SSCP Systems and Application Security Practice Test 7 — 15 Questions

Question 1

A security operations center (SOC) is investigating a suspected supply chain attack where a trusted software update was modified to include a backdoor. The update was delivered via the vendor's official update server over HTTPS. Which of the following controls, if implemented by the organization, would have BEST prevented the installation of the backdoored update?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Code signing verification of the update package before installation.. Code signing verification is the key control to ensure the integrity and authenticity of software updates. If the update was modified after signing, the signature check fails, and the installation is blocked. Other controls like network segmentation or TLS pinning do not protect against a compromised update server or a malicious insider at the vendor.

Answer

TLS certificate pinning for the update server connection.

Answer

Network segmentation between the update server and critical systems.

Answer

Endpoint detection and response (EDR) with behavioral monitoring.

Question 2

A healthcare SaaS provider runs its application stack on Docker containers orchestrated by Kubernetes in a public cloud. A security administrator must reduce the risk of a compromised container accessing the underlying node's kernel. Which control BEST addresses this requirement?

Accepted Answer

Deploy containers with gVisor or Kata Containers to provide a sandboxed kernel boundary.. Sandboxed container runtimes such as gVisor and Kata Containers create a kernel boundary between the workload and the node, directly reducing the impact of a compromised container. Network policies, secret encryption, and resource quotas address networking, confidentiality, and availability respectively, but none of them prevent a container from interacting with the host kernel.

Answer

Set CPU and memory resource requests and limits on each container specification.

Answer

Configure Kubernetes Secrets to encrypt environment variables used by the application.

Answer

Enable Kubernetes NetworkPolicy to restrict pod-to-pod traffic on the cluster network.

Question 3

A security administrator is reviewing how mobile devices connect to corporate email and file shares. The organization wants to protect data if a device is lost and to prevent data leakage between personal and work applications. Which TWO controls should the administrator implement? (Choose two.)

Accepted Answer

Enroll devices in a mobile device management solution with remote wipe. MDM with remote wipe protects data when a device is lost, and containerization isolates corporate apps and data from personal ones to stop leakage across the boundary. Together they address both parts of the requirement without forcing users to carry separate devices.

Answer

Enable full device backup to the user's personal cloud account

Answer

Allow sideloading of applications from unknown sources

Answer

Disable device encryption to improve application performance

Question 4

A security administrator is deploying a new web application on a Linux server and wants to prevent an attacker who compromises the web server process from reading the application's private TLS keys stored on the same host. The administrator decides to use a hardware security module (HSM) to protect the keys. Which of the following BEST describes how the HSM provides this protection?

Accepted Answer

The HSM performs cryptographic operations internally so the private key never leaves the hardware boundary.. A hardware security module protects private keys by generating and using them inside tamper-resistant hardware. The key never enters the host's memory or file system, so a compromised web server process cannot read it. Encrypting keys on disk, using a TPM, or replicating keys to a CPU enclave still exposes the key material to the host at some point, which fails the stated requirement.

Answer

The HSM stores the private keys in a file encrypted with a passphrase that only the web server process knows.

Answer

The HSM encrypts the private key with a key derived from the server's TPM and stores the ciphertext on disk.

Answer

The HSM replicates the private key to a secure enclave in the server CPU, where it is used for TLS handshakes.

Question 5

A security administrator is deploying a new web application on a Linux server. The application must be isolated from the host and other applications, and it must only be able to read its own configuration files. The administrator decides to use a container. Which of the following should the administrator implement to meet these requirements?

Accepted Answer

Use a read-only root filesystem and mount only the required configuration files as a read-only volume.. The requirement is to isolate the application and restrict it to reading only its own configuration files. A read-only root filesystem combined with read-only volume mounts for specific configuration files enforces this least-privilege model. Other options either grant excessive privileges or break functionality by removing all capabilities.

Answer

Run the container as the root user to ensure it has permission to read the configuration files.

Answer

Run the container with the --privileged flag to ensure it has all necessary permissions.

