CCNA Systems and Application Security Questions

Cloud Security Posture Management continuously scans cloud infrastructure for misconfigurations, comparing deployed resource settings against security baselines and compliance frameworks. It directly satisfies the stem's requirement for ongoing detection of exposed data risks, unlike CWPP (workload protection) or CASB (access control), which address different layers.

Whitelisting only permits explicitly approved executables, so any legitimate business application not yet listed is blocked. A defined approval process lets administrators vet and add new or updated software promptly, preserving user productivity while keeping the default-deny posture intact.

In IaaS the provider secures the physical hosts, hypervisor and network fabric, but the guest operating system remains the customer's layer. Patching, hardening and OS-level controls therefore fall to the customer, satisfying the stem's IaaS responsibility split.

Path traversal, also called directory traversal, occurs when user-supplied input containing sequences like ../ is used to access files outside the intended directory. The analyst's observation that ../../etc/passwd returns a system file demonstrates exactly this flaw. The application fails to validate or normalize the path, allowing access to arbitrary files readable by the process.

On modern Linux, persistence that survives reboot is typically implemented through systemd timers, user and system cron entries, or legacy startup scripts such as rc.local. Reviewing these locations directly targets mechanisms that re-launch malicious code after a restart, making this the correct first step for identifying reboot-surviving persistence.

The SameSite attribute controls whether the browser sends the cookie with cross-site requests. Setting SameSite to Lax or Strict prevents the cookie from being included in requests originating from other sites, which blocks CSRF attacks. This directly addresses the CSRF concern and complements HttpOnly for XSS protection, making it one of the two correct recommendations.

Strong password policies enforce complexity, length and expiry through Group Policy, blocking weak credentials that brute-force and credential-stuffing attacks exploit. CIS Benchmarks recommend this account-policy hardening for Windows servers, satisfying the stem's requirement for a typically recommended measure.

In PaaS, the provider secures the runtime, OS and infrastructure, but the customer retains ownership of the deployed application. Input validation and parameterised queries to prevent SQL injection sit squarely with the customer, satisfying the stem's requirement to secure application code.

In PaaS, the provider secures the platform, runtime and OS, but the customer retains responsibility for their application code. Input validation and parameterised queries preventing SQL injection remain the organisation's duty, satisfying the shared responsibility boundary for application-layer controls.

Seccomp filters restrict which system calls a container process may invoke, directly limiting the kernel attack surface an attacker can use during a breakout attempt. By allowing only the calls the application needs, the profile blocks dangerous syscalls that are commonly abused for privilege escalation or container escape. This makes it the most effective control for reducing breakout impact.

CSPM evaluates cloud resource configurations against security baselines and benchmarks. A storage bucket set to public read access is a classic configuration drift that CSPM detects and flags, since it inspects control-plane settings rather than runtime traffic or application behaviour.

Selective wipe (or enterprise wipe) removes only corporate data and configurations from a device, leaving personal data intact. This meets the requirement of protecting corporate information while respecting user privacy. It is a standard MDM feature for BYOD or company-owned devices with personal use.

Full-device encryption protects all data at rest, including the application's local storage. When combined with a strong passcode, the encryption keys are derived from the passcode, so without it the data remains inaccessible. This directly satisfies the requirement that lost or stolen devices do not expose patient data, as the attacker cannot decrypt the storage without the passcode.

gVisor and Kata Containers insert an isolation layer between the container and the host kernel. gVisor intercepts system calls in user space, while Kata runs each pod in a lightweight virtual machine with its own kernel. Either approach prevents a container breakout from directly reaching the node kernel, directly satisfying the requirement to limit kernel-level exposure.

User Account Control enforces mandatory integrity levels, prompting for administrator approval before privileged actions elevate a process. This prevents unauthorised changes to system settings by standard users, satisfying the requirement for mandatory integrity controls with administrator approval.

Unmanaged VMs consume hypervisor CPU, memory, storage and licensing without lifecycle oversight, which is the defining characteristic of VM sprawl. Because these instances bypass the CMDB, they escape patching and vulnerability tracking, so sprawl is the risk most directly created by the missing inventory records.

Full disk encryption protects data at rest if the drive is removed, and storing the key in an HSM or external key manager ensures the key is not on the same disk as the ciphertext. This satisfies both auditor conditions: confidentiality of stolen media and separation of key material from encrypted data. It is the standard approach for data-at-rest protection on servers.

/etc/sudoers defines which users and groups may run commands as root via sudo, using User_Spec and Cmnd_Spec entries. Editing it satisfies the stem's requirement to restrict superuser command execution to authorised users, unlike /etc/passwd or /etc/shadow.

