SSCP Systems and Application Security Practice Test 5 — 15 Questions

Question 1

During a vulnerability scan, a security team discovers that several virtual machine snapshots contain outdated software with known vulnerabilities. Which risk is most directly associated with this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability reintroduction. Virtual machine snapshots capture the state of a VM at a point in time, including the operating system and installed software. If a snapshot contains outdated software with known vulnerabilities, restoring that snapshot or using it to create new VMs can reintroduce those vulnerabilities into the environment, even if they were previously patched. This is known as vulnerability reintroduction.

Answer

Resource exhaustion

Answer

VM sprawl

Answer

VM escape

Question 2

Which Windows feature provides mandatory integrity controls and helps prevent unauthorized changes to system settings by requiring administrator approval?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the Windows feature that enforces mandatory integrity controls and prompts for administrator approval before allowing changes that require elevated privileges. It ensures that even administrator accounts run with standard-user rights by default and must explicitly consent to elevation, preventing unauthorized system changes.

Answer

Windows Defender Application Control

Answer

Security Audit Policy

Answer

Group Policy

Question 3

A security administrator is configuring a Linux server to enforce mandatory access control (MAC). Which of the following tools provides MAC on Linux?

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that implement mandatory access control policies beyond traditional discretionary access control.

Answer

PAM

Answer

iptables

Answer

chmod

Question 4

An organization using cloud IAM wants to grant a compute instance permissions to access a cloud storage bucket without storing long-term credentials on the instance. Which IAM feature should be used?

Accepted Answer

IAM role assigned to the compute instance. IAM roles for compute instances allow the instance to assume a role and obtain temporary credentials from a security token service, avoiding the need for long-term keys.

Answer

Service-level access policies

Answer

Long-term user access keys

Answer

Resource-based policies on the storage bucket

Question 5

A security engineer is hardening a Linux server. Which TWO actions are recommended to reduce the attack surface? (Select TWO.)

Accepted Answer

Remove unnecessary services and daemons. Option A is correct because removing unnecessary services and daemons eliminates listening ports, binaries, and potential vulnerabilities that attackers could exploit, directly shrinking the attack surface. Option B is correct because disabling unused user accounts removes dormant credentials and login paths that could be abused for unauthorized access or privilege escalation. Option C is wrong because installing a web server for management adds a new network-facing service and increases, rather than reduces, the attack surface. Option D is wrong because setting umask to 000 makes newly created files world-readable and world-writable, weakening permissions instead of hardening them. Option E is wrong because enabling IPv6 routing adds network functionality and exposure that is unnecessary on a hardened server and can introduce additional attack vectors.

Answer

Install a web server for management

Answer

Set umask to 000

Answer

Enable IPv6 routing

Question 6

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 7

A security analyst is hardening a new Windows server. Which configuration would MOST effectively reduce the attack surface by limiting the software that can execute?

Accepted Answer

Configure AppLocker rules. AppLocker is a Windows application control feature that lets administrators define allow/deny rules based on publisher, path, or file hash, thereby restricting which executables, scripts, and installers can run. This directly limits the software that can execute, which is the most effective way to reduce attack surface against unauthorized or malicious code. Antivirus, AutoPlay, and UAC address other threats but do not control what software is permitted to run.

Answer

Enable Windows Defender Antivirus

Answer

Disable AutoPlay

Answer

Enable User Account Control (UAC)

Question 8

A Linux server is being hardened. The security team wants to enforce mandatory access control policies that confine processes to limited access to files and resources. Which technology should be implemented?

Accepted Answer

SELinux. SELinux (Security-Enhanced Linux) implements mandatory access control (MAC) by labeling processes and files with security contexts and enforcing policy rules that confine processes to only the resources they are permitted to access. This is exactly what the security team needs to enforce MAC and limit process access to files and resources.

Answer

PAM

Answer

iptables

Answer

auditd

Question 9

A company uses virtualization extensively. The security team discovers that developers have created many unmanaged virtual machines that are not tracked in the configuration management database (CMDB). Which risk is MOST directly associated with this situation?

