SSCP Systems and Application Security — 40 Questions

Question 1

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable and configure auditd with rules to capture login events. auditd is the Linux kernel-level audit subsystem that can capture authentication events — including successful and failed logins — via configurable rules (e.g., watching /var/log/secure, /etc/pam.d, or using the 'loginuid' mechanism). It provides comprehensive, tamper-resistant logging that satisfies the requirement to log all authentication attempts.

Answer

Use PAM to log authentication events to /var/log/secure

Answer

Set up SELinux to audit login attempts

Answer

Configure syslog to monitor /var/log/auth.log

Question 2

Which of the following is a primary security concern when using VM snapshots in a virtualized environment?

Accepted Answer

Snapshots may contain unpatched vulnerabilities if not regularly updated. VM snapshots capture the complete state of a virtual machine—including its disk, memory, and configuration—at a specific point in time. If the guest OS inside the snapshot has not been patched since the snapshot was taken, restoring that snapshot reintroduces all the vulnerabilities that were present at capture time, effectively rolling back security updates. This makes unpatched vulnerabilities the primary security concern, since snapshots can silently undo remediation efforts.

Answer

Snapshots can be used to bypass authentication

Answer

Snapshots can be exported and stolen

Answer

Snapshots consume excessive storage space

Question 3

A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is correct because it inspects HTTP/HTTPS traffic and blocks common OWASP Top 10 attacks such as SQL injection, cross-site scripting (XSS), and command injection at the application layer. Input validation and parameterized queries are correct because they prevent injection flaws (A03:2021-Injection) by ensuring untrusted data is never interpreted as executable SQL or script, which is a core OWASP mitigation. Code signing for application binaries is correct because it ensures integrity and authenticity of deployed code, mitigating OWASP risks like software and data integrity failures (A08:2021) and preventing tampered or malicious binaries from running. Disabling auto-run on user workstations addresses removable-media malware propagation and is not a web application control for OWASP Top 10 web flaws. A host-based IDS on the database server provides detection rather than prevention and does not directly mitigate the OWASP Top 10 web application attack classes.

Answer

Disable auto-run on user workstations

Answer

Use a host-based intrusion detection system on the database server

Question 4

A security engineer is evaluating cloud security tools. Which TWO of the following are primarily used to protect cloud workloads? (Select two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Option B, Cloud Workload Protection Platform (CWPP), is correct because CWPPs are specifically designed to secure running workloads such as VMs, containers, and serverless functions, providing runtime protection, vulnerability management, and behavioral monitoring at the workload level. Option C, Web Application Firewall (WAF), is correct because a WAF protects cloud-hosted web applications and APIs by inspecting HTTP/HTTPS traffic and blocking common attacks like SQL injection and cross-site scripting (XSS), directly shielding the application workload from exploitation. Option A, IAM, is not primarily a workload protection tool; it governs authentication, authorization, and access policies for identities and resources rather than defending the workload itself. Option D, CSPM, focuses on identifying misconfigurations and compliance risks in cloud infrastructure and posture, not on actively protecting running workloads. Option E, SIEM, aggregates and correlates log and event data for detection and response, but it is a monitoring and analytics platform rather than a workload protection mechanism.

Answer

Identity and Access Management (IAM)

Answer

Cloud Security Posture Management (CSPM)

Answer

Security Information and Event Management (SIEM)

Question 5

A security analyst notices that a Linux server has an unusual number of failed login attempts for the root account. To strengthen authentication security while preserving administrative access, which of the following configurations would be most effective?

Accepted Answer

Implement account lockout via PAM module pam_tally2. Implementing account lockout via the PAM module pam_tally2 directly addresses the brute-force pattern observed (repeated failed root logins) by locking the account after a defined threshold of failures, while still allowing legitimate administrative access once unlocked. This is the most effective control because it actively throttles and blocks the attack vector rather than merely hardening files or rotating credentials. It preserves root access for authorized admins, satisfying the 'preserving administrative access' requirement.

Answer

Configure SELinux to enforce mandatory access control on the /etc/shadow file

Answer

Change the root password every 30 days

Answer

Disable root login entirely and require sudo for all administrative tasks

Question 6

A security administrator is configuring Windows Firewall with Advanced Security for a web server. The requirement is to allow inbound HTTPS traffic but block all other inbound traffic. Which of the following rule configurations best meets this requirement?

