SSCP Systems and Application Security Practice Test 4 — 15 Questions

Question 1

An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?

Accepted Answer

Unpatched and misconfigured VMs. Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.

Answer

License compliance violations

Answer

Increased power consumption and cooling costs

Answer

VM escape attacks from older hypervisors

Question 2

Which of the following tools would best help a security team detect misconfigurations in a cloud environment, such as open storage buckets or overly permissive IAM roles?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) tools are specifically designed to continuously monitor cloud environments for misconfigurations, compliance violations, and security risks such as open storage buckets and overly permissive IAM roles. They compare the actual configuration against best practices and benchmarks (e.g., CIS, NIST) and alert on deviations. This directly addresses the need to detect misconfigurations.

Answer

Web Application Firewall (WAF)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Event Viewer

Question 3

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

Accepted Answer

Establishing a process to add approved applications to the whitelist. Application whitelisting only allows approved applications to run. To maintain operational efficiency, organizations must have a streamlined process to review and add new or updated applications to the whitelist as business needs evolve. Without this, users may be blocked from necessary tools, causing productivity loss.

Answer

Ensuring that all users have local administrator rights

Answer

Deploying a host-based firewall on each endpoint

Answer

Disabling Windows Defender Antivirus to reduce resource usage

Question 4

A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?

Accepted Answer

Use Windows Event Forwarding to a central event collector. Windows Event Forwarding (WEF) uses the WS-Management/WinRM protocol to push selected event logs from source servers to a central Windows Event Collector (WEC) server. Because events are forwarded in near real time to a separate host, an attacker who compromises a source server cannot easily erase the already-forwarded copies, satisfying the tamper-resistance requirement. It also centralizes review, which is what the forensic analyst needs across multiple servers.

Answer

Store logs only on the local server and back them up weekly

Answer

Configure Event Viewer on each server to overwrite events as needed

Answer

Enable auditing of account logon events

Question 5

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 6

A cloud security architect is designing a solution to protect workloads running in a public cloud. Which THREE of the following are key security controls that should be implemented?

Accepted Answer

Deploy a Cloud Security Posture Management (CSPM) tool. Option B is correct because a Cloud Security Posture Management (CSPM) tool continuously monitors the cloud environment for misconfigurations, compliance violations, and policy drift, which is a foundational control for protecting public cloud workloads. Option D is correct because a Cloud Workload Protection Platform (CWPP) secures the actual workloads (VMs, containers, serverless functions) at runtime, providing vulnerability scanning, threat detection, and workload-level hardening. Option E is correct because implementing IAM roles with least privilege limits each identity to only the permissions required for its function, reducing the blast radius of compromised credentials and enforcing zero-trust access control. Option A is not a key control because storing encryption keys in the same region as the data does not improve security and may actually reduce resilience; key management should follow a dedicated KMS/HSM strategy with appropriate separation and replication. Option C is not a key control because disabling multi-factor authentication for service accounts weakens security and violates best practices; MFA or strong credential management should be enforced, not removed.

Answer

Store encryption keys in the same cloud region as the data

Answer

Disable multi-factor authentication for service accounts

Question 7

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Accepted Answer

SQL injection. SQL injection (A) is a classic injection flaw where untrusted input is concatenated into SQL statements, allowing an attacker to alter query logic and manipulate the database. LDAP injection (B) is also an injection flaw because unsanitized input inserted into LDAP filters or queries can modify directory lookups and bypass authentication or expose directory data. OS command injection (D) occurs when user input is passed to a shell or system call, letting an attacker execute arbitrary operating-system commands on the server. Broken authentication (C) is a separate OWASP category involving weaknesses in session management, credential handling, or authentication logic, not an injection flaw. Cross-Site Scripting (E) is typically classified under injection-like client-side flaws or its own category, but in the OWASP Top 10 it is not grouped as an injection flaw in the same sense as SQL, LDAP, or OS command injection.

Answer

Broken authentication

Answer

Cross-Site Scripting (XSS)

Question 8

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker is a Windows built-in feature introduced in Windows 7 and Server 2008 R2 that allows administrators to create and enforce rules specifying which applications and files users can run. It uses a whitelisting model based on file attributes such as publisher, path, or hash, and can be configured via Group Policy or PowerShell cmdlets. By default, AppLocker blocks any executable not explicitly allowed, thus ensuring only approved executables run. This directly meets the requirement for application whitelisting on Windows servers.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 9

A security administrator is reviewing Linux audit logs to detect unauthorized file access. Which Linux component is primarily responsible for generating these security audit logs?

Accepted Answer

auditd. auditd is the userspace component of the Linux Audit system that writes audit records to disk.

Answer

systemd-journald

Answer

SELinux

Answer

PAM

Question 10

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools continuously monitor cloud environments against security benchmarks (CIS, PCI-DSS, ISO 27001) and compliance frameworks, detecting misconfigurations such as public S3 buckets, overly permissive security groups, or disabled logging, then providing remediation guidance. The primary purpose is posture management — identifying and fixing configuration drift and policy violations before they are exploited.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 11

An organization uses VMware ESXi in a production environment. Which of the following is the most effective mitigation against VM escape attacks?

Accepted Answer

Regularly patching the ESXi hypervisor. VM escape exploits a vulnerability in the hypervisor that lets a guest VM break out and access the host or other VMs. Regularly patching ESXi closes known hypervisor vulnerabilities (e.g., those disclosed in VMware security advisories) before attackers can exploit them, making it the most effective mitigation. Patching directly addresses the root cause — the hypervisor flaw — rather than the symptoms.

Answer

Using VM snapshots for quick recovery

Answer

Implementing network segmentation between VMs

Answer

Disabling unnecessary guest tools within VMs

Question 12

According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?

Accepted Answer

Data classification and access controls. In the shared responsibility model, the cloud provider always owns security *of* the cloud (physical facilities, hypervisor, host OS, and for SaaS the application itself), while the customer always owns security *in* the cloud — their data, identities, and access decisions. Data classification and access controls are therefore unambiguously customer responsibilities in every cloud service model, including SaaS. This is the one responsibility that never transfers to the provider.

Answer

Physical security of data centers

Answer

Securing the application code

Answer

Managing the underlying operating system

Question 13

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration

Question 14

A Linux administrator needs to configure access controls so that a specific user can run certain commands with root privileges without entering a password. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file defines which users or groups may run which commands as root (or other users), and supports the NOPASSWD tag to allow passwordless execution. Editing it with visudo ensures syntax validation and prevents concurrent-edit corruption. This is the standard mechanism for granting granular, password-free privilege escalation on Linux.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/security/limits.conf

Question 15

A company deploys a web application and wants to protect against SQL injection and XSS attacks. Which security control is specifically designed to inspect HTTP traffic and block such attacks?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at the application layer (HTTP/HTTPS) and inspects request and response payloads for attack signatures such as SQL injection and cross-site scripting (XSS). It can block or filter malicious requests before they reach the web application, making it the control specifically designed for this purpose.

Answer

Intrusion Detection System (IDS)

Answer

Network segmentation

Answer

Host-based firewall