SSCP Systems and Application Security — Timed 20 Questions

Question 1

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

Accepted Answer

Rewrite the legacy module to use parameterized queries.. Option B is correct because parameterized queries (prepared statements) are the definitive defense against SQL injection, as they separate SQL logic from user data by design. Rewriting the legacy module to use parameterized queries eliminates the root cause of the vulnerability at the code level, ensuring that user input is never concatenated into the SQL statement. This is the most secure and permanent fix, as it directly addresses the injection point in the application layer.

Answer

Disable the legacy module until a full rewrite is completed.

Answer

Deploy a web application firewall (WAF) to block SQL injection patterns.

Answer

Implement input validation to reject special characters.

Question 2

An organization is implementing a jump server architecture for managing critical servers. Which additional control BEST reduces the risk of lateral movement if the jump server is compromised?

Accepted Answer

Implement SSH key-based authentication with agent forwarding restricted to specific target hosts.. Option C is correct because restricting SSH agent forwarding to specific target hosts prevents an attacker who compromises the jump server from using forwarded credentials to authenticate to arbitrary internal systems. This containment limits lateral movement by ensuring that even if the jump server is breached, the attacker cannot reuse SSH keys to pivot to non-approved targets.

Answer

Enable verbose logging on all target servers.

Answer

Require multi-factor authentication for all jump server logins.

Answer

Use a separate VLAN for management traffic.

Question 3

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

Accepted Answer

Encrypt all sensitive data stored on the device using a key derived from the user's passcode.. Option C is correct because encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.

Answer

Require a strong screen lock passcode.

Answer

Disable cloud backups for the app.

Answer

Use app sandboxing to isolate app data from other apps.

Question 4

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Accepted Answer

The application passes user input to a shell command via exec() or system() functions.. Option C is correct because the scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Answer

The application uses unsanitized input in SQL queries.

Answer

The application reflects user input in HTTP responses without escaping.

Answer

The application uses hidden form fields to store session tokens.

Question 5

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Accepted Answer

Mount the /tmp and /var partitions with the 'nosuid' option.. Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.

Answer

Enable auditd to log all SUID executions.

Answer

Set the umask to 077 for all users.

Answer

Remove all SUID binaries from the system.

Question 6

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Accepted Answer

Ensure all data transmissions use TLS 1.2 or higher.. TLS 1.2 or higher is the standard protocol for encrypting data in transit over public networks, ensuring confidentiality and integrity between client and server. It is the most critical control because it directly protects data as it moves across the internet to the cloud, which is the primary risk in a migration scenario.

Answer

Enable server-side encryption for cloud storage.

Answer

Implement data classification labels.

Answer

Use IPsec VPNs for all cloud connections.

Question 7

A security analyst reviews logs and finds that an attacker exploited a vulnerability in a web application to read arbitrary files from the server. The application runs on Apache with mod_php. Which of the following is the MOST likely vulnerability?

Accepted Answer

Local File Inclusion (LFI) vulnerability in a PHP include statement.. The correct answer is D because the scenario describes reading arbitrary files from the server, which is the hallmark of a Local File Inclusion (LFI) vulnerability. In a PHP application using include statements, an attacker can manipulate a file path parameter (e.g., `?page=../../etc/passwd`) to include and read local files, exploiting the server's filesystem access. Apache with mod_php is particularly susceptible to LFI when user input is not sanitized before being passed to functions like `include()` or `require()`.

Answer

XML External Entity (XXE) vulnerability.

Answer

Remote File Inclusion (RFI) vulnerability.

Answer

Server-Side Request Forgery (SSRF) vulnerability.

Question 8

An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?

Accepted Answer

Perform threat modeling to identify potential attack vectors.. Threat modeling is a proactive security activity performed during the design phase to identify potential attack vectors, trust boundaries, and threats before any code is written. By analyzing the system architecture and data flows, teams can mitigate security flaws early, reducing the cost and effort of fixing vulnerabilities later in the SDLC.

Answer

Run dynamic application security testing (DAST) tools.

Answer

Apply security patches to the development environment.