Accepted Answer

Create an inbound allow rule for HTTPS and create a block rule for all other ports. The correct configuration to allow only inbound HTTPS traffic is to create an explicit inbound allow rule for HTTPS (TCP port 443) and an explicit inbound block rule for all other ports. This ensures that only HTTPS is permitted, while all other inbound traffic is blocked, adhering to the principle of least privilege. Option A is incorrect because Windows Firewall does not support 'excluding' ports from a block rule; you must use allow rules. Option B is incorrect because setting the default inbound action to block is a global setting that may affect other services, and it is not a specific rule; the question asks for a rule configuration, not a global setting change. Option C is incorrect because it addresses outbound traffic, not inbound.

Answer

Create an inbound block rule for all ports and then exclude HTTPS

Answer

Create an inbound allow rule for HTTPS and set the firewall default action to block

Answer

Create an outbound allow rule for HTTPS only

Question 7

A security analyst is reviewing application security and identifies risks related to the OWASP Top 10. Which THREE are examples of OWASP Top 10 vulnerabilities? (Select THREE.)

Accepted Answer

Security Misconfiguration. Security Misconfiguration (A) is a recognized OWASP Top 10 category (A05:2021), covering insecure default settings, verbose errors, and exposed admin interfaces. Injection (B) is OWASP Top 10 A03:2021, encompassing SQL, NoSQL, OS command, and LDAP injection flaws. Cross-Site Scripting (C) is included under OWASP Top 10 A03:2021 Injection, since XSS is a form of untrusted data being interpreted as code in the browser. Man-in-the-Middle (MitM) is a network attack technique rather than an OWASP Top 10 category, and Buffer overflow is a memory-safety flaw typically covered by CWE/SANS or secure coding guidance, not the OWASP Top 10 list.

Answer

Man-in-the-Middle (MitM)

Answer

Buffer overflow

Question 8

A cloud security team is implementing CSPM (Cloud Security Posture Management) for their IaaS environment. Which THREE issues is CSPM MOST likely to detect? (Select THREE.)

Accepted Answer

IAM roles with overly permissive policies. CSPM detects misconfigurations such as open security groups, unencrypted storage, and excessive IAM permissions.

Answer

Outdated OS patches on cloud VMs

Answer

Runtime malware in a virtual machine

Question 9

A security analyst is investigating a potential security incident on a Linux server. The analyst suspects that an attacker has gained root access and installed a rootkit. Which of the following commands would be most effective in detecting the presence of a rootkit by comparing system binaries against known good hashes?

Accepted Answer

rkhunter --check. rkhunter is specifically designed to detect rootkits by comparing the hashes of system binaries against a known good database, among other checks. This makes it the most effective tool for the described scenario. While chkrootkit is also a rootkit detector, it does not emphasize hash comparison as its primary method.

Answer

netstat -tuln

Answer

ps aux

Answer

chkrootkit

Question 10

A security engineer is implementing controls to protect a web application from session hijacking attacks. Which TWO of the following measures are MOST effective in preventing an attacker from stealing or reusing a valid session token? (Choose two.)

Accepted Answer

Implement session token binding to the client's TLS certificate.. The most effective measures to prevent session token theft and reuse are setting Secure and HttpOnly flags on cookies, and binding tokens to the client's TLS certificate. Secure/HttpOnly protects against interception and XSS, while token binding ensures a stolen token cannot be replayed from a different connection. Other options either increase risk or address different attack vectors.

Answer

Store session tokens in local storage instead of cookies.

Answer

Rotate the session token after successful authentication.

Answer

Use a long session timeout to improve user experience.

Question 11

A security analyst is investigating a suspected malware infection on a Windows workstation. The analyst observes that a process named 'svchost.exe' is making outbound connections to an unknown IP address. Which of the following should the analyst do FIRST to determine if this is malicious activity?

Accepted Answer

Examine the parent process and command-line arguments of the svchost.exe instance.. The first step in investigating a suspicious process is to gather information without altering the system. Examining the parent process and command-line arguments can reveal if svchost.exe is legitimate or a masquerading malware. This quick triage helps determine the next steps, such as isolating the system or collecting memory.