Editing /etc/sudoers defines exactly which users or groups may run which commands via sudo, satisfying the requirement that only authorised accounts gain elevated execution. This replaces blanket root access with granular, auditable privilege delegation, so unauthorised users cannot escalate.

SELinux enforces mandatory access control through type enforcement, confining each process to only the files and resources its policy permits, regardless of user identity. Standard discretionary permissions cannot constrain a compromised daemon this way, which is the hardening requirement.

A Web Application Firewall inspects inbound HTTP/HTTPS requests at layer 7, matching signatures and rules to block SQL injection and cross-site scripting payloads before they reach the application. This directly satisfies the stem's requirement for a control specifically designed to inspect HTTP traffic.

SELinux is a mandatory access control framework integrated into the Linux kernel that enforces security policies based on labels applied to processes, files, ports, and other objects. It restricts even root-level processes according to administrator-defined policy, which fits the hospital's need for granular, system-wide MAC enforcement on a Linux host handling sensitive health records.

auditd can monitor the execve system call, which is invoked whenever a new process is executed. By configuring a rule to watch execve, the SIEM will receive an event containing the full command line and the parent process. This directly detects the arbitrary command execution caused by the malicious HTTP request, providing immediate and reliable evidence.

Editing /etc/sudoers lets you grant the named user targeted command privileges via a NOPASSWD entry, satisfying the passwordless requirement. The sudoers file maps users to permitted commands and their authentication rules, unlike /etc/passwd or /etc/shadow, which hold account and password data rather than privilege-escalation policy.

Unmanaged VMs are often forgotten, leading to security gaps.

Full-disk encryption with a key protector that requires a secret known only to the user means the volume encryption key cannot be unwrapped without that secret. An attacker who extracts the drive still lacks the input needed to decrypt, so pre-boot authentication is the control that converts encryption at rest into meaningful protection for a lost device.

In SaaS, the provider secures the application, runtime and infrastructure, while the customer retains responsibility for its own data classification and managing which users may access that data. These controls sit above the provider's boundary, satisfying the stem's shared responsibility constraint.

Generic client-facing errors with detailed server-side logging prevent attackers from learning internal file paths and connection strings while preserving diagnostic data for developers. This directly addresses the information disclosure observed in the stack trace without altering business logic. It is a standard secure coding practice aligned with SSCP guidance on error handling and preventing sensitive data exposure in application responses.

Under IaaS the provider manages the platform beneath the VM, leaving everything above the operating system to the tenant. Application security, including patching web app code, therefore falls to the customer, satisfying the stem's customer-responsibility constraint rather than the provider's managed scope.

An IAM role attached to the compute instance issues short-lived, automatically rotated credentials through the instance metadata service, so no long-term secret is stored on disk. This satisfies the requirement of granting bucket access without embedding persistent credentials on the instance.

Hypervisor patches close the vulnerabilities that let guest code break out of its VM boundary and reach the host. Since the hypervisor is the isolation layer itself, keeping it patched directly addresses the VM escape constraint in the stem.

Disabling unnecessary services and accounts removes unused listening ports and dormant credentials, directly shrinking exploitable entry points. This satisfies the hardening requirement by eliminating attack vectors that patching alone cannot address, since unused services still expose the Windows server.

Disabling Telnet and FTP removes insecure cleartext protocols, while patching closes known vulnerabilities. Together they eliminate both the exposed attack surface and the exploitable flaws, satisfying the hardening requirement more completely than either measure alone.

chmod 600 file.txt sets the permission bits to rw-------, giving the owner read and write while group and others receive none. The octal 6 encodes read (4) plus write (2) for the owner, and the two trailing zeros deny all group and other access, satisfying the stem's restriction requirement.

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query, causing it to execute unintended commands. This matches the stem's description of malicious data reaching an interpreter directly, distinguishing it from broken access control or misconfiguration.

Snapshots preserve a point-in-time disk state, so reverting a virtual machine restores the outdated software and its known vulnerabilities, undoing prior patching. This directly satisfies the stem's constraint: dormant snapshot images retaining vulnerable code that re-enters production upon restore, which is precisely vulnerability reintroduction.

Removing unnecessary services and packages eliminates unused daemons, open ports and vulnerable libraries, shrinking the number of exploitable entry points on the host. This directly reduces the attack surface, which is the hardening goal stated in the scenario.

