CCNA Systems and Application Security Questions

SELinux enforces mandatory access control through type enforcement, role-based access control and multi-level security, applying kernel-level policy labels that constrain every process and file regardless of user discretion. AppArmor and standard permissions do not provide the same comprehensive MAC model on Linux.

CSPM continuously assesses cloud configuration against benchmarks and compliance baselines, detecting misconfigured storage, network and logging settings. It satisfies the stem's design requirement by addressing the misconfiguration risk inherent to public cloud, where provider-managed infrastructure removes traditional perimeter controls.

SQL injection inserts malicious SQL statements through unsanitised input fields, tricking the database interpreter into executing attacker-controlled queries. It is a canonical injection flaw because untrusted data crosses into an interpreter without proper separation, matching the OWASP Top 10 category.

Mobile OS secure storage, such as iOS Keychain or Android Keystore, uses hardware-backed keys in a secure element or trusted execution environment. The key material is protected from software attacks, and even on a rooted or jailbroken device, extracting the key is significantly harder. This matches the protection the developer seeks for locally stored sensitive data.

Integrity measurement with attestation verifies that only binaries matching approved hashes execute, which directly enforces whitelisting. It also provides evidence that the system has not been tampered with. This approach supports the requirement to allow approved binaries while blocking unauthorized executables, and it can be integrated with boot-time verification for stronger assurance.

The auditd daemon is the Linux userspace component that writes kernel-generated audit events to /var/log/audit/audit.log, capturing file access, syscalls and authentication activity. It is the subsystem specifically responsible for producing the security audit records the administrator reviews.

SELinux enforces mandatory access control through kernel-level type enforcement and security contexts, applying policy defined by the administrator rather than the resource owner. This satisfies the Linux MAC requirement because even root processes are confined by the loaded policy.

MDM enrollment lets the organization enforce policy, monitor compliance, and trigger a remote wipe if a device is lost, directly addressing the data protection requirement. It also provides the management channel needed to push other controls such as passcode and encryption policies to enrolled devices.

Concatenating unsanitised input into SQL queries lets attackers alter query structure, so the flaw is Injection. This directly satisfies the stem's constraint: user input reaches an interpreter without sanitisation. Injection covers SQL, NoSQL, OS command and ORM injection, making it the precise OWASP Top 10 category here.

CSPM tools continuously scan cloud configurations against benchmarks and policies, surfacing open storage buckets and overly permissive IAM roles. This agentless posture assessment targets exactly the misconfiguration class described, unlike runtime workload protection or vulnerability scanners.

The /etc/sudoers file defines which users may run which commands with elevated privileges, so a rule granting www-data only specific commands enforces least privilege. Editing it via visudo validates syntax and prevents locking out administrative access.

AppLocker applies allow or deny rules based on publisher, path, or file hash, blocking execution of unauthorised installers and applications. Configured through Group Policy, it directly enforces the software restriction the administrator needs, unlike firewall or audit settings.

WDAC enforces an allowlist model: only applications matching explicitly permitted publisher, hash or path rules may execute, blocking all else by default. This directly satisfies the requirement to prevent unauthorised applications from running, unlike audit-only or reputation-based approaches.

Parameterized queries ensure that user input is treated as data, not executable code, by separating SQL logic from data. This prevents attackers from altering the query structure, effectively mitigating SQL injection regardless of the input's content. It is the most effective control for this vulnerability.

WDAC enforces application whitelisting by validating executables against code-integrity policies at the kernel level, blocking anything unsigned or untrusted. This directly satisfies the requirement to prevent unauthorised applications from running on Windows workstations, unlike AppLocker's weaker user-mode enforcement.

Old snapshots preserve the VM's disk state from months earlier, including operating system and application versions that have since been patched. Restoring or reverting to such a snapshot reinstates those unpatched vulnerabilities, directly satisfying the stem's concern about stale, months-old snapshots retained on the hypervisor host.

Full disk encryption converts the entire drive contents into ciphertext so that data at rest is unreadable without the decryption key or authentication credential. If a laptop is lost or stolen, an attacker cannot extract files by removing the drive. This directly satisfies the requirement that lost-device data remain protected without proper authentication.

Manipulating the id parameter grants access to another user's profile because the application trusts client-supplied input without verifying ownership. This is IDOR: an authorisation flaw where the object reference is exposed and no access control check confirms the requester's entitlement to that record.

Cross-Site Scripting injects malicious scripts into content served to other users, exploiting unvalidated input rendered without output encoding. This satisfies the injection criterion: untrusted data is interpreted as executable code by the victim's browser, distinct from server-side SQL or command injection, but still an injection flaw within the OWASP Top 10.

When the 'none' algorithm is accepted, the token's signature is not verified. An attacker can modify the token's payload, such as changing the user role to admin, and set the algorithm to 'none' to bypass signature validation. This allows forging tokens with arbitrary claims, resulting in unauthorized access and privilege escalation.

An HSM generates and stores private keys in tamper-resistant hardware and performs signing or decryption operations internally. The web server sends data to the HSM and receives the result, but the private key itself is never exposed to the host memory or file system. Even if the web server process is compromised, the attacker cannot extract the key from the HSM.

Direct concatenation of unsanitised input into an SQL query is classic SQL injection, which falls under the OWASP Top 10 Injection category. The stem's defining constraint — untrusted input reaching an interpreter without sanitisation — is precisely the mechanism Injection describes, making it the accurate classification.

VM escape exploits hypervisor or virtualisation-layer flaws to break isolation between guests and the host. Patching the hypervisor removes those known vulnerabilities, which is the control that directly prevents escape; guest patching and network controls do not address the shared layer.

IDOR occurs when an application exposes a direct reference to an internal object, such as a record ID in a URL or API parameter, and fails to verify that the requester owns it. Manipulating that value returns another user's data.

A CMDB records every VM, owner and lifecycle state, and lifecycle policies enforce decommissioning of unused instances. This directly addresses sprawl by giving visibility and control over VM provisioning and retirement, satisfying the stem's mitigation requirement more effectively than periodic manual audits.

Closing unused ports and enabling a host-based firewall restricts network access to only necessary services, directly reducing the attack surface. This prevents attackers from reaching potentially vulnerable services. It is a key hardening measure for servers.