SSCP Systems and Application Security Practice Test 5 — 15 Questions

Question 1

A company deploys a web application that processes credit card payments. The development team uses parameterized queries for all database interactions. However, during a penetration test, the tester successfully injects malicious code into a search field and retrieves sensitive customer data. Which of the following is the most likely cause?

Accepted Answer

The application uses dynamic SQL despite parameterized queries for some fields.. Option A is correct because the use of parameterized queries prevents SQL injection, but if dynamic SQL is constructed elsewhere in the application (e.g., for the search field), it can still be vulnerable. Option B is incorrect because XSS affects client-side execution, not direct data retrieval from the database. Option C is incorrect because direct query execution would require explicit permissions beyond the application's context. Option D is incorrect because directory traversal exploits file system access, not database query injection.

Answer

The web server is misconfigured to allow directory traversal.

Answer

The database server has weak permissions allowing direct query execution.

Answer

The search field output is not sanitized, allowing stored XSS.

Question 2

An organization uses a cloud-based file synchronization service to share project files with external partners. The security team discovers that an unauthorized third party accessed sensitive documents by guessing weak passwords. Which additional control would most effectively mitigate this risk?

Accepted Answer

Enforcing multi-factor authentication for all external users.. Option B is correct because multi-factor authentication directly addresses credential guessing by requiring a second factor. Option A is incorrect because file-level encryption with on-premises keys does not prevent unauthorized access if the attacker already has valid credentials. Option C is incorrect because SFTP does not inherently provide stronger authentication than HTTPS. Option D is incorrect because a custom domain certificate does not affect authentication strength.

Answer

Requiring all file transfers to use SFTP instead of HTTPS.

Answer

Implementing file-level encryption with keys stored on-premises.

Answer

Configuring the service to use a custom domain certificate.

Question 3

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

Accepted Answer

The web application firewall is blocking legitimate traffic.. Option C is correct because a 403 Forbidden error typically indicates that the web application firewall (WAF) is blocking requests, often due to false positives. Option A is incorrect because an IP change would result in connection errors, not HTTP 403. Option B is incorrect because a database connection pool exhaustion would cause 500-type errors. Option D is incorrect because an expired SSL certificate would cause SSL handshake errors, not 403.

Answer

The SSL certificate has expired.

Answer

The application's database connection pool is exhausted.

Answer

The web server's IP address has changed.

Question 4

A security analyst needs to ensure that a legacy application running on an unsupported operating system remains secure until it can be replaced. Which strategy provides the most effective risk reduction?

Accepted Answer

Move the application to a sandboxed virtual machine and isolate it from the network.. Option D is correct because isolating the application in a sandboxed virtual machine with network restrictions minimizes the attack surface. Option A is incorrect because application whitelisting does not protect against OS-level vulnerabilities. Option B is incorrect because upgrading the application is not feasible if it runs on an unsupported OS. Option C is incorrect because third-party patches may introduce instability or conflicts.

Answer

Apply all available security patches from third-party sources.

Answer

Upgrade the application to the latest version with vendor support.

Answer

Implement application whitelisting to allow only approved executables.

Question 5

Which TWO of the following are effective measures to prevent cross-site scripting (XSS) vulnerabilities in a web application?

Accepted Answer

Implement a Content Security Policy (CSP).. Options B and C are correct because output encoding prevents XSS by neutralizing script payloads, and Content Security Policy (CSP) provides a browser-level defense that restricts script execution. Option A is incorrect because HTTPS only encrypts data in transit, not preventing XSS. Option D is incorrect because WAFs can block some XSS attempts but are not a prevention measure at the application level. Option E is incorrect because HTTP method does not affect XSS.

Answer

Use a web application firewall (WAF) to block known XSS payloads.

Answer

Replace GET requests with POST for all form submissions.

Answer

Use HTTPS for all communications.

Question 6

Which THREE of the following are best practices for securely managing cryptographic keys in an enterprise environment?

Accepted Answer

Implement key escrow to allow recovery of encrypted data.. Options A, C, and E are correct. HSMs provide tamper-resistant key storage. Key rotation limits exposure from compromised keys. Key escrow allows recovery when keys are lost. Option B is incorrect because email is not a secure channel for key distribution. Option D is incorrect because using the same key for multiple purposes (e.g., encryption and signing) violates key separation principles.

