How should I use these Systems and Application Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Systems and Application Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Systems and Application Security domain.

SSCP · topic practice

Systems and Application Security practice questions

Practise Systems Security Certified Practitioner SSCP Systems and Application Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Systems and Application Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Systems and Application Security

Systems and Application Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Systems and Application Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Systems and Application Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

Trap 1: Disable the legacy module until a full rewrite is completed.

May cause business disruption; immediate fix is possible.

Trap 2: Deploy a web application firewall (WAF) to block SQL injection…

WAF can be bypassed and is not a permanent fix.

Trap 3: Implement input validation to reject special characters.

Input validation is not sufficient; it can be bypassed.

Study all Systems and Application Security common traps →

A
Disable the legacy module until a full rewrite is completed.
Why wrong: May cause business disruption; immediate fix is possible.
B
Rewrite the legacy module to use parameterized queries.
Parameterized queries prevent SQL injection by separating code from data.
C
Deploy a web application firewall (WAF) to block SQL injection patterns.
Why wrong: WAF can be bypassed and is not a permanent fix.
D
Implement input validation to reject special characters.
Why wrong: Input validation is not sufficient; it can be bypassed.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Systems and Application Security explanation →

An organization is implementing a jump server architecture for managing critical servers. Which additional control BEST reduces the risk of lateral movement if the jump server is compromised?

Trap 1: Enable verbose logging on all target servers.

Logging is detective, not preventive.

Trap 2: Require multi-factor authentication for all jump server logins.

Does not prevent lateral movement from a compromised jump server.

Trap 3: Use a separate VLAN for management traffic.

Network segmentation helps but does not restrict lateral movement at the host level.

Study all Systems and Application Security common traps →

A
Enable verbose logging on all target servers.
Why wrong: Logging is detective, not preventive.
B
Require multi-factor authentication for all jump server logins.
Why wrong: Does not prevent lateral movement from a compromised jump server.
C
Implement SSH key-based authentication with agent forwarding restricted to specific target hosts.
Restricts which hosts can be accessed from the jump server, reducing lateral movement.
D
Use a separate VLAN for management traffic.
Why wrong: Network segmentation helps but does not restrict lateral movement at the host level.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Systems and Application Security explanation →

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

Trap 1: Require a strong screen lock passcode.

Screen lock prevents unauthorized access but does not encrypt data.

Trap 2: Disable cloud backups for the app.

Prevents data leakage via backup but does not protect data on device.

Trap 3: Use app sandboxing to isolate app data from other apps.

Sandboxing prevents access by other apps but does not encrypt data.

Study all Systems and Application Security common traps →

A
Require a strong screen lock passcode.
Why wrong: Screen lock prevents unauthorized access but does not encrypt data.
B
Disable cloud backups for the app.
Why wrong: Prevents data leakage via backup but does not protect data on device.
C
Encrypt all sensitive data stored on the device using a key derived from the user's passcode.
Encryption at rest ensures data is unreadable without the key.
D
Use app sandboxing to isolate app data from other apps.
Why wrong: Sandboxing prevents access by other apps but does not encrypt data.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Systems and Application Security explanation →

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Trap 1: The application uses unsanitized input in SQL queries.

SQL injection leads to database access, not command execution.

Trap 2: The application reflects user input in HTTP responses without…

XSS vulnerability, but does not directly execute commands on server.

Trap 3: The application uses hidden form fields to store session tokens.

CSRF vulnerability, not command execution.

Study all Systems and Application Security common traps →

A
The application uses unsanitized input in SQL queries.
Why wrong: SQL injection leads to database access, not command execution.
B
The application reflects user input in HTTP responses without escaping.
Why wrong: XSS vulnerability, but does not directly execute commands on server.
C
The application passes user input to a shell command via exec() or system() functions.
Command injection allows arbitrary command execution on the server.
D
The application uses hidden form fields to store session tokens.
Why wrong: CSRF vulnerability, not command execution.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Systems and Application Security explanation →

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Trap 1: Enable auditd to log all SUID executions.

Logging is detective, not preventive.

Trap 2: Set the umask to 077 for all users.

Controls default file permissions but does not affect existing SUID binaries.

Trap 3: Remove all SUID binaries from the system.

May break functionality; not practical.

Study all Systems and Application Security common traps →

A
Enable auditd to log all SUID executions.
Why wrong: Logging is detective, not preventive.
B
Set the umask to 077 for all users.
Why wrong: Controls default file permissions but does not affect existing SUID binaries.
C
Mount the /tmp and /var partitions with the 'nosuid' option.
Prevents execution of SUID binaries on those partitions.
D
Remove all SUID binaries from the system.
Why wrong: May break functionality; not practical.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Systems and Application Security explanation →

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Trap 1: Enable server-side encryption for cloud storage.

Protects data at rest, not in transit.

Trap 2: Implement data classification labels.

Data classification helps with handling but does not protect data in transit.

Trap 3: Use IPsec VPNs for all cloud connections.

IPsec is one option but not always necessary; TLS is more common for web traffic.

