SSCP Systems and Application Security Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Question 2

Match each cryptography term to its definition.

Question 3

Match each security control to its type (administrative, technical, physical).

Question 4

A software development team is implementing input validation for a web application that accepts user email addresses. Which approach BEST prevents email injection attacks?

Accepted Answer

Whitelist allowed characters: alphanumeric, @, ., -, _. Option C is correct because whitelisting valid characters (alphanumeric, @, ., -, _) restricts input to safe characters, preventing injection of special characters used in email injection. Option A is wrong because blacklisting known malicious patterns is easily bypassed. Option B is wrong because client-side validation only is insufficient as it can be bypassed. Option D is wrong because length limits do not prevent injection.

Answer

Blacklist known malicious email patterns

Answer

Set maximum email length to 100 characters

Answer

Rely on client-side JavaScript validation only

Question 5

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

Accepted Answer

Implement application whitelisting. Option B is correct because application whitelisting blocks unauthorized executables, including ransomware, from running. Option A is wrong because email filtering can reduce but not block all ransomware delivery. Option C is wrong because user training is important but not a technical control that immediately prevents execution. Option D is wrong because backups help recovery but do not prevent infection.

Answer

Deploy email spam filtering

Answer

Conduct user security awareness training

Answer

Enable file-level backup to a separate location

Question 6

A company runs containerized applications in a Kubernetes cluster. They need to ensure that containers run with the least privilege and cannot escalate privileges. Which configuration change is MOST effective?

Accepted Answer

Mount the container root filesystem as read-only. Option D is correct because setting a read-only root filesystem prevents container from writing to its own filesystem, limiting damage from compromise. Option A is wrong because running as non-root is important but does not prevent privilege escalation if capabilities allow. Option B is wrong because dropping all capabilities reduces risk but does not prevent writes to root filesystem. Option C is wrong because SELinux enforcing mode adds a layer but is not directly about privilege escalation in containers.

Answer

Set the container to run as non-root user

Answer

Drop all Linux capabilities from the container

Answer

Enable SELinux enforcing mode on the host

Question 7

A database administrator notices unusual queries that seem to be trying to extract data via SQL injection. The application uses parameterized queries for most queries, but some dynamic queries are built using string concatenation. What is the BEST remediation?

Accepted Answer

Rewrite all dynamic queries to use parameterized queries. Option A is correct because converting all dynamic queries to use parameterized queries eliminates the possibility of SQL injection. Option B is wrong because input validation alone is insufficient if concatenation is used. Option C is wrong because WAF is a detection/blocking control but not a code-level fix. Option D is wrong because least privilege reduces impact but does not prevent injection.

Answer

Restrict database user permissions to only necessary tables

Answer

Implement strict input validation for all user inputs

Answer

Deploy a web application firewall (WAF) in front of the application

Question 8

An IT administrator needs to ensure that all workstations receive security patches in a timely manner. Which process is MOST effective for this?

Accepted Answer

Deploy a centralized patch management solution. Option C is correct because a centralized patch management system automates deployment and reporting. Option A is wrong because automatic updates from vendor can be unreliable and may not be centrally reported. Option B is wrong because manual patching is error-prone and not scalable. Option D is wrong because using older OS versions is insecure and against best practice.

Answer

Use only operating systems that no longer require security patches

Answer

Assign a technician to manually patch each workstation monthly

Answer

Enable automatic updates on each workstation from the vendor

Question 9

A company uses a Cloud Workload Protection Platform (CWPP) to secure IaaS workloads. They discover that a virtual machine (VM) is communicating with a known command-and-control server. What is the FIRST action the security team should take?

Accepted Answer

Immediately isolate the VM by removing it from the network. Option B is correct because isolating the VM stops the malicious communication and prevents further spread. Option A is wrong because the infection is already active; waiting for analysis allows more damage. Option C is wrong because terminating the VM may be too aggressive and could cause data loss without investigation. Option D is wrong because scanning does not stop ongoing communication.

Answer

Run an antivirus scan on the VM to remove the malware

Answer

Terminate the VM and create a new one from a clean image

Answer

Analyze the traffic logs to determine the scope of the compromise

Question 10

An organization allows employees to use personal smartphones to access corporate email and data. Which control is MOST important to protect corporate data if a device is lost or stolen?

Accepted Answer

Implement remote wipe capability. Option D is correct because remote wipe can erase corporate data from a lost device. Option A is wrong because encryption protects data at rest but does not prevent access if device is unlocked. Option B is wrong because screen lock can be bypassed with brute force. Option C is wrong because strong passwords help but if device is already compromised, remote wipe is the best response.

Answer

Require device encryption

Answer

Require strong passwords with complexity requirements

Answer

Enforce a screen lock timeout of 1 minute

Question 11

A small business needs basic protection against malware. Which solution is MOST cost-effective and provides real-time protection?

Accepted Answer

Deploy an endpoint protection platform (EPP). Option C is correct because endpoint protection platforms (EPP) provide antivirus, anti-malware, and often additional features like firewall and web protection. Option A is wrong because host-based firewalls alone do not protect against malware. Option B is wrong because periodic scans miss threats between scans. Option D is wrong because email encryption does not protect against malware delivered via other vectors.

Answer

Schedule weekly antivirus scans

Answer

Install a host-based firewall on each computer

Answer

Use email encryption for all communications

Question 12

A DevOps team implements a CI/CD pipeline for a web application. Which security control is BEST to ensure that only properly reviewed code reaches production?

Accepted Answer

Require a manual approval gate before deployment. Option B is correct because requiring manual approval in the pipeline ensures a human has reviewed the code before it proceeds. Option A is wrong because automated tests are important but may miss logic flaws. Option C is wrong because code signing ensures integrity but not review. Option D is wrong because static analysis is automated and may produce false positives; it does not replace human review.

Answer

Run static application security testing (SAST) in the pipeline

Answer

Run automated unit tests and integration tests

Answer

Implement code signing for all artifacts

Question 13

Which TWO of the following are essential components of a secure configuration baseline for a new server deployment?

Accepted Answer

Disable all unnecessary services and ports. Options B and D are correct. Disabling unused services reduces attack surface, and applying the latest patches closes known vulnerabilities. Option A is wrong because default passwords are insecure and should be changed. Option C is wrong because logging can be disabled but it is often needed for monitoring; keeping logs is generally recommended. Option E is wrong because using a single password for all accounts violates least privilege.

Answer

Enable only error logging, not audit logging

Answer

Assign the same strong password to all local accounts

Answer

Use default passwords for all service accounts

Question 14

Which THREE of the following are types of application security testing that should be included in a secure SDLC?

Accepted Answer

Static application security testing (SAST). Options A, C, and E are correct. SAST (Static Application Security Testing) analyzes source code, DAST (Dynamic Application Security Testing) tests running applications, and penetration testing simulates real attacks. Option B is wrong because UAT is for functional validation, not security. Option D is wrong because load testing is for performance, not security.

Answer

User acceptance testing (UAT)

Answer

Load testing

Question 15

Which THREE of the following are data loss prevention (DLP) controls that can be implemented to protect sensitive data?

Accepted Answer

Encrypt sensitive data both at rest and in transit. Options A, D, and E are correct. Data classification labels guide handling, encryption protects data in transit/rest, and endpoint DLP agents can block unauthorized transfers. Option B is wrong because firewalls control network traffic but do not inspect data content. Option C is wrong because strong passwords are authentication, not data loss prevention.

Answer

Require strong passwords for all user accounts

Answer

Implement network firewalls to block all outbound traffic