SSCP Systems and Application Security Practice Test 4 — 15 Questions

Question 1

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Accepted Answer

SQL injection. Injection flaws occur when untrusted data is sent to an interpreter. SQL, OS command, and LDAP injection are classic examples.

Answer

Broken authentication

Answer

Cross-Site Scripting (XSS)

Question 2

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker provides application whitelisting capabilities in Windows, allowing administrators to control which applications can run based on rules.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 3

A security administrator is reviewing Linux audit logs to detect unauthorized file access. Which Linux component is primarily responsible for generating these security audit logs?

Accepted Answer

auditd. auditd is the userspace component of the Linux Audit system that writes audit records to disk.

Answer

systemd-journald

Answer

SELinux

Answer

PAM

Question 4

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 5

An organization uses VMware ESXi in a production environment. Which of the following is the most effective mitigation against VM escape attacks?

Accepted Answer

Regularly patching the ESXi hypervisor. VM escape attacks exploit hypervisor vulnerabilities. Keeping the hypervisor patched is the primary defense, as it closes known vulnerabilities that could be used for escape.

Answer

Using VM snapshots for quick recovery

Answer

Implementing network segmentation between VMs

Answer

Disabling unnecessary guest tools within VMs

Question 6

According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?

Accepted Answer

Data classification and access controls. In SaaS, the customer is responsible for securing their data, including classification, access controls, and encryption of data at rest and in transit.

Answer

Physical security of data centers

Answer

Securing the application code

Answer

Managing the underlying operating system

Question 7

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration

Question 8

A Linux administrator needs to configure access controls so that a specific user can run certain commands with root privileges without entering a password. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls sudo permissions. By adding an appropriate entry, the administrator can grant passwordless sudo access to specific commands.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/security/limits.conf

Question 9

A company deploys a web application and wants to protect against SQL injection and XSS attacks. Which security control is specifically designed to inspect HTTP traffic and block such attacks?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) filters and monitors HTTP traffic between a web application and the Internet, commonly used to block OWASP Top 10 attacks like SQL injection and XSS.

Answer

Intrusion Detection System (IDS)

Answer

Network segmentation

Answer

Host-based firewall

Question 10

During a vulnerability scan, a security team discovers that several virtual machine snapshots contain outdated software with known vulnerabilities. Which risk is most directly associated with this scenario?

Accepted Answer

Vulnerability reintroduction. VM snapshots, if left inactive and not patched, can reintroduce vulnerabilities when the snapshot is used to provision new VMs, as the software is outdated.

Answer

Resource exhaustion

Answer

VM sprawl

Answer

VM escape

Question 11

Which Windows feature provides mandatory integrity controls and helps prevent unauthorized changes to system settings by requiring administrator approval?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) prompts for consent or credentials before allowing actions that require administrative privileges, helping to prevent unauthorized changes.

Answer

Windows Defender Application Control

Answer

Security Audit Policy

Answer

Group Policy

Question 12

A security administrator is configuring a Linux server to enforce mandatory access control (MAC). Which of the following tools provides MAC on Linux?

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that implement mandatory access control policies beyond traditional discretionary access control.

Answer

PAM

Answer

iptables

Answer

chmod

Question 13

A security engineer is hardening a Linux server. Which TWO actions are recommended to reduce the attack surface? (Select TWO.)

Accepted Answer

Remove unnecessary services and daemons. Removing unnecessary services and disabling unused accounts reduce the number of potential entry points for attackers.

Answer

Install a web server for management

Answer

Set umask to 000

Answer

Enable IPv6 routing

Question 14

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 15

A security analyst is reviewing application security and identifies risks related to the OWASP Top 10. Which THREE are examples of OWASP Top 10 vulnerabilities? (Select THREE.)

Accepted Answer

Security Misconfiguration. Injection, XSS, and Security Misconfiguration are classic OWASP Top 10 categories.

Answer

Man-in-the-Middle (MitM)

Answer

Buffer overflow