Accepted Answer

VM sprawl. VM sprawl refers to the proliferation of unmanaged VMs, increasing attack surface and management complexity.

Answer

VM escape

Answer

Snapshot vulnerability reintroduction

Answer

Insecure hypervisor configuration

Question 10

A security architect is reviewing cloud security for a SaaS application used by the company. According to the shared responsibility model, which security controls are PRIMARILY the customer's responsibility?

Accepted Answer

Data classification and user access management. In SaaS, the customer is responsible for data classification and managing user access (IAM).

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Operating system patching

Question 11

A web application is vulnerable to SQL injection. Which security control would be MOST effective at detecting and blocking such attacks at the network perimeter?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at the application layer and can detect and block SQL injection patterns using signature-based and anomaly-based rules (e.g., OWASP Core Rule Set). It sits at the network perimeter in front of the web application, making it the most effective control for this requirement.

Answer

Intrusion Detection System (IDS)

Answer

Application whitelisting

Answer

Host-based firewall

Question 12

A system administrator is configuring a Linux server to ensure that only authorized users can execute commands with superuser privileges. Which file should be edited to control sudo access?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the central configuration file that defines which users and groups may run which commands with elevated privileges via sudo. It uses a specific syntax (user/group, host, runas, command) and is edited with visudo to prevent syntax errors that could lock out sudo access. Editing this file is the standard way to control sudo authorization on Linux.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 13

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Accepted Answer

Reintroduction of unpatched vulnerabilities. Old VM snapshots preserve the exact state of the VM at the time of capture, including the OS and application binaries. If a VM is reverted to a months-old snapshot, any patches applied since then are lost, reintroducing known vulnerabilities that attackers can exploit. This is the most likely and direct risk of retaining stale snapshots on the hypervisor.

Answer

VM escape via snapshot file corruption

Answer

Unauthorized access to snapshot data

Answer

Hypervisor memory exhaustion

Question 14

A security engineer is hardening a Windows workstation. Which TWO configurations reduce the attack surface by limiting execution of unauthorized code? (Select TWO.)

Accepted Answer

Configure AppLocker rules. AppLocker (A) is correct because it uses allow/deny rules based on publisher, path, or file hash to control which executables, scripts, and installers users can run, directly restricting unauthorized code execution. Windows Defender Application Control (D) is also correct because WDAC enforces code integrity policies at the kernel level, allowing only trusted, signed binaries to execute and blocking unauthorized or tampered code. Windows Firewall with Advanced Security (B) filters network traffic by port, protocol, and profile but does not govern local code execution, so it does not meet the requirement. BitLocker (C) provides full-disk encryption for data-at-rest confidentiality and does not prevent execution of unauthorized programs. Disabling AutoPlay (E) reduces a minor vector for automatic execution from removable media but is not a general code-execution control like AppLocker or WDAC.

Answer

Enable Windows Firewall with Advanced Security

Answer

Enable BitLocker full-disk encryption

Answer

Disable AutoPlay

Question 15

A security analyst is reviewing OWASP Top 10 vulnerabilities in a web application. Which TWO are injection-related attacks? (Select TWO.)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) (B) is correct because it is an injection attack in which attacker-supplied JavaScript is injected into a web page and executed in a victim's browser, typically via unescaped user input rendered into HTML, allowing session theft or DOM manipulation. SQL injection (E) is correct because it injects malicious SQL statements through unsanitized input into a database query, enabling data exfiltration, authentication bypass, or command execution on the DBMS. Both belong to the injection class of attacks where untrusted data is interpreted as code or commands by an interpreter. Security Misconfiguration (A) is a configuration weakness, not an injection flaw. Cross-Site Request Forgery (CSRF) (C) abuses a victim's authenticated session to force unintended requests, not code injection. Insecure Direct Object References (IDOR) (D) is an access-control flaw where object identifiers are manipulated to reach unauthorized resources, not an injection attack.

Answer

Security Misconfiguration

Answer

Cross-Site Request Forgery (CSRF)

Answer

Insecure Direct Object References (IDOR)