SSCP Systems and Application Security Practice Test 2 — 15 Questions

Question 1

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. Patching the guest operating system and web server software is correct because in the IaaS shared responsibility model, the customer controls and is responsible for everything from the guest OS upward — including OS patches, middleware, runtime, and application code. The provider secures the physical hosts, hypervisor, and network fabric beneath the virtualization layer.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 2

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks typically exploit vulnerabilities in the hypervisor itself or in the guest tools (like VMware Tools or VirtualBox Guest Additions) that run with elevated privileges. Applying hypervisor security patches closes known vulnerabilities that could allow a VM to break out, while disabling unnecessary guest tools reduces the attack surface that an attacker could leverage to interact with the hypervisor. Together, these measures directly harden the virtualization layer against escape attempts.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 3

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. chmod 600 file.txt sets permissions so the owner has read and write (6 = rw-), while group and others have no permissions (0 = ---). This matches the requirement that only the owner can read and write and no one else has access. The numeric (octal) mode 600 is the standard way to express owner rw, group none, others none.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 4

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating unsanitized user input directly into an SQL query is the textbook definition of an Injection vulnerability (OWASP A03:2021). The untrusted input is interpreted as SQL code rather than data, allowing an attacker to alter query logic, bypass authentication, or exfiltrate the database. This is the classic SQL injection pattern.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 5

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools continuously scan cloud configurations against security benchmarks (CIS, NIST, PCI-DSS) and detect misconfigurations like publicly accessible storage buckets, overly permissive IAM policies, unencrypted volumes, and disabled logging. A publicly readable S3 bucket is a textbook CSPM finding.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 6

A Windows system administrator needs to enforce a security policy that prevents users from installing unauthorized software. Which feature should be configured via Group Policy?

Accepted Answer

AppLocker. AppLocker is a Windows application control feature configured via Group Policy that lets administrators allow or deny which applications and files users can run, directly preventing installation and execution of unauthorized software. It uses rules based on publisher, path, or file hash. This is the correct tool for enforcing an application allowlist/denylist through GPO.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 7

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the primary configuration file for the sudo command, defining which users or groups can run which commands on which hosts, and whether a password is required. A user with NOPASSWD: ALL in this file can execute any command as root without a password. Therefore, reviewing /etc/sudoers is the correct action to verify the auditor's finding.

Answer

/etc/shadow

Answer

/etc/group

Answer

/etc/passwd

Question 8

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure (network, OS, hypervisor, runtime), while the customer is responsible for the security of their application code and data. Securing application code against SQL injection is therefore the customer's responsibility. The other options are provider-managed in PaaS.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 9

A security engineer is hardening a Windows server. Which TWO actions should be taken to reduce the attack surface? (Select TWO.)

Accepted Answer

Disable unnecessary services and accounts. Option C is correct because disabling unnecessary services and accounts directly shrinks the attack surface by removing exploitable entry points, listening ports, and credentials that attackers could abuse for privilege escalation or lateral movement. Option D is correct because applying the latest security patches remediates known vulnerabilities (e.g., remote code execution flaws) that malware and threat actors actively exploit, which is a foundational hardening step. Option A is wrong because creating more active user accounts expands the attack surface and increases credential-management risk rather than reducing it. Option B is wrong because enabling AutoRun for removable media facilitates malware propagation via USB drives and should typically be disabled. Option E is wrong because installing additional third-party software adds new code, services, and potential vulnerabilities, enlarging rather than reducing the attack surface.

Answer

Increase the number of active user accounts for auditing

Answer

Enable auto-run for removable media to improve user convenience

Answer

Install additional third-party software for monitoring

Question 10

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux (A) is correct because it is a Linux kernel security module that enforces mandatory access control by applying type enforcement, role-based access control, and multi-level security policies that confine processes and users regardless of their discretionary permissions. AppArmor (C) is also correct because it implements MAC through per-program profiles that restrict an application's file, network, and capability access using path-based rules loaded into the kernel. iptables (B) is incorrect because it is a packet-filtering firewall tool for network traffic, not a MAC framework for constraining process privileges. auditd (D) is incorrect because it is the Linux auditing daemon that logs security-relevant events, providing accountability rather than access enforcement. PAM (E) is incorrect because it is an authentication framework that handles login and credential checks, not a mandatory access control mechanism.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)

Question 11

An organization is hardening a new Windows server for production use. Which of the following is the most effective method to ensure that only approved applications can run?

Accepted Answer

Configure AppLocker or Windows Defender Application Control. AppLocker and Windows Defender Application Control (WDAC) are the native Windows mechanisms that enforce application allowlisting by permitting only approved executables, scripts, and installers to run. They operate via policy at the kernel/OS level and are the correct control for restricting execution to approved software. This directly satisfies the requirement that only approved applications can run.

Answer

Enable BitLocker drive encryption

Answer

Enable User Account Control (UAC)

Answer

Install Windows Defender Antivirus

Question 12

A security analyst is reviewing Linux server logs after a suspected breach. Which auditing tool should be used to examine detailed records of system calls and file access events?

Accepted Answer

auditd. auditd is the Linux userspace auditing daemon that works with the kernel audit subsystem to record system calls, file access, authentication events, and other security-relevant activity. It writes detailed records to /var/log/audit/audit.log and can be queried with ausearch and aureport, making it the correct tool for examining system call and file access events after a suspected breach.

Answer

SELinux

Answer

PAM

Answer

iptables

Question 13

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In the IaaS shared responsibility model, the customer is responsible for securing the guest operating system, including patching, because the cloud provider manages the hypervisor and physical infrastructure. The customer controls the OS and applications running on the IaaS instances.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 14

To prevent VM escape attacks in a virtualized environment, which of the following is the most critical security measure?

Accepted Answer

Apply the latest patches to the hypervisor. The hypervisor is the software layer that creates and runs virtual machines, and it is the primary target for VM escape attacks because it sits between the guest VMs and the host hardware. A vulnerability in the hypervisor (e.g., in its emulation of devices or in its memory management) can allow a guest VM to break out and execute code on the host. Applying the latest patches to the hypervisor directly addresses these vulnerabilities, making it the most critical measure to prevent VM escape. Without patching, other measures like network segmentation or disabling guest tools do not fix the underlying exploitable flaw.

Answer

Disable unnecessary VM guest tools

Answer

Use VLAN segmentation for VM networks

Answer

Use snapshots for quick recovery

Question 15

An administrator wants to ensure that a Linux web server only allows the www-data user to run specific commands with elevated privileges. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file defines which users or groups may run which commands with elevated privileges via sudo. To allow www-data to run specific commands as root, you add entries there (typically using visudo). This enforces least privilege by limiting the commands the web user can execute with sudo.

Answer

/etc/pam.d/

Answer

/etc/chmod.conf

Answer

/etc/selinux/config