Answer

Conduct a code review for security vulnerabilities.

Question 9

Which TWO of the following are effective controls to prevent buffer overflow attacks? (Choose two.)

Accepted Answer

Address Space Layout Randomization (ASLR). Address Space Layout Randomization (ASLR) is a memory protection technique that randomizes the base addresses of executable modules, heap, and stack regions. This makes it significantly harder for an attacker to predict the memory addresses needed to inject and execute shellcode, thereby mitigating many buffer overflow exploits that rely on fixed address references.

Answer

Input validation to reject long inputs

Answer

Code obfuscation

Answer

Stack canaries

Question 10

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Accepted Answer

JavaScript execution in the browser's developer console that was not initiated by the user. Option B is correct because XSS attacks often inject malicious JavaScript that executes in the victim's browser without user initiation. Observing unexpected script execution in the developer console indicates that an attacker's payload has run, which is a direct sign of a successful XSS exploit.

Answer

Unusual cookie values or multiple cookies

Answer

Unusual network traffic to external IP addresses

Question 11

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Accepted Answer

Disable SSID broadcast. Disabling SSID broadcast prevents the access point from including the network name in beacon frames, making the network less visible to casual scanning tools. However, it is not a security measure because the SSID is still transmitted in probe requests and responses, and can be easily discovered using packet capture tools like Wireshark or airodump-ng. It is considered a best practice only as a minor obscurity layer, not a replacement for strong encryption.

Answer

Set a short, simple pre-shared key for convenience

Answer

Use WEP encryption

Answer

Enable MAC address filtering

Question 12

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is a valid method for authenticating users in a web application because it is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables single sign-on (SSO) by allowing the SP to trust the IdP's assertion of the user's identity, making it a widely adopted federated authentication protocol.

Answer

IP address whitelisting

Answer

LDAP

Question 13

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

Accepted Answer

Authentication bypass via SQL injection.. The payload shown is a classic SQL injection attempt, specifically targeting authentication logic by injecting a tautology (e.g., ' OR '1'='1) into a login field. If the web application is vulnerable, this bypasses authentication by making the SQL query always return true, granting unauthorized access without valid credentials.

Answer

Directory traversal to read sensitive files.

Answer

Remote code execution on the web server.

Answer

Cross-site scripting (XSS) attack leading to session theft.

Question 14

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Accepted Answer

A malicious macro in a Word document executed the command.. The event shows a command prompt launching with a base64-encoded PowerShell command, which is a common technique used by malicious macros to download and execute payloads. Microsoft Office macros can invoke cmd.exe or PowerShell to bypass security controls, and the encoded command suggests obfuscation typical of malware, not legitimate software updates or user actions.

Answer

Microsoft Office is performing an automatic update.

Answer

A scheduled task triggered the command.

Answer

A user ran a legitimate command from the Start menu.

Question 15

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Question 16

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Question 17

Match each cryptography term to its definition.

Question 18

Match each security control to its type (administrative, technical, physical).

Question 19

A software development team is implementing input validation for a web application that accepts user email addresses. Which approach BEST prevents email injection attacks?

Accepted Answer

Whitelist allowed characters: alphanumeric, @, ., -, _. Option C is correct because whitelisting valid characters (alphanumeric, @, ., -, _) restricts input to safe characters, preventing injection of special characters used in email injection. Option A is wrong because blacklisting known malicious patterns is easily bypassed. Option B is wrong because client-side validation only is insufficient as it can be bypassed. Option D is wrong because length limits do not prevent injection.

Answer

Blacklist known malicious email patterns

Answer

Set maximum email length to 100 characters

Answer

Rely on client-side JavaScript validation only

Question 20

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

Accepted Answer

Implement application whitelisting. Option B is correct because application whitelisting blocks unauthorized executables, including ransomware, from running. Option A is wrong because email filtering can reduce but not block all ransomware delivery. Option C is wrong because user training is important but not a technical control that immediately prevents execution. Option D is wrong because backups help recovery but do not prevent infection.

Answer

Deploy email spam filtering

Answer

Conduct user security awareness training

Answer

Enable file-level backup to a separate location