CSPM continuously assesses cloud environments against security baselines and compliance frameworks, identifying misconfigurations such as public buckets or overly permissive roles, then alerting or auto-remediating. This detection and remediation of misconfigurations is its primary purpose, distinct from workload protection or identity governance.

In PaaS, the provider secures the platform and runtime, but the customer still controls who accesses the service. Managing user accounts, authentication and authorisation remains the customer's duty, satisfying the stem's shared responsibility constraint for identity.

seccomp filters the system calls a process may invoke, so a compromised container can be blocked from dangerous calls such as mounting file systems or loading kernel modules. Profiles are applied by the runtime at container start, requiring no change to the application image, which fits the team's constraint exactly.

chmod alters the read, write and execute bits of a file's permission mode, applying symbolic or octal changes to owner, group and others. Hardening requires tightening these access bits, so chmod directly satisfies the task of managing file permissions on the server.

The /proc/<pid>/exe symbolic link points to the actual executable backing the running process, even if the file was deleted or renamed, so it reveals the true binary. Hashing that file and comparing it to a trusted baseline shows whether the executable has been altered, satisfying both questions.

auditd hooks into the Linux kernel audit subsystem, recording system calls and file access events with full context. It captures the detailed syscall-level records a breach investigation needs, unlike syslog or application logs, which omit kernel-level activity.

Code signing verification checks that the update package was signed by the vendor's private key and has not been altered. If the attacker modified the update, the signature would not match, and the installation would be blocked. This directly prevents the backdoored update from being installed, assuming the vendor's private key was not compromised. It is the most effective control for this scenario.

Patching the guest operating system falls to the customer under IaaS, since the provider manages only the hypervisor, physical hosts and network fabric. The customer retains control of everything from the guest OS upward, satisfying the stem's shared responsibility constraint.

Patching the ESXi hypervisor closes the vulnerabilities that VM escape exploits target, directly satisfying the stem's mitigation requirement. Because escape attacks break the isolation boundary between guest and host, keeping the hypervisor current is more effective than guest-level controls, which cannot protect the host.

Selective wipe, or enterprise wipe, is designed for BYOD scenarios where the organization manages only the corporate container. It removes corporate email, attachments, and the encryption keys protecting that data while leaving personal photos and apps intact. This satisfies the requirement to remotely erase only corporate data if the device is lost.

Removing unnecessary services and daemons eliminates listening ports and executable code that attackers could exploit, directly shrinking the server's attack surface. This satisfies the hardening constraint by reducing the number of potential entry points requiring patching and monitoring.

AppLocker and Windows Defender Application Control enforce application allowlisting, permitting only explicitly approved executables to run. This directly satisfies the requirement that only approved applications execute, unlike antivirus scanning or firewall rules, which detect or block traffic rather than restrict which programs may launch.

Cryptographically signing the artifact in the pipeline and verifying that signature at deploy time binds the exact bytes to a trusted build process. Any tampering after signing invalidates the signature and blocks deployment. This is the mechanism behind sigstore/cosign and similar supply-chain integrity tools, and it directly satisfies the requirement for provable artifact integrity.

An allowlist restricts deserialization to only known, safe classes, preventing attacker-controlled gadget chains from being instantiated. Because the partner API only needs to send specific session object types, enumerating those types and rejecting everything else directly blocks the malicious object from being processed. This is the most targeted and effective mitigation for insecure deserialization in this scenario.

AppLocker enforces allow/deny rules on which executables, scripts and installers may run, directly restricting software execution on the Windows server and shrinking the attack surface. Unlike firewall or patch controls, it addresses the constraint of limiting what can execute.

AppLocker applies policy-based allow lists that restrict which executables, scripts and installers may run, using publisher, path or hash rules. This enforces application whitelisting natively on Windows servers, satisfying the hardening requirement without third-party agents.

Cryptographically secure random session identifiers resist prediction, and transmitting them only over TLS prevents interception on the network. Together these address both predictability and capture risks. This is the standard approach for protecting session tokens in public web applications and aligns with secure session management guidance.

Group Policy centrally defines and enforces domain-wide security settings, including password complexity and account lockout thresholds, by linking Group Policy Objects to sites, domains, or organisational units. This satisfies the stem's requirement for applying consistent policies across multiple systems in a domain, unlike local policy, which applies to a single machine only.

/etc/sudoers defines sudo privileges, including NOPASSWD entries that let a user run commands as root without authentication. Reviewing it confirms the auditor's finding, since the sudoers policy is the authoritative source for this configuration rather than PAM or group membership files.

Telnet transmits credentials and session data in cleartext, so any network observer can capture them. Removing the service eliminates that exposure, while SSH provides encrypted, authenticated remote administration. Disabling or firewalling Telnet leaves the insecure service installed and re-enableable.

