SSCP Systems and Application Security Practice Test 3 — 15 Questions

Question 1

A security engineer is evaluating cloud security tools. Which TWO of the following are primarily used to protect cloud workloads? (Select two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). CWPP provides runtime security for cloud VMs and containers. WAF protects web applications from attacks like SQL injection and XSS. CSPM focuses on misconfiguration detection, not workload runtime. IAM manages identities. SIEM aggregates logs but is not workload-specific.

Answer

Identity and Access Management (IAM)

Answer

Cloud Security Posture Management (CSPM)

Answer

Security Information and Event Management (SIEM)

Question 2

During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)

Accepted Answer

Snapshots may contain unpatched vulnerabilities. Snapshots can reintroduce vulnerabilities because they capture the VM state at a point in time; if the VM was not fully patched, the snapshot retains those unpatched vulnerabilities (option A). Additionally, snapshots may contain sensitive data in memory or disk that could be exposed if not properly secured (option B). Furthermore, snapshots can be used to roll back security configurations, undoing security updates or settings (option D). The incorrect options are C (snapshots cause VM sprawl) and E (snapshots can be used as an attack vector for VM escape). VM sprawl is more about excessive VM creation, not a direct risk of snapshots, and VM escape is a different vulnerability unrelated to snapshot risks.

Answer

Snapshots cause VM sprawl

Answer

Snapshots can be used as an attack vector for VM escape

Question 3

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. Telnet is an unencrypted protocol that transmits credentials in cleartext. Removing unnecessary services reduces the attack surface; disabling Telnet eliminates a known vulnerability.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 4

An organization is implementing Windows Defender Application Control (WDAC) to prevent unauthorized applications from running on company workstations. Which of the following best describes the primary security benefit of this approach?

Accepted Answer

It prevents execution of any application not explicitly allowed. WDAC is a whitelisting technology that only allows approved applications to execute, effectively blocking malware and unauthorized software by default.

Answer

It encrypts application binaries at rest

Answer

It automatically updates applications from a trusted source

Answer

It ensures that all applications are digitally signed

Question 5

A security analyst notices that a Linux server has an unusual number of failed login attempts for the root account. To strengthen authentication security while preserving administrative access, which of the following configurations would be most effective?

Accepted Answer

Implement account lockout via PAM module pam_tally2. PAM (Pluggable Authentication Modules) can enforce account lockout after a number of failed attempts. This mitigates brute-force attacks while allowing legitimate administrators to unlock accounts if needed.

Answer

Configure SELinux to enforce mandatory access control on the /etc/shadow file

Answer

Change the root password every 30 days

Answer

Disable root login entirely and require sudo for all administrative tasks

Question 6

A company is deploying virtual machines (VMs) in a private cloud environment. To prevent VM escape attacks, which of the following is the most critical security control?

Accepted Answer

Regularly patching the hypervisor software. VM escape attacks exploit vulnerabilities in the hypervisor to break out of a VM. Keeping the hypervisor patched is the primary defense against known vulnerabilities.

Answer

Using a separate management network for the hypervisor

Answer

Disabling unnecessary VM guest tools

Answer

Implementing a host-based firewall on each VM

Question 7

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In the IaaS shared responsibility model, the cloud provider manages the physical infrastructure, while the customer is responsible for securing the operating system, applications, and data.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 8

During a code review, a developer identifies that a web application directly concatenates user input into SQL queries without sanitization. This vulnerability is classified under which OWASP Top 10 category?

Accepted Answer

Injection. SQL injection occurs when untrusted data is sent to an interpreter as part of a command. It is a classic injection flaw, which is the top category in OWASP.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 9

A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?

Accepted Answer

Edit the /etc/sudoers file to restrict sudo access. The /etc/sudoers file controls which users can run commands as root via sudo. Proper configuration is essential for privilege escalation control.

Answer

Enable auditd to log all commands

Answer

Configure PAM to enforce password complexity

Answer

Set the setuid bit on critical binaries

Question 10

An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?

Accepted Answer

Unpatched and misconfigured VMs. Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.

Answer

License compliance violations

Answer

Increased power consumption and cooling costs

Answer

VM escape attacks from older hypervisors

Question 11

Which of the following tools would best help a security team detect misconfigurations in a cloud environment, such as open storage buckets or overly permissive IAM roles?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM tools are specifically designed to identify cloud misconfigurations, including storage bucket permissions and IAM roles, and often provide remediation guidance.

Answer

Web Application Firewall (WAF)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Event Viewer

Question 12

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

Accepted Answer

Establishing a process to add approved applications to the whitelist. Application whitelisting requires a process for updating the whitelist when new legitimate software is needed; otherwise, users may be blocked from necessary applications.

Answer

Ensuring that all users have local administrator rights

Answer

Deploying a host-based firewall on each endpoint

Answer

Disabling Windows Defender Antivirus to reduce resource usage

Question 13

A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?

Accepted Answer

Use Windows Event Forwarding to a central event collector. Centralized logging with a SIEM (or similar) aggregates logs from multiple sources. Forwarding events to a central collector ensures logs are preserved even if a server is compromised.

Answer

Store logs only on the local server and back them up weekly

Answer

Configure Event Viewer on each server to overwrite events as needed

Answer

Enable auditing of account logon events

Question 14

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 15

A cloud security architect is designing a solution to protect workloads running in a public cloud. Which THREE of the following are key security controls that should be implemented?

Accepted Answer

Deploy a Cloud Security Posture Management (CSPM) tool. IAM roles control permissions for cloud resources. CSPM detects misconfigurations. CWPP provides runtime protection for workloads.

Answer

Store encryption keys in the same cloud region as the data

Answer

Disable multi-factor authentication for service accounts