SSCP Systems and Application Security — Timed 10 Questions

Question 1

During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?

Accepted Answer

Disable Telnet and FTP services, and apply all critical security patches.. System hardening involves removing unnecessary services, applying patches, and following benchmarks like CIS or DISA STIGs. Disabling Telnet and FTP and applying all critical patches directly addresses the discovered issues.

Answer

Move the server to a more secure network segment and implement network access controls.

Answer

Enable SELinux and configure a host-based firewall using iptables.

Answer

Install a host-based intrusion detection system (HIDS) to monitor for attacks.

Question 2

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) and AppLocker are used for application whitelisting. WDAC provides more robust control.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 3

A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?

Accepted Answer

Enable and configure auditd with rules to capture login events. The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.

Answer

Use PAM to log authentication events to /var/log/secure

Answer

Set up SELinux to audit login attempts

Answer

Configure syslog to monitor /var/log/auth.log

Question 4

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 5

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks exploit vulnerabilities in the hypervisor. Keeping the hypervisor patched and disabling unnecessary VM guest tools reduces attack surface.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 6

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. The chmod command changes file permissions. The octal mode 600 sets read/write for owner, no permissions for group and others.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 7

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating user input into SQL queries allows injection attacks. Injection is a top vulnerability.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 8

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 9

A Windows system administrator needs to enforce a security policy that prevents users from installing unauthorized software. Which feature should be configured via Group Policy?

Accepted Answer

AppLocker. AppLocker can be configured via Group Policy to allow or deny applications based on rules, preventing unauthorized software installation.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 10

Which of the following is a primary security concern when using VM snapshots in a virtualized environment?

Accepted Answer

Snapshots may contain unpatched vulnerabilities if not regularly updated. VM snapshots capture the state at a point in time. If the snapshot is not updated with patches, reverting to it can reintroduce vulnerabilities that were previously fixed.

Answer

Snapshots can be used to bypass authentication

Answer

Snapshots can be exported and stolen

Answer

Snapshots consume excessive storage space