Answer

Use the same key for encryption and decryption (symmetric) and also for signing.

Answer

Share keys via email encrypted with the recipient's public key.

Question 7

Which TWO of the following are common indicators of a ransomware attack?

Accepted Answer

Files with .encrypted extension appearing in directories.. Options B and D are correct. Encrypted files with a new extension and the presence of a ransom note are classic signs of ransomware. Option A is incorrect because unusual outbound traffic may indicate command-and-control communication but is not specific to ransomware. Option C is incorrect because failed login attempts suggest brute-force, not ransomware. Option E is incorrect because network latency typically increases during an attack, not decreases.

Answer

Unusual outbound network traffic to unknown IPs.

Answer

Decreased network latency.

Answer

System log entries showing failed login attempts.

Question 8

A company runs a critical web application on an internal server that authenticates users against a Microsoft SQL Server database. The application was developed by a vendor that is no longer in business, and the source code is unavailable. The current authentication process stores user passwords using reversible encryption. The security team has identified this as a high-risk vulnerability. They propose implementing a database-level trigger that hashes the password column during INSERT and UPDATE operations, and modifying the application's stored procedures to compare hashed values during login. However, after implementation, users report that they cannot log in. The authentication logs show that the password comparison always fails. The database administrator confirms that the trigger is working and that new user registrations store the SHA-256 hash. What is the most likely cause of the login failures?

Accepted Answer

The stored procedure for login is still comparing the plain-text password with the hash.. Option C is correct because the stored procedure for login likely still expects a plain-text password and compares it directly to the stored hash, causing failure. Option A is incorrect because the trigger should fire on all updates, including those by the same user. Option B is incorrect because the trigger uses SHA-256 and the stored procedure should use the same algorithm. Option D is incorrect because the trigger should be defined on the password column.

Answer

The trigger does not hash the password during UPDATE operations that are performed by the same user.

Answer

The application is using a different hashing algorithm than the trigger.

Answer

The trigger hashes the password only if the password column is part of a specific set of columns.

Question 9

An organization uses a central syslog server to collect logs from firewalls, servers, and network devices. Recently, the security team noticed that some critical events from the firewall are missing from the syslog server. The firewall configuration sends syslog messages using UDP to the syslog server. The syslog server administrator reports that the server is receiving a high volume of logs and occasionally drops packets due to buffer overflow. The team needs to ensure reliable delivery of all syslog messages without losing any. Which solution should the team implement?

Accepted Answer

Switch to TCP-based syslog with TLS.. Option B is correct because switching to TCP-based syslog with TLS provides reliable, connection-oriented delivery with encryption. Option A is incorrect because increasing the UDP buffer may reduce drops but does not guarantee reliability. Option C is incorrect because log aggregation at each segment does not address the transport reliability issue. Option D is incorrect because a load balancer would distribute load but not prevent UDP packet loss.

Answer

Increase the UDP buffer size on the syslog server.

Answer

Implement log aggregation at each network segment.

Answer

Use a load balancer for syslog receivers.

Question 10

A small business uses a single Windows Server 2016 machine that also acts as a domain controller, file server, and runs a custom application for inventory management. The server recently exhibited slow performance and frequent crashes. The system administrator runs antivirus and finds no malware. The event log shows several 'Event ID 7000' errors from the Service Control Manager, indicating certain services failed to start. The administrator also notices that the server has not been restarted in 180 days and has several pending updates. What is the most likely cause of the performance issues?

Accepted Answer

The server has not been restarted for an extended period and has pending updates.. Option D is correct because pending updates often include bug fixes and performance improvements; the lack of restarts may lead to memory leaks or resource exhaustion. Option A is incorrect because there is no indication of resource exhaustion from a specific service. Option B is incorrect because the antivirus found no malware. Option C is incorrect because a fragmented hard drive would not cause service start failures.

Answer

A rootkit infection that the antivirus failed to detect.

Answer

A heavily fragmented hard drive.

Answer

A memory leak in the custom application.

Question 11

A healthcare organization uses an electronic health records (EHR) system that stores patient data in a relational database. The system is accessed by doctors and nurses via tablet devices on a wireless network. The security team has detected that some patient records were accessed outside of normal business hours from an IP address not belonging to the organization. The database logs show that the queries originated from the application server. The application logs indicate that the access was performed using a legitimate user account that had been disabled due to employee departure two weeks earlier. Which of the following is the most effective step to prevent recurrence?

