SSCP Systems and Application Security Practice Test 6 — 15 Questions

Question 1

A Linux administrator is hardening a server. Which TWO commands are used to manage file permissions? (Select TWO.)

Accepted Answer

chmod. Option D, chmod, is correct because it directly manages file permissions by changing the read, write, and execute bits (the mode) for the owner, group, and others on files and directories, using symbolic or octal notation. Option E, chown, is correct because it manages file ownership, changing the owning user and/or group of a file, which is a core part of file permission management since permissions are evaluated against the owner and group. Option A, usermod, is incorrect because it modifies user account attributes such as group membership, home directory, and shell, not file permissions. Option B, passwd, is incorrect because it manages user authentication passwords, not file permissions. Option C, groupadd, is incorrect because it creates new groups in the system, not file permissions.

Answer

usermod

Answer

passwd

Answer

groupadd

Question 2

A company is migrating to the cloud and wants to understand the shared responsibility model. For an IaaS deployment, which THREE are customer responsibilities? (Select THREE.)

Accepted Answer

Managing application security (e.g., patching web app code). In IaaS, customer manages OS, applications, and network traffic controls (guest OS firewall).

Answer

Physical security of the data center

Answer

Securing the hypervisor

Question 3

A security analyst is reviewing Linux audit logs with auditd. Which TWO events would be of greatest concern for a server that should not have interactive logins? (Select TWO.)

Accepted Answer

Successful root login via SSH. Option A (Successful root login via SSH) is correct because a server that should not permit interactive logins should never show a successful root SSH session; this indicates either a policy violation or compromised credentials granting direct privileged interactive access. Option C (Multiple failed su attempts) is correct because repeated su failures signal an active attempt to escalate to another account (often root) interactively, which is a strong indicator of brute-force or unauthorized privilege-escalation activity on a host that should have no interactive users. Option B (System reboot logs) is not inherently concerning, as reboots are routine operational events and do not by themselves indicate interactive login or compromise. Option D (Successful cron job execution) is normal scheduled behavior and does not represent an interactive login. Option E (File permission changes by a non-root user) may be worth reviewing, but a non-root user changing permissions on files they own is not as directly indicative of unauthorized interactive access as a successful root SSH login or repeated su failures.

Answer

System reboot logs

Answer

Successful cron job execution

Answer

File permission changes by a non-root user

Question 4

A system administrator is applying CIS Benchmarks to a Windows server. Which TWO hardening measures are typically recommended by CIS? (Select TWO.)

Accepted Answer

Enforce strong password policies. Option C (Enforce strong password policies) is correct because CIS Benchmarks for Windows Server explicitly require configuring account policies such as minimum password length (typically 14 characters), password complexity, maximum password age, and password history to reduce the risk of brute-force and credential-guessing attacks. Option D (Disable unused services) is correct because CIS hardening guidance mandates disabling or setting to Disabled any unnecessary services (e.g., Fax, Windows Search, Remote Registry) to shrink the attack surface and eliminate unneeded listening ports and privileged functionality. Option A is wrong because enabling all Windows features by default directly contradicts CIS least-functionality principles, which call for removing or not installing unneeded roles and features. Option B is wrong because CIS Benchmarks require enabling and configuring audit logging (e.g., via Advanced Audit Policy) to capture security-relevant events, not disabling it. Option E is wrong because allowing anonymous enumeration of SAM accounts is a known information-disclosure weakness that CIS explicitly prohibits by requiring the Anonymous Enumeration of SAM Accounts and Shares setting to be Disabled.

Answer

Enable all Windows features by default

Answer

Disable audit logging

Answer

Allow anonymous enumeration of SAM accounts

Question 5

A financial services firm runs a Java-based customer portal on Apache Tomcat. During a code review, the security team discovers that the application deserializes session objects received from an untrusted partner API without validating their contents. An attacker could craft a malicious serialized object that executes arbitrary code on the server when deserialized. Which of the following controls BEST mitigates this risk?

