SSCP Systems and Application Security Practice Test 3 — 15 Questions

Question 1

Which of the following OWASP Top 10 vulnerabilities involves an attacker sending malicious data to an interpreter as part of a command or query?

Accepted Answer

Injection. Injection is the OWASP Top 10 category that directly involves an attacker sending malicious data to an interpreter as part of a command or query. This occurs when untrusted data is concatenated into a command or query without proper validation or parameterization, allowing the attacker to alter the intended execution. Examples include SQL injection, OS command injection, and LDAP injection, where the interpreter executes the attacker's injected commands. The core reasoning is that the vulnerability arises from the lack of separation between data and code, enabling the attacker to control the interpreter's behavior.

Answer

Security Misconfiguration

Answer

Broken Authentication

Answer

Cross-Site Scripting (XSS)

Question 2

A cloud security team wants to continuously monitor for misconfigured cloud resources that could expose data. Which tool category is specifically designed for this purpose?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM (Cloud Security Posture Management) tools detect misconfigurations like open storage buckets or overly permissive IAM roles. CWPP focuses on runtime workload protection. WAF protects web apps. IAM manages identities, not configuration monitoring.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Identity and Access Management (IAM)

Answer

Web Application Firewall (WAF)

Question 3

An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?

Accepted Answer

Securing the application code from SQL injection. Under the shared responsibility model for PaaS, the cloud provider manages the physical infrastructure, the operating system, and the runtime environment, while the customer is responsible for the security of the application code and data they deploy. Securing application code against SQL injection is therefore the customer's responsibility because it involves how the application is written and how it handles input.

Answer

Physical security of the data center

Answer

Patching the web server runtime

Answer

Patching the underlying operating system

Question 4

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy is the correct answer because it is a centralized management feature in Windows Active Directory that allows administrators to define and enforce security policies—such as password complexity, account lockout thresholds, and audit settings—across multiple systems in a domain. Group Policy Objects (GPOs) are linked to sites, domains, or organizational units (OUs) and are applied to computers and users at logon or startup, ensuring consistent policy enforcement. This centralized approach is essential for enterprise environments where local settings would be impractical to manage individually.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)

Question 5

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 6

During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object Reference (IDOR) occurs when an application exposes an internal object identifier (like a user ID in a URL) and fails to verify that the requesting user is authorized to access that object. Changing /profile?id=123 to another ID to view another user's profile is the classic IDOR pattern. It falls under OWASP's Broken Access Control category (A01:2021).

Answer

Broken Authentication

Answer

Security Misconfiguration

Answer

Injection

Question 7

A Linux system administrator needs to restrict network traffic to a server, allowing only HTTP and HTTPS from the internet. Which tool should be used to configure packet filtering rules?

Accepted Answer

iptables. iptables is the standard Linux user-space utility for configuring the kernel's Netfilter packet filtering rules, including allowing only HTTP (TCP 80) and HTTPS (TCP 443) from the internet. It operates at the network layer and is the correct tool for host-based firewall configuration on Linux.

Answer

PAM

Answer

SELinux

Answer

auditd

Question 8

An organization is implementing system hardening. Which of the following actions are recommended by CIS Benchmarks? (Select all that apply.)

Accepted Answer

Remove unnecessary services and accounts. Option A is correct because CIS Benchmarks emphasize reducing the attack surface by removing or disabling unnecessary services, applications, and accounts that are not required for the system's role. Option C is correct because CIS Benchmarks recommend disabling autorun and autoplay to prevent automatic execution of potentially malicious code from removable media and network drives. Option D is correct because enabling User Account Control (UAC) ensures administrative actions require explicit elevation and helps enforce least privilege on Windows systems. Option B is incorrect because CIS Benchmarks generally recommend static IP configuration or controlled network settings for servers rather than enabling DHCP on all interfaces, which can introduce unauthorized or unpredictable network configuration. Option E is incorrect because CIS Benchmarks recommend enabling and properly configuring host-based firewalls, not disabling them, to filter inbound and outbound traffic.