Answer

Use Task Manager to end the svchost.exe process immediately to stop the connection.

Answer

Check the digital signature of the svchost.exe process to verify it is signed by Microsoft.

Answer

Run a full antivirus scan to detect and remove the malware.

Question 12

A security engineer is configuring a containerized application in a production Kubernetes cluster. The engineer wants to prevent a compromised container from accessing the host's metadata service to retrieve cloud credentials and from mounting sensitive host paths. Which Kubernetes security control should the engineer implement?

Accepted Answer

Pod security admission with the restricted profile, which disallows hostPath volumes and host network access.. Pod security admission with the restricted profile enforces a hardened pod specification that disallows hostPath volumes, host network, and privileged access. This prevents a compromised container from mounting sensitive host paths and from using host-level networking to reach the metadata service. Network policies, RBAC, and sidecar proxies address other aspects but do not block host path mounts, so they fail the combined requirement.

Answer

Role-based access control (RBAC) that limits the service account to read-only access to secrets.

Answer

A mutating admission controller that injects a sidecar proxy to inspect all outbound traffic.

Answer

Network policies that deny all egress traffic from the application's namespace.

Question 13

A security administrator is implementing application whitelisting on a fleet of Windows 10 workstations. The administrator wants to use AppLocker to allow only signed applications from trusted publishers to run, while blocking all other executables. Which TWO of the following AppLocker rule conditions should the administrator use to achieve this? (Choose two.)

Accepted Answer

Certificate. The administrator needs to allow signed applications from trusted publishers, which requires the Publisher condition to enforce digital signature rules. Additionally, to allow a specific unsigned internal application, the File hash condition is used to identify that exact file by its hash. Together, these conditions meet the requirements while maintaining a whitelist approach.

Answer

File name

Answer

Path

Answer

File hash

Question 14

During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?

Accepted Answer

Disable Telnet and FTP services, and apply all critical security patches.. The most effective hardening approach directly addresses the identified vulnerabilities: disabling insecure services (Telnet and FTP, which transmit credentials in cleartext) and applying critical security patches to close known exploitable flaws. This removes the actual attack vectors rather than merely monitoring or isolating them, aligning with CIS and NIST hardening guidance.

Answer

Move the server to a more secure network segment and implement network access controls.

Answer

Enable SELinux and configure a host-based firewall using iptables.

Answer

Install a host-based intrusion detection system (HIDS) to monitor for attacks.

Question 15

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is Microsoft's application control feature that enforces application whitelisting by allowing only explicitly trusted code to run on Windows workstations. It uses code integrity policies (based on publisher, hash, or path) to block unauthorized executables, scripts, and drivers. WDAC is the modern successor to AppLocker and is built into Windows 10/11 and Windows Server.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 16

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. Patching the guest operating system and web server software is correct because in the IaaS shared responsibility model, the customer controls and is responsible for everything from the guest OS upward — including OS patches, middleware, runtime, and application code. The provider secures the physical hosts, hypervisor, and network fabric beneath the virtualization layer.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 17

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks typically exploit vulnerabilities in the hypervisor itself or in the guest tools (like VMware Tools or VirtualBox Guest Additions) that run with elevated privileges. Applying hypervisor security patches closes known vulnerabilities that could allow a VM to break out, while disabling unnecessary guest tools reduces the attack surface that an attacker could leverage to interact with the hypervisor. Together, these measures directly harden the virtualization layer against escape attempts.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 18

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. chmod 600 file.txt sets permissions so the owner has read and write (6 = rw-), while group and others have no permissions (0 = ---). This matches the requirement that only the owner can read and write and no one else has access. The numeric (octal) mode 600 is the standard way to express owner rw, group none, others none.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 19

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating unsanitized user input directly into an SQL query is the textbook definition of an Injection vulnerability (OWASP A03:2021). The untrusted input is interpreted as SQL code rather than data, allowing an attacker to alter query logic, bypass authentication, or exfiltrate the database. This is the classic SQL injection pattern.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 20

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools continuously scan cloud configurations against security benchmarks (CIS, NIST, PCI-DSS) and detect misconfigurations like publicly accessible storage buckets, overly permissive IAM policies, unencrypted volumes, and disabled logging. A publicly readable S3 bucket is a textbook CSPM finding.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location