Accepted Answer

Implement a strict allowlist of permitted classes for deserialization and reject all others.. Insecure deserialization allows attackers to influence object state and potentially achieve remote code execution. The most direct fix is to constrain which classes can be deserialized using an allowlist, so only expected types from the partner API are accepted. Transport encryption, WAF rules, and JVM tuning do not validate object contents and therefore fail to eliminate the vulnerability.

Answer

Enable TLS 1.3 with mutual authentication between the portal and the partner API.

Answer

Increase the Java heap size and enable garbage collection tuning on the Tomcat server.

Answer

Deploy a web application firewall (WAF) with OWASP ModSecurity Core Rule Set in blocking mode.

Question 6

A healthcare organization is deploying a containerized patient records application on Kubernetes. The security team wants to prevent a compromised container from accessing the underlying node's filesystem and from escalating privileges. Which Kubernetes control should be configured to restrict the container's capabilities and prevent privilege escalation?

Accepted Answer

Set the pod's securityContext to allowPrivilegeEscalation: false and drop all Linux capabilities.. Restricting a container's privileges requires configuring its securityContext to prevent privilege escalation and to drop unnecessary Linux capabilities. These settings directly limit what the container process can do on the host, including mounting filesystems or using privileged system calls. Network policies, privileged pod security profiles, and resource quotas address different concerns and do not prevent host filesystem access or privilege escalation.

Answer

Configure a resource quota that limits CPU and memory for the pod.

Answer

Enable PodSecurityPolicy with the privileged profile applied to the namespace.

Answer

Configure a NetworkPolicy that denies all ingress and egress traffic to the pod.

Question 7

A security engineer is hardening a Windows server that hosts a critical database. The server currently has many unnecessary services running. Which TWO of the following actions are most effective in reducing the attack surface of this server? (Choose two.)

Accepted Answer

Enable a host-based firewall and close unused ports.. Reducing attack surface involves eliminating unnecessary functionality and restricting access. Disabling unused services and features removes potential vulnerabilities, while closing unused ports and enabling a host-based firewall limits network exposure. Together, these actions significantly shrink the opportunities for an attacker to exploit the server.

Answer

Implement full disk encryption on the server's drives.

Answer

Apply the principle of least privilege to user accounts.

Answer

Install the latest antivirus software and keep it updated.

Question 8

A software vendor ships a Java-based payment service to a customer's data center. The customer's security team requires that the application run with only the minimum privileges necessary and cannot be trusted to restrict itself. Which mechanism should the security team use to enforce these restrictions on the JVM?

Accepted Answer

Java security policy files configured with a SecurityManager. Java's SecurityManager works with a policy file that enumerates granted permissions, so code is denied anything not explicitly allowed. This lets the security team enforce least privilege from outside the application, which matches the requirement that the application itself not be trusted to limit its own access.

Answer

Running the JVM as a Windows service under Local System

Answer

Enabling verbose garbage collection logging

Answer

Code signing the JAR with a trusted certificate

Question 9

A security administrator is configuring a mobile device management (MDM) policy for company-owned smartphones. The organization wants to ensure that if a device is lost or stolen, corporate data can be removed without affecting the user's personal data. Which of the following MDM capabilities should be enabled?

Accepted Answer

Selective wipe of corporate data. Selective wipe is designed to remove only corporate data and settings from a mobile device, preserving personal data. This is essential for scenarios where devices are used for both work and personal purposes. It ensures that sensitive company information is not exposed if the device is lost or stolen, while not intruding on the user's personal data.

Answer

Enforcing a strong screen lock PIN

Answer

Containerization of corporate applications

Answer

Remote wipe of the entire device

Question 10

A security administrator is building a Security Information and Event Management (SIEM) correlation rule to detect a specific attack pattern on a Linux web server. The rule must identify attempts where an attacker sends a single malicious HTTP request that causes the server to execute an arbitrary operating system command. Which of the following event sources would provide the most reliable and immediate evidence for this rule?

Accepted Answer

Linux auditd logs configured to monitor execve system calls. Detecting arbitrary command execution requires visibility into process creation on the host. Linux auditd can monitor the execve system call, capturing the exact command line and parent process for every new program. This gives the SIEM immediate, high-fidelity evidence of the attack, unlike network flow or web access logs that lack process-level context.

Answer

Apache access logs with the Combined Log Format enabled

Answer

NetFlow records exported from the network router

Answer

Syslog messages from the SSH daemon

Question 11

A healthcare provider must ensure that stored patient records remain unreadable if an attacker steals the physical disk from a database server. The server runs a mainstream Linux distribution and the requirement applies to the entire volume, not just individual files. Which control best meets this requirement?

Accepted Answer

Full disk encryption with LUKS on the data volume. Whole-volume encryption converts all data on the block device into ciphertext at rest and requires a key to mount it. When the disk is stolen, the ciphertext is useless without that key, which directly satisfies the requirement to keep records unreadable after physical theft.

Answer

Enforcing strict file permissions on the data directory

Answer

Enabling SELinux in enforcing mode on the server

Answer

Per-file encryption performed by the database engine

Question 12

A healthcare organization is developing a mobile application that stores patient data locally on the device. The security team must ensure that if a device is lost or stolen, the data cannot be accessed without the user's authentication. Which of the following controls should be implemented to meet this requirement?

Accepted Answer

Enable full-device encryption and require a strong passcode.. The most direct control to prevent access to locally stored data on a lost or stolen device is full-device encryption tied to a passcode. This ensures that without the correct passcode, the encryption keys cannot be derived, rendering the data unreadable. Other options address different threats such as network interception or reverse engineering, but not data-at-rest confidentiality.

Answer

Use obfuscation to hide the application's code and data structures.

Answer

Store all patient data in a remote database and cache nothing locally.

Answer

Implement certificate pinning for all API communications.

Question 13

A mobile device management (MDM) administrator at a healthcare company needs to ensure that a physician's personally owned smartphone can access patient records through the corporate email application, but the administrator must be able to remotely erase only the corporate email data and its encryption keys if the device is lost, without deleting the physician's personal photos and apps. Which MDM capability should the administrator configure?

Accepted Answer

Enable selective wipe, also called enterprise wipe, which removes only corporate email data and associated keys.. Selective wipe, also known as enterprise wipe, is the MDM feature that removes only corporate data and its encryption keys from a personally owned device. It preserves the user's personal content, making it the correct choice for BYOD scenarios. Full-device wipe, passcode policies, and copy-paste restrictions do not provide the required granular remote erasure of corporate email data.

Answer

Configure a full-device remote wipe that removes all data after a predefined number of failed unlock attempts.

Answer

Enroll the device in a mobile application management (MAM) policy that blocks copy and paste between apps.

Answer

Apply a device-level passcode policy that requires a six-digit PIN and disables the camera application.

Question 14

A DevOps team deploys containerized microservices and wants to reduce the impact of a compromised container. They need a control that limits which system calls each container process can make, without changing the application image. Which Linux kernel feature should they enable?

Accepted Answer

seccomp profiles applied to the container. seccomp attaches a filter to each process that permits or denies individual system calls, so even a fully compromised container is constrained at the kernel boundary. Because profiles are supplied by the container runtime at launch, the team avoids modifying the application image while gaining strong containment.

Answer

Read-only root file system for the container

Answer

Dropping all Linux capabilities from the container

Answer

Linux cgroups v2 memory limits

Question 15

A security administrator at a hospital is configuring a server that processes electronic health records. The server runs a Linux-based operating system, and the administrator needs to select a mandatory access control (MAC) framework that can enforce granular, policy-based restrictions on how processes interact with files, network ports, and other system resources. Which of the following should the administrator choose?

Accepted Answer

SELinux. SELinux provides mandatory access control by labeling subjects and objects and enforcing administrator-defined policy in the kernel, restricting processes regardless of user identity. The other choices describe authentication hardening or discretionary and role-based models that do not enforce system-wide mandatory policy. For a Linux server holding regulated health data, SELinux is the correct framework to meet the granular MAC requirement.

Answer

Password complexity and account lockout policies

Answer

Role-based access control (RBAC) through group membership

Answer

Discretionary access control (DAC) via standard file permissions