Answer

Enable DHCP for all network interfaces

Answer

Disable the host-based firewall

Question 9

During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)

Accepted Answer

Snapshots may contain unpatched vulnerabilities. Option A is correct because a snapshot captures the VM's disk state at a point in time, including the guest OS and installed applications; if that state predates patching, restoring or mounting the snapshot reintroduces unpatched vulnerabilities into the environment. Option B is correct because snapshots preserve the full contents of the virtual disks (and often memory state), so credentials, keys, and other sensitive data that were later deleted or rotated can persist inside snapshot files such as .vmdk delta disks or .avhd files. Option D is correct because rolling back to a snapshot reverts the entire VM state, including security settings, firewall rules, group policies, and patch levels, potentially undoing hardening or remediation performed after the snapshot was taken. Option C is not a snapshot-specific risk; VM sprawl refers to the uncontrolled proliferation of VMs, not snapshot files, and is a lifecycle/governance issue rather than an inherent snapshot risk. Option E is not correct because VM escape exploits hypervisor or virtualization-layer vulnerabilities, not snapshots themselves; snapshots are a data-exposure and rollback concern, not a mechanism for escaping the VM boundary.

Answer

Snapshots cause VM sprawl

Answer

Snapshots can be used as an attack vector for VM escape

Question 10

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. The best action is to remove Telnet and use SSH instead because Telnet transmits data, including credentials, in cleartext, making it inherently insecure. SSH provides encrypted communication, eliminating the vulnerability. Removing the service also reduces the attack surface.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 11

An organization is implementing Windows Defender Application Control (WDAC) to prevent unauthorized applications from running on company workstations. Which of the following best describes the primary security benefit of this approach?

Accepted Answer

It prevents execution of any application not explicitly allowed. WDAC is an application control mechanism that enforces an allowlist of approved code, blocking execution of any binary, script, or package not explicitly permitted by policy. This default-deny posture is its primary security benefit, preventing unauthorized or malicious executables from running even if they land on the endpoint.

Answer

It encrypts application binaries at rest

Answer

It automatically updates applications from a trusted source

Answer

It ensures that all applications are digitally signed

Question 12

A company is deploying virtual machines (VMs) in a private cloud environment. To prevent VM escape attacks, which of the following is the most critical security control?

Accepted Answer

Regularly patching the hypervisor software. Regularly patching the hypervisor software is the most critical control to prevent VM escape attacks because these attacks typically exploit vulnerabilities in the hypervisor itself. Keeping the hypervisor up to date ensures that known security flaws are remediated, reducing the attack surface. While other controls add defense in depth, patching directly addresses the root cause of most escape vulnerabilities.

Answer

Using a separate management network for the hypervisor

Answer

Disabling unnecessary VM guest tools

Answer

Implementing a host-based firewall on each VM

Question 13

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In IaaS, the customer is responsible for securing the operating system, including patch management, because the provider only manages the hypervisor and physical infrastructure. Operating system security and patching is therefore a customer responsibility. The other options are provider responsibilities in IaaS.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 14

During a code review, a developer identifies that a web application directly concatenates user input into SQL queries without sanitization. This vulnerability is classified under which OWASP Top 10 category?

Accepted Answer

Injection. Directly concatenating unsanitized user input into SQL queries is the textbook definition of SQL injection, which falls under the OWASP Top 10 'Injection' category (A03:2021). Injection covers SQL, NoSQL, OS command, and LDAP injection where untrusted data is interpreted as code or commands. The fix is parameterized queries or prepared statements, not input filtering alone.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 15

A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?

Accepted Answer

Edit the /etc/sudoers file to restrict sudo access. The /etc/sudoers file defines which users and groups may run which commands with elevated privileges via sudo. Restricting sudo access by editing this file (preferably with visudo) ensures that only authorized users can execute commands as root or another privileged account. This directly satisfies the requirement to control who can execute commands with elevated privileges.

Answer

Enable auditd to log all commands

Answer

Configure PAM to enforce password complexity

Answer

Set the setuid bit on critical binaries