Answer

Disable all Linux capabilities for the container to prevent any file access.

Question 6

A company is deploying a web application in a containerized environment. The security team wants to ensure that if an attacker compromises the application, they cannot escalate privileges to the host or other containers. Which of the following container security measures should be implemented?

Accepted Answer

Run containers as a non-root user and drop unnecessary Linux capabilities.. The most effective runtime control to prevent privilege escalation and container escape is to run containers with least privilege: as a non-root user and with unnecessary Linux capabilities dropped. This limits the impact of a compromise. Other measures like read-only filesystems or private registries add defense in depth but do not directly address privilege escalation.

Answer

Use a read-only root filesystem for the container.

Answer

Enable inter-container communication on the default bridge network.

Answer

Store container images in a private registry with vulnerability scanning.

Question 7

A financial services firm is migrating a customer-facing web application to a containerized platform. The security team wants to reduce the risk of a compromised container accessing the host kernel or other containers. Which of the following is the MOST effective control to limit the impact of a container breakout?

Accepted Answer

Enforcing a seccomp profile that allows only required system calls. Seccomp profiles constrain the system call interface exposed to container processes, directly shrinking the kernel attack surface an attacker can use to escape. Read-only filesystems, image scanning, and logging all add value at different stages but do not restrict runtime kernel interactions. Restricting syscalls is the most effective way to limit breakout impact on a shared host.

Answer

Scanning container images for known vulnerabilities before deployment

Answer

Enabling verbose logging of container stdout and stderr

Answer

Running containers with a read-only root filesystem

Question 8

A financial services firm must prove that an e-commerce application's source code has not been tampered with between the build pipeline and production deployment. The pipeline already stores build artifacts in an internal repository. Which control BEST provides this assurance?

Accepted Answer

Sign each build artifact with a key held by the CI/CD system and verify the signature before deployment.. Signing build artifacts in the pipeline and validating those signatures before deployment creates a cryptographic chain from the trusted build to production. If any byte changes in transit or at rest, verification fails. SBOMs, commit signing, and MFA improve visibility or access control but do not seal the artifact itself, so they cannot prove non-tampering.

Answer

Generate an SBOM in SPDX format and archive it alongside each release.

Answer

Enable multi-factor authentication for all engineers who have access to the artifact repository.

Answer

Require developers to sign Git commits with their personal GPG keys.

Question 9

A security analyst investigates a suspicious process on a Linux web server that is making outbound connections to an unknown IP address. The analyst wants to confirm which executable file is running and whether it has been modified since installation. Which combination of actions best accomplishes this?

Accepted Answer

Inspect the process's /proc//exe link and compare the file hash against a known-good baseline. Resolving the /proc//exe link identifies the exact executable behind the process, and hashing that file against a trusted baseline detects tampering. Used together, these steps confirm both the binary's identity and its integrity, which is what the investigation requires.

Answer

Check the process owner with the ps command and confirm it is not root

Answer

Run netstat to list the established outbound connection

Answer

Review the process's open file descriptors in /proc/<pid>/fd

Question 10

A financial services company runs a customer-facing mobile banking API on Linux containers. A penetration test reveals that when the API receives an oversized JSON payload, the application returns a stack trace containing internal file paths and database connection strings. The developer wants to prevent this information disclosure without changing the API's core business logic. Which control should the security practitioner recommend FIRST?

Accepted Answer

Configure the application to return generic error messages and log detailed exceptions server-side only.. The core issue is an information disclosure vulnerability caused by improper error handling. Returning generic messages to clients while logging details internally removes the sensitive data from the response path and preserves troubleshooting capability. WAFs and logging are useful compensating or detective controls, but they do not eliminate the root cause, which is the application revealing internal implementation details.

Answer

Deploy a web application firewall in blocking mode with signatures for known stack trace patterns.

Answer

Increase the maximum allowed request body size in the API gateway to reject oversized payloads.

Answer

Enable full verbose logging in the API and ship logs to a centralized SIEM for alerting.

Question 11

A security engineer is reviewing the configuration of a web application that uses JSON Web Tokens (JWT) for session management. The engineer notices that the application accepts tokens signed with the 'none' algorithm. Which of the following is the most critical security risk associated with this configuration?

Accepted Answer

Attackers can forge tokens with arbitrary claims, leading to privilege escalation.. Accepting the 'none' algorithm means the application does not verify the token's signature. An attacker can craft a token with any claims and set the algorithm to 'none', bypassing authentication and authorization. This is a critical vulnerability that can lead to full account takeover and privilege escalation.

Answer

Tokens will be transmitted in plaintext, exposing sensitive information.

Answer

Tokens will expire prematurely, causing denial of service for legitimate users.

Answer

The application will experience performance degradation due to lack of signature verification.

Question 12

A developer is building a mobile banking application and wants to ensure that if an attacker gains physical access to a rooted or jailbroken device, the application's sensitive data stored locally cannot be easily read. The developer decides to use the secure storage provided by the mobile operating system. Which of the following BEST describes the protection offered by this secure storage?

Accepted Answer

Data is encrypted with a hardware-backed key stored in a secure element or trusted execution environment.. Mobile operating systems provide secure storage such as iOS Keychain and Android Keystore, which encrypt data with hardware-backed keys stored in a secure element or trusted execution environment. This protects sensitive data even on rooted or jailbroken devices because the key cannot be easily extracted. Password-derived keys, obfuscation, and sandbox permissions do not provide equivalent protection against a privileged attacker.

Answer

Data is encrypted with a key derived from the user's login password, which is never stored on the device.

Answer

Data is stored in a hidden directory that is inaccessible to other applications due to sandbox permissions.

Answer

Data is obfuscated using a proprietary algorithm that changes with each application release to prevent reverse engineering.

Question 13

A security analyst is hardening a web application that stores user-uploaded images. The application currently writes uploads to a directory served directly by the web server. Which TWO controls BEST reduce the risk of a malicious upload leading to remote code execution? (Choose two.)

Accepted Answer

Validate the file's magic bytes and extension against an allowlist of permitted image formats.. Preventing upload-based remote code execution requires both validating that the content is genuinely an allowed image type and ensuring stored files can never be interpreted as executable code. Content inspection and an extension allowlist establish the first barrier, while storing files outside the web root with safe response headers removes the execution path entirely.

Answer

Log every upload event with the client IP address and user agent for later review.

Answer

Increase the PHP upload_max_filesize directive to accommodate large images.

Answer

Rename each uploaded file to a random UUID while keeping the original extension.

Question 14

A small business wants to protect data stored on employee laptops. The security policy requires that if a laptop is lost or stolen, the data on its disk cannot be read by anyone without the proper authentication. Which of the following should be implemented?

Accepted Answer

Full disk encryption. Full disk encryption ensures that data at rest is ciphertext and unreadable without the correct key or authentication, which is exactly the protection needed when a laptop is lost or stolen. The other controls address runtime monitoring, integrity, or network filtering and do not prevent offline disk reading. For portable devices, encryption is the foundational data-at-rest control.

Answer

A personal firewall

Answer

File integrity monitoring

Answer

A host-based intrusion detection system

Question 15

A healthcare organization stores protected health information on a database server. Auditors require that the data remain unreadable if the physical disk is stolen, and that encryption keys never reside on the same disk as the ciphertext. Which approach BEST satisfies these requirements?

Accepted Answer

Enable full disk encryption using a key stored in a hardware security module or external key manager.. The auditors require protection of data at rest plus separation of keys from ciphertext. Full disk encryption with keys held in an HSM or external key manager meets both conditions by ensuring a stolen disk yields only ciphertext and the key remains in a controlled, separate system. The other approaches either leave key material on the same disk or fail to provide equivalent protection.

Answer

Use file-level encryption on individual tablespaces with passwords stored in a local script.

Answer

Apply column-level encryption using a symmetric key embedded in the application configuration file.

Answer

Implement database transparent data encryption with keys managed by the database instance on the same volume.