Windows Event Forwarding uses the WS-Management protocol to push events from source servers to a central collector, where they are stored on a separate host. This centralisation means an attacker compromising one server cannot alter or delete the forwarded copies.

Snapshots capture the full VM state, including the guest OS and installed software, at the moment of creation. Restoring one reinstates that captured image, so any patches applied afterwards are lost, reintroducing the unpatched vulnerabilities the snapshot preserved. This directly satisfies the stem's requirement that snapshots constitute a risk.

Checking magic bytes and enforcing an extension allowlist ensures the file's actual content matches an expected image type, blocking polyglot files and scripts disguised with image extensions. This directly prevents a PHP or JSP payload from being accepted as a JPEG, which is a prerequisite for the upload-to-RCE chain described in the scenario.

In SaaS, the provider secures the application, runtime and underlying infrastructure, while the customer retains ownership of its data. Classifying that data and controlling who may access it therefore remain customer responsibilities, since only the customer understands its sensitivity and business access requirements.

Platform secure storage is designed to isolate secrets from other applications and, on supported hardware, to protect them with hardware-backed keys. Moving tokens there prevents other apps from reading them and addresses the finding directly on both platforms. This is the recommended remediation for insecure local storage of credentials or tokens.

A successful root SSH login directly violates the no-interactive-logins constraint, since it establishes an authenticated remote shell on the server. Root access also bypasses the least-privilege boundaries that should restrict administrative activity, making this event a high-priority indicator of compromise or misconfiguration.

AppLocker enforces allow or deny rules based on publisher signature, file path or hash, so only approved executables, scripts and installers run. This directly limits execution of unauthorised code, satisfying the stem's attack-surface reduction constraint on the Windows workstation.

Removing unnecessary services and accounts shrinks the attack surface by eliminating unused daemons, listening ports and dormant credentials that attackers exploit for lateral movement or privilege escalation. This directly satisfies the CIS Benchmarks' hardening objective of reducing exploitable components to only those required for the system's documented business function.

Multi-factor authentication requires a second factor beyond a password, so a stolen or guessed credential alone cannot grant console or API access. Applying it to privileged accounts directly reduces the risk of unauthorized administrative access, which is the stated objective. This is a foundational control for protecting the management plane of any IaaS environment.

In IaaS, the provider secures the physical hosts, network and hypervisor only. The customer retains control of everything above the hypervisor, so patching the guest OS and web server software falls to them. This satisfies the shared responsibility split for IaaS workloads.

Running as non-root and dropping capabilities follows the principle of least privilege. If the application is compromised, the attacker has limited permissions and cannot perform privileged operations like mounting filesystems or modifying kernel parameters. This significantly reduces the risk of container escape and lateral movement to the host or other containers.

A Java security policy file lists the exact permissions granted to code, and the SecurityManager enforces them at runtime by checking each sensitive operation against the policy. This gives the security team an external, declarative way to restrict the application to only the privileges it needs, independent of how the application is written.

Patching the hypervisor closes known privilege-escalation vulnerabilities that permit VM escape, while removing unnecessary guest tools shrinks the guest-to-host attack surface, such as shared folders and clipboard channels. Together these directly satisfy the stem's requirement to stop a VM compromising the hypervisor.

LUKS encrypts the block device itself, so every sector written to the volume is ciphertext while at rest. If the disk is removed and mounted elsewhere, the data is unreadable without the passphrase or key file. This satisfies whole-volume confidentiality for a stolen physical disk.

iptables is the Linux kernel's packet-filtering framework, configuring rules in the filter table to accept TCP ports 80 and 443 and drop other inbound traffic. It directly satisfies the requirement to restrict network traffic at the host level.

A Web Application Firewall inspects HTTP traffic at the network perimeter, matching request patterns against signatures for SQL injection and blocking malicious payloads before they reach the application, satisfying the requirement to detect and block attacks at the perimeter.

The securityContext fields allowPrivilegeEscalation and capabilities directly control whether a process can gain more privileges than its parent and which Linux capabilities are available. Setting allowPrivilegeEscalation to false blocks setuid and similar escalation paths, while dropping capabilities removes the ability to perform privileged operations such as mounting filesystems or modifying kernel parameters. This precisely mitigates the described risk.

A read-only root filesystem prevents the container from modifying its own files, and mounting only the necessary configuration files as read-only volumes enforces least privilege. This meets the requirement that the application can only read its own configuration files while being isolated from the host and other applications.