Accepted Answer

Implement a process to disable user accounts within one hour of employee termination.. Option A is correct because disabling the account should have been immediate upon employee departure; this is a failure of the account management process. Option B is incorrect while useful, does not address the root cause of the account still being active. Option C is incorrect because network segmentation would not prevent use of a valid account. Option D is incorrect because MFA helps but if the account is still active, the attacker could have bypassed MFA if not enforced.

Answer

Require multi-factor authentication for all remote access.

Answer

Enable audit logging on all database transactions.

Answer

Segregate the wireless network from the internal network.

Question 12

A financial services organization deploys a new web application that allows customers to check account balances and transfer funds. The application uses a RESTful API with JSON payloads. Shortly after deployment, the security team notices unusual traffic patterns: many requests contain excessively long JSON strings in the 'amount' field, and some of these requests return 500 Internal Server Errors. The application logs show that these requests cause high CPU usage on the application server. The developers confirm that the input validation only checks for negative numbers and characters. Which type of attack is most likely occurring, and what is the best immediate mitigation?

Accepted Answer

The attack is a Denial of Service using large payloads; implement input size limits and validation.. Option B is correct because the symptoms indicate a Denial of Service attack via large payloads that consume server resources. Input validation should reject oversized inputs. Option A is incorrect because brute force would not cause high CPU from large payloads. Option C is incorrect because SQL injection would likely return specific error messages rather than 500s from CPU exhaustion. Option D is incorrect because XSS targets browser execution, not server CPU.

Answer

The attack is a brute-force attempt on the amount field; implement rate limiting.

Answer

The attack is cross-site scripting; sanitize output.

Answer

The attack is SQL injection; use parameterized queries.

Question 13

A university IT department manages a lab of 50 computers running Windows 10 that are used by students for coursework. The computers are joined to a domain and have Group Policy applied to restrict administrative access. Recently, several students were able to install unauthorized software by using the built-in Administrator account, which had the same password on all lab computers. The IT department wants to prevent this without affecting the students' ability to run required academic software. Which of the following is the most effective solution?

Accepted Answer

Use a tool to assign a unique, random password to the local Administrator account on each computer.. Option C is correct because changing the local Administrator password to a unique, complex value for each machine prevents lateral movement and unauthorized use. Option A is incorrect because disabling the account might break functionality if it's relied upon. Option B is incorrect because while SRP helps, it does not prevent use of the Administrator account. Option D is incorrect because standard user accounts do not have installation rights, but if students know the Admin password, they can still use it.

Answer

Configure the computers to only allow standard user accounts.

Answer

Disable the local Administrator account on all lab computers.

Answer

Implement Software Restriction Policies to block unauthorized executables.

Question 14

Which TWO of the following are effective measures to prevent buffer overflow attacks in a custom-developed application?

Accepted Answer

Input validation. Input validation helps ensure data fits within buffer limits, and stack canaries detect and prevent stack-based buffer overflows. Using unpatched libraries increases vulnerability; disabling ASLR makes exploitation easier; running with least privilege limits damage but does not prevent the overflow itself.

Answer

Using unpatched third-party libraries

Answer

Running the application with least privilege

Answer

Disabling ASLR

Question 15

Refer to the exhibit. A security administrator is troubleshooting connectivity to a web server. Users report they can access the website via HTTP and HTTPS, but cannot establish new SSH connections. Which of the following best explains this issue?

Accepted Answer

The firewall is configured to drop new SSH connections, which prevents users from initiating new SSH sessions.. The firewall rule drops all new TCP connections to port 22 (SSH) using the state NEW module. Established SSH sessions, if any, would still be allowed, but new connections are blocked. Option A is incorrect because the rule does not block all traffic on port 22, only new connections. Option B is a partial statement but does not capture the state-based filtering. Option D is incorrect because the INPUT chain policy is ACCEPT, but the drop rule overrides for new SSH traffic.

Answer

The firewall is dropping SSH connections only when they are new, but established sessions may still be allowed.

Answer

The firewall policy is set to ACCEPT on the INPUT chain, so SSH should work.

Answer

The firewall is blocking all incoming traffic on port 22.