Answer

Set up SELinux to audit login attempts

Answer

Configure syslog to monitor /var/log/auth.log

Question 6

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 7

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks exploit vulnerabilities in the hypervisor. Keeping the hypervisor patched and disabling unnecessary VM guest tools reduces attack surface.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 8

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. The chmod command changes file permissions. The octal mode 600 sets read/write for owner, no permissions for group and others.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 9

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating user input into SQL queries allows injection attacks. Injection is a top vulnerability.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 10

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 11

A Windows system administrator needs to enforce a security policy that prevents users from installing unauthorized software. Which feature should be configured via Group Policy?

Accepted Answer

AppLocker. AppLocker can be configured via Group Policy to allow or deny applications based on rules, preventing unauthorized software installation.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 12

Which of the following is a primary security concern when using VM snapshots in a virtualized environment?

Accepted Answer

Snapshots may contain unpatched vulnerabilities if not regularly updated. VM snapshots capture the state at a point in time. If the snapshot is not updated with patches, reverting to it can reintroduce vulnerabilities that were previously fixed.

Answer

Snapshots can be used to bypass authentication

Answer

Snapshots can be exported and stolen

Answer

Snapshots consume excessive storage space

Question 13

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls sudo privileges. It can be edited with visudo. A NOPASSWD entry would allow passwordless sudo.

Answer

/etc/shadow

Answer

/etc/group

Answer

/etc/passwd

Question 14

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In PaaS, the provider manages the runtime, middleware, and OS; the customer is responsible for application-level security, including code and data.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 15

A security engineer is hardening a Windows server. Which TWO actions should be taken to reduce the attack surface? (Select TWO.)

Accepted Answer

Disable unnecessary services and accounts. Removing unnecessary accounts and services, and applying patches are core hardening steps. Disabling auto-run prevents malware from executing automatically.

Answer

Increase the number of active user accounts for auditing

Answer

Enable auto-run for removable media to improve user convenience

Answer

Install additional third-party software for monitoring

Question 16

A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Web Application Firewall (WAF). Web Application Firewall (WAF) blocks common attacks like injection and XSS. Input validation prevents injection. Code signing ensures software integrity. Disabling auto-run is unrelated.

Answer

Disable auto-run on user workstations

Answer

Use a host-based intrusion detection system on the database server

Question 17

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that provide MAC. iptables is a firewall, not MAC. PAM is for authentication. auditd is for auditing.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)

Question 18

An organization is hardening a new Windows server for production use. Which of the following is the most effective method to ensure that only approved applications can run?

Accepted Answer

Configure AppLocker or Windows Defender Application Control. AppLocker or Windows Defender Application Control (WDAC) provide application whitelisting, ensuring only approved executables, scripts, and installers run. UAC controls privilege elevation, not execution. Windows Defender Antivirus detects malware but does not enforce whitelisting. BitLocker provides full-disk encryption, not application control.

Answer

Enable BitLocker drive encryption

Answer

Enable User Account Control (UAC)

Answer

Install Windows Defender Antivirus

Question 19

A security analyst is reviewing Linux server logs after a suspected breach. Which auditing tool should be used to examine detailed records of system calls and file access events?

Accepted Answer

auditd. auditd is the Linux audit daemon that logs system calls, file access, and security events. PAM manages authentication, iptables is a firewall, and SELinux enforces MAC policies but does not log all system calls.

Answer

SELinux

Answer

PAM

Answer

iptables

Question 20

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure