SSCP Systems and Application Security Practice Test 3 — 15 Questions

Question 1

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. Telnet is an unencrypted protocol that transmits credentials in cleartext. Removing unnecessary services reduces the attack surface; disabling Telnet eliminates a known vulnerability.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 2

An organization is implementing Windows Defender Application Control (WDAC) to prevent unauthorized applications from running on company workstations. Which of the following best describes the primary security benefit of this approach?

Accepted Answer

It prevents execution of any application not explicitly allowed. WDAC is a whitelisting technology that only allows approved applications to execute, effectively blocking malware and unauthorized software by default.

Answer

It encrypts application binaries at rest

Answer

It automatically updates applications from a trusted source

Answer

It ensures that all applications are digitally signed

Question 3

A security analyst notices that a Linux server has an unusual number of failed login attempts for the root account. To strengthen authentication security while preserving administrative access, which of the following configurations would be most effective?

Accepted Answer

Implement account lockout via PAM module pam_tally2. PAM (Pluggable Authentication Modules) can enforce account lockout after a number of failed attempts. This mitigates brute-force attacks while allowing legitimate administrators to unlock accounts if needed.

Answer

Configure SELinux to enforce mandatory access control on the /etc/shadow file

Answer

Change the root password every 30 days

Answer

Disable root login entirely and require sudo for all administrative tasks

Question 4

A company is deploying virtual machines (VMs) in a private cloud environment. To prevent VM escape attacks, which of the following is the most critical security control?

Accepted Answer

Regularly patching the hypervisor software. VM escape attacks exploit vulnerabilities in the hypervisor to break out of a VM. Keeping the hypervisor patched is the primary defense against known vulnerabilities.

Answer

Using a separate management network for the hypervisor

Answer

Disabling unnecessary VM guest tools

Answer

Implementing a host-based firewall on each VM

Question 5

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In the IaaS shared responsibility model, the cloud provider manages the physical infrastructure, while the customer is responsible for securing the operating system, applications, and data.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 6

During a code review, a developer identifies that a web application directly concatenates user input into SQL queries without sanitization. This vulnerability is classified under which OWASP Top 10 category?

Accepted Answer

Injection. SQL injection occurs when untrusted data is sent to an interpreter as part of a command. It is a classic injection flaw, which is the top category in OWASP.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 7

A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?

Accepted Answer

Edit the /etc/sudoers file to restrict sudo access. The /etc/sudoers file controls which users can run commands as root via sudo. Proper configuration is essential for privilege escalation control.

Answer

Enable auditd to log all commands

Answer

Configure PAM to enforce password complexity

Answer

Set the setuid bit on critical binaries

Question 8

An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?

Accepted Answer

Unpatched and misconfigured VMs. Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.

Answer

License compliance violations

Answer

Increased power consumption and cooling costs

Answer

VM escape attacks from older hypervisors

Question 9

A security administrator is configuring Windows Firewall with Advanced Security for a web server. The requirement is to allow inbound HTTPS traffic but block all other inbound traffic. Which of the following rule configurations best meets this requirement?

Accepted Answer

Create an inbound allow rule for HTTPS and create a block rule for all other ports. A specific allow rule for HTTPS (port 443) combined with a default block rule ensures only HTTPS is allowed. The default block rule enforces the principle of least privilege.

Answer

Create an inbound block rule for all ports and then exclude HTTPS

Answer

Create an inbound allow rule for HTTPS and set the firewall default action to block

Answer

Create an outbound allow rule for HTTPS only

Question 10

Which of the following tools would best help a security team detect misconfigurations in a cloud environment, such as open storage buckets or overly permissive IAM roles?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM tools are specifically designed to identify cloud misconfigurations, including storage bucket permissions and IAM roles, and often provide remediation guidance.

Answer

Web Application Firewall (WAF)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Event Viewer

Question 11

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

Accepted Answer

Establishing a process to add approved applications to the whitelist. Application whitelisting requires a process for updating the whitelist when new legitimate software is needed; otherwise, users may be blocked from necessary applications.

Answer

Ensuring that all users have local administrator rights

Answer

Deploying a host-based firewall on each endpoint

Answer

Disabling Windows Defender Antivirus to reduce resource usage

Question 12

A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?

Accepted Answer

Use Windows Event Forwarding to a central event collector. Centralized logging with a SIEM (or similar) aggregates logs from multiple sources. Forwarding events to a central collector ensures logs are preserved even if a server is compromised.

Answer

Store logs only on the local server and back them up weekly

Answer

Configure Event Viewer on each server to overwrite events as needed

Answer

Enable auditing of account logon events

Question 13

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 14

A cloud security architect is designing a solution to protect workloads running in a public cloud. Which THREE of the following are key security controls that should be implemented?

Accepted Answer

Deploy a Cloud Security Posture Management (CSPM) tool. IAM roles control permissions for cloud resources. CSPM detects misconfigurations. CWPP provides runtime protection for workloads.

Answer

Store encryption keys in the same cloud region as the data

Answer

Disable multi-factor authentication for service accounts

Question 15

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Accepted Answer

SQL injection. Injection flaws occur when untrusted data is sent to an interpreter. SQL, OS command, and LDAP injection are classic examples.

Answer

Broken authentication

Answer

Cross-Site Scripting (XSS)