SSCP Systems and Application Security Practice Test 2 — 15 Questions

Question 1

A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Web Application Firewall (WAF). Web Application Firewall (WAF) blocks common attacks like injection and XSS. Input validation prevents injection. Code signing ensures software integrity. Disabling auto-run is unrelated.

Answer

Disable auto-run on user workstations

Answer

Use a host-based intrusion detection system on the database server

Question 2

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that provide MAC. iptables is a firewall, not MAC. PAM is for authentication. auditd is for auditing.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)

Question 3

An organization is hardening a new Windows server for production use. Which of the following is the most effective method to ensure that only approved applications can run?

Accepted Answer

Configure AppLocker or Windows Defender Application Control. AppLocker or Windows Defender Application Control (WDAC) provide application whitelisting, ensuring only approved executables, scripts, and installers run. UAC controls privilege elevation, not execution. Windows Defender Antivirus detects malware but does not enforce whitelisting. BitLocker provides full-disk encryption, not application control.

Answer

Enable BitLocker drive encryption

Answer

Enable User Account Control (UAC)

Answer

Install Windows Defender Antivirus

Question 4

A security analyst is reviewing Linux server logs after a suspected breach. Which auditing tool should be used to examine detailed records of system calls and file access events?

Accepted Answer

auditd. auditd is the Linux audit daemon that logs system calls, file access, and security events. PAM manages authentication, iptables is a firewall, and SELinux enforces MAC policies but does not log all system calls.

Answer

SELinux

Answer

PAM

Answer

iptables

Question 5

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 6

To prevent VM escape attacks in a virtualized environment, which of the following is the most critical security measure?

Accepted Answer

Apply the latest patches to the hypervisor. VM escape exploits vulnerabilities in the hypervisor to break isolation. Regularly patching the hypervisor addresses known vulnerabilities. Disabling guest tools reduces attack surface but may impact functionality. VLAN segmentation and snapshots do not prevent escape.

Answer

Disable unnecessary VM guest tools

Answer

Use VLAN segmentation for VM networks

Answer

Use snapshots for quick recovery

Question 7

An administrator wants to ensure that a Linux web server only allows the www-data user to run specific commands with elevated privileges. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. sudoers file controls which users can run commands with sudo and limits commands. PAM handles authentication, not command authorization. SELinux policies control MAC, not sudo. chmod sets file permissions but does not grant specific command execution.

Answer

/etc/pam.d/

Answer

/etc/chmod.conf

Answer

/etc/selinux/config

Question 8

Which of the following OWASP Top 10 vulnerabilities involves an attacker sending malicious data to an interpreter as part of a command or query?

Accepted Answer

Injection. Injection attacks, such as SQL injection, occur when untrusted data is sent to an interpreter. Broken Authentication refers to flaws in auth mechanisms. XSS injects scripts into web pages. Security misconfiguration involves improper setup.

Answer

Security Misconfiguration

Answer

Broken Authentication

Answer

Cross-Site Scripting (XSS)

Question 9

A cloud security team wants to continuously monitor for misconfigured cloud resources that could expose data. Which tool category is specifically designed for this purpose?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM (Cloud Security Posture Management) tools detect misconfigurations like open storage buckets or overly permissive IAM roles. CWPP focuses on runtime workload protection. WAF protects web apps. IAM manages identities, not configuration monitoring.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Identity and Access Management (IAM)

Answer

Web Application Firewall (WAF)

Question 10

An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?

Accepted Answer

Securing the application code from SQL injection. In PaaS, the provider manages the platform (OS, runtime), and the customer is responsible for the application code and data. Patching the runtime is the provider's duty. Database backup may be partially shared, but application code security is always the customer's.

Answer

Physical security of the data center

Answer

Patching the web server runtime

Answer

Patching the underlying operating system

Question 11

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy enforces security settings across Active Directory domain-joined systems. Local Security Policy only affects the local machine. UAC controls elevation. Security Audit Policies are part of Group Policy but not the overarching feature.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)

Question 12

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 13

During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper access control checks. Injection involves sending malicious data. Broken Authentication relates to authentication flaws. Security Misconfiguration involves improper setup.

Answer

Broken Authentication

Answer

Security Misconfiguration

Answer

Injection

Question 14

A Linux system administrator needs to restrict network traffic to a server, allowing only HTTP and HTTPS from the internet. Which tool should be used to configure packet filtering rules?

Accepted Answer

iptables. iptables or nftables are Linux firewall tools for packet filtering. PAM handles authentication. SELinux enforces MAC. auditd logs events. They do not filter network traffic.

Answer

PAM

Answer

SELinux

Answer

auditd

Question 15

An organization is implementing system hardening. Which of the following actions are recommended by CIS Benchmarks? (Select all that apply.)

Accepted Answer

Remove unnecessary services and accounts. CIS Benchmarks recommend removing unnecessary services and accounts (A) to reduce attack surface, disabling autorun and autoplay features (C) to prevent unauthorized code execution, and enabling User Account Control (UAC) (D) to enforce least privilege. These are all common system hardening recommendations.

Answer

Enable DHCP for all network interfaces

Answer

Disable the host-based firewall