SSCP Systems and Application Security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?

Accepted Answer

Default outbound connections are set to Allow, potentially allowing malware to communicate out. Option B is correct because Remote Desktop (TCP-In) rule is disabled (Enabled: No), so RDP is not allowed in, which might be intended but the issue is that the rule 'RDP (UDP-In)' is set to Block and Enabled: Yes, which blocks UDP RDP traffic. However, the question asks for 'most significant weakness'. The configuration shows inbound connections are blocked by default, but the RDP (UDP-In) rule is blocking UDP RDP. This could be a problem if RDP is needed. But option B points out that the rule for UDP RDP is blocking, which might block legitimate traffic if RDP uses UDP. Actually, the exhibit shows 'RDP (UDP-In) Block Yes' meaning it is blocking UDP RDP. Option A is incorrect because the default inbound is block, which is good. Option C is correct? Wait, let's analyze: The weakness is that outbound connections are allowed by default, which is typical but could be a weakness if not controlled. Option D is incorrect because File and Printer Sharing rule is disabled, which is good for security. The most significant weakness is allowing all outbound connections by default, which could allow malware to communicate out. Option C says 'Default outbound connections are set to Allow, potentially allowing malware to communicate out.' That is a common weakness. Option B is also plausible but blocking UDP RDP might be intentional. However, many organizations block UDP RDP to prevent vulnerabilities. But outbound allow is a bigger concern. So I'll go with C. But to align with typical exam, outbound allow default is a common weakness. So option C is correct.

Answer

Inbound connections are set to Block by default

Answer

The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic

Answer

The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery

Question 2

Refer to the exhibit. A web server log shows two requests from the same IP. What type of attack is being attempted, and which mitigation is MOST effective?

Accepted Answer

SQL injection; use parameterized queries. Option A is correct because the requests contain SQL injection patterns (OR 1=1 and DROP TABLE). Parameterized queries prevent SQL injection. Option B is wrong because XSS would involve script tags. Option C is wrong because command injection would involve shell commands. Option D is wrong because CSRF would involve a different method and referrer.

Answer

Cross-site scripting (XSS); encode all output

Answer

Cross-site request forgery (CSRF); use anti-CSRF tokens

Answer

Command injection; implement input validation

Question 3

Refer to the exhibit. An AWS S3 bucket policy is defined as shown. Which statement about this policy is TRUE?

Accepted Answer

Any user can read objects in the company-public bucket. Option B is correct because the first statement allows anyone to read objects in the company-public bucket. Option A is wrong because the policy does not affect other buckets. Option C is wrong because the company-public bucket is explicitly allowed for GetObject. Option D is wrong because the Deny statement is effective, but it only denies access to company-private bucket, not company-public.

Answer

The company-public bucket objects are completely private

Answer

The Deny statement prevents all access to both buckets

Answer

The policy applies to all buckets in the account

Question 4

A company wants to prevent unauthorized applications from running on employee workstations. Which of the following is the most effective control?

Accepted Answer

Application whitelisting. Application whitelisting allows only approved executables to run, effectively preventing unauthorized applications. Host-based intrusion detection can detect but not prevent. Antivirus relies on signatures and may miss unknown malware. User training is important but not a technical control.

Answer

User training

Answer

Regular antivirus updates

Answer

Host-based intrusion detection system

Question 5

A web application processes user-supplied data in SQL queries. Which practice best prevents SQL injection?

Accepted Answer

Parameterized queries. Parameterized queries (also known as prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:name` in PDO). The database engine treats the user input strictly as data, never as executable SQL code, which inherently prevents SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Input length validation

Question 6

An organization experiences malware that injects code into legitimate processes. Which security feature should be enabled to prevent code execution in memory pages?

Accepted Answer

Data Execution Prevention (DEP). Data Execution Prevention (DEP) is a hardware and software security feature that marks memory pages as non-executable unless they explicitly contain executable code. By preventing code execution in data-only memory regions (such as the heap and stack), DEP stops malware that attempts to inject and run shellcode within legitimate processes, even if the process is compromised.

Answer

Encrypted File System (EFS)

Answer

Address Space Layout Randomization (ASLR)

Answer

Mandatory Access Control (MAC)

Question 7

A critical vulnerability is discovered in an application currently in use. What should be done first?

Accepted Answer

Test the patch in a non-production environment. Testing the patch in a non-production environment ensures it does not break functionality before deployment. Immediate deployment risks downtime. Disabling the application or notifying users are reactive steps, not the first.

Answer

Notify users to stop using the application

Answer

Disable the application until patch is ready

Answer

Deploy the patch immediately to all systems

Question 8

A company uses virtual machines for development. To ensure isolation between VMs on the same host, which control is most important?

Accepted Answer

Virtual network segmentation. Virtual network segmentation prevents VM-to-VM attacks by isolating traffic. Hypervisor patching is important for security but does not directly provide isolation. Strong passwords protect console access but not network traffic. Antivirus protects within each VM but not between them.

Answer

Antivirus on each VM

Answer

Hypervisor patching

Answer

Strong passwords for VM consoles

Question 9

A BYOD policy allows personal devices to access corporate email. What is the best control to enforce device encryption and remote wipe?

Accepted Answer

Mobile Device Management (MDM) profile. Mobile Device Management (MDM) can enforce encryption and remote wipe policies. VPN encrypts data in transit but not the device. Containerization isolates corporate data but may not enforce full device encryption. NAC controls network access, not device settings.

Answer

Network Access Control (NAC)

Answer

Containerization app

Answer

Mandatory VPN connection

Question 10

An employee receives an email with an attachment claiming to be an invoice but contains a macro virus. What control would have blocked this?

Accepted Answer

Macro security settings in Office. Macro security settings in Office can disable macros or require signed macros, preventing execution. Spam filter may not detect targeted phishing. Attachment scanning may miss zero-day variants. User training reduces risk but does not technically block.

Answer

User awareness training

Answer

Email attachment scanning

Answer

Spam filter

Question 11

An organization uses AWS IAM to manage access. Which best practice ensures least privilege?

Accepted Answer

Create individual users and assign only necessary permissions. Creating individual users with only necessary permissions enforces least privilege. Using root account is dangerous. Shared accounts violate accountability. Granting full S3 access is excessive.

Answer

Use a single shared admin account

Answer

Use root account for administrative tasks

Answer

Grant all users full access to S3 buckets

Question 12

During a code review, you discover that an application stores passwords in plaintext. What is the most secure remediation?

Accepted Answer

Use bcrypt with a unique salt per password. Bcrypt with a unique salt is designed for password storage; it is slow and resistant to brute force. MD5 is fast and weak. AES encryption is reversible if the key is compromised. Database access control does not protect if the database is breached.

Answer

Hash passwords with MD5

Answer

Use AES encryption of passwords

Answer

Store passwords in a database with restricted access

Question 13

Refer to the exhibit. A security analyst reviews a Windows Security event log entry showing multiple logon failures for user 'admin' from IP 10.0.0.100 within 5 minutes. What type of attack is most likely occurring?

Accepted Answer

Brute force attack. Multiple logon failures from a single IP indicate a brute force attack. Pass-the-hash uses captured hashes, not repeated failures. Kerberos ticket replay is different. Privilege escalation is not indicated.

Answer

Kerberos ticket replay

Answer

Pass-the-hash attack

Answer

Privilege escalation

Question 14

Refer to the exhibit. A firewall log shows repeated outbound connection attempts from an internal workstation (192.168.1.50) to an external IP (203.0.113.50) on TCP port 445. What is the most likely cause?

Accepted Answer

A worm or malware exploiting SMB. Port 445 is SMB. Outbound SMB attempts often indicate a worm or malware trying to propagate. Web browsing uses 80/443. File sharing is typically internal. DNS uses 53.

Answer

A misconfigured DNS client

Answer

A user browsing the web

Answer

A legitimate file share connection

Question 15

Refer to the exhibit. An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': ['s3:ListBucket','s3:GetObject'], 'Resource': 'arn:aws:s3:::example-bucket/*'. What does this policy allow?

Accepted Answer

List objects and read objects in example-bucket. ListBucket allows listing objects, GetObject allows reading objects. It does not allow write or delete. The resource is specific to example-bucket.

Answer

Full access to all S3 buckets

Answer

Delete objects from example-bucket

Answer

Write objects to example-bucket

SSCP Systems and Application Security Practice Test 3 — 15 Questions

Exhibit

SSCP Systems and Application Security Practice Test 3 — 15 Questions

Exhibit