Study all Systems and Application Security common traps →

A
Enable server-side encryption for cloud storage.
Why wrong: Protects data at rest, not in transit.
B
Implement data classification labels.
Why wrong: Data classification helps with handling but does not protect data in transit.
C
Use IPsec VPNs for all cloud connections.
Why wrong: IPsec is one option but not always necessary; TLS is more common for web traffic.
D
Ensure all data transmissions use TLS 1.2 or higher.
TLS encrypts data in transit and is widely supported.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Systems and Application Security explanation →

A security analyst reviews logs and finds that an attacker exploited a vulnerability in a web application to read arbitrary files from the server. The application runs on Apache with mod_php. Which of the following is the MOST likely vulnerability?

Trap 1: XML External Entity (XXE) vulnerability.

XXE can read files but typically requires XML processing.

Trap 2: Remote File Inclusion (RFI) vulnerability.

RFI includes remote files, not reading local files.

Trap 3: Server-Side Request Forgery (SSRF) vulnerability.

SSRF makes requests to internal resources, not reading files directly.

Study all Systems and Application Security common traps →

A
XML External Entity (XXE) vulnerability.
Why wrong: XXE can read files but typically requires XML processing.
B
Remote File Inclusion (RFI) vulnerability.
Why wrong: RFI includes remote files, not reading local files.
C
Server-Side Request Forgery (SSRF) vulnerability.
Why wrong: SSRF makes requests to internal resources, not reading files directly.
D
Local File Inclusion (LFI) vulnerability in a PHP include statement.
LFI allows reading local files via path traversal.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Systems and Application Security explanation →

An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?

Trap 1: Run dynamic application security testing (DAST) tools.

DAST is performed on running applications.

Trap 2: Apply security patches to the development environment.

Patching is operational, not design.

Trap 3: Conduct a code review for security vulnerabilities.

Code review occurs during development, not design.

Study all Systems and Application Security common traps →

A
Perform threat modeling to identify potential attack vectors.
Threat modeling in design phase identifies risks before coding.
B
Run dynamic application security testing (DAST) tools.
Why wrong: DAST is performed on running applications.
C
Apply security patches to the development environment.
Why wrong: Patching is operational, not design.
D
Conduct a code review for security vulnerabilities.
Why wrong: Code review occurs during development, not design.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Systems and Application Security explanation →

Which TWO of the following are effective controls to prevent buffer overflow attacks? (Choose two.)

Trap 1: Input validation to reject long inputs

Input validation can help but is not sufficient; many overflows occur via other means.

Trap 2: Code obfuscation

Obfuscation does not prevent buffer overflows.

Trap 3: Stack canaries

Stack canaries detect overflow but do not prevent it.

Study all Systems and Application Security common traps →

A
Input validation to reject long inputs
Why wrong: Input validation can help but is not sufficient; many overflows occur via other means.
B
Address Space Layout Randomization (ASLR)
ASLR randomizes memory addresses, making it harder to predict target addresses.
C
Code obfuscation
Why wrong: Obfuscation does not prevent buffer overflows.
D
Non-executable stack (NX bit)
NX bit marks stack as non-executable, preventing code execution.
E
Stack canaries
Why wrong: Stack canaries detect overflow but do not prevent it.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Systems and Application Security explanation →

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Trap 1: Unusual cookie values or multiple cookies

May indicate session fixation or hijacking, not specifically XSS.

Trap 2: Unusual network traffic to external IP addresses

May be caused by other malware, not specifically XSS.

Study all Systems and Application Security common traps →

A
Unusual cookie values or multiple cookies
Why wrong: May indicate session fixation or hijacking, not specifically XSS.
B
JavaScript execution in the browser's developer console that was not initiated by the user
XSS payloads often execute script automatically.
C
Presence of script tags in the page source that are not part of the original application
Injected script tags are a hallmark of XSS.
D
Unexpected pop-up windows in the browser
XSS can inject JavaScript that creates pop-ups.
E
Unusual network traffic to external IP addresses
Why wrong: May be caused by other malware, not specifically XSS.

Full breakdown with real-world context →

Question 11easymulti select

Read the full wireless explanation →

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Trap 1: Set a short, simple pre-shared key for convenience

Weak passwords are a security risk.

Trap 2: Use WEP encryption

WEP is outdated and easily cracked.

Trap 3: Enable MAC address filtering

MAC filtering is easily bypassed by spoofing.

Study all Systems and Application Security common traps →

A
Disable SSID broadcast
Hiding SSID reduces visibility to casual scanners.
B
Set a short, simple pre-shared key for convenience
Why wrong: Weak passwords are a security risk.
C
Use WEP encryption
Why wrong: WEP is outdated and easily cracked.
D
Enable MAC address filtering
Why wrong: MAC filtering is easily bypassed by spoofing.
E
Use WPA3 encryption
WPA3 provides strong encryption and authentication.

Full breakdown with real-world context →

Question 12mediummulti select

Read the full Systems and Application Security explanation →

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Trap 1: IP address whitelisting

IP whitelisting is an access control, not authentication.

Trap 2: LDAP

LDAP is a protocol for accessing directory services, not an authentication method per se.

Study all Systems and Application Security common traps →

A
IP address whitelisting
Why wrong: IP whitelisting is an access control, not authentication.
B
SAML
SAML enables single sign-on across domains.
C
OAuth 2.0
OAuth 2.0 provides delegated access via tokens.
D
HTTP Basic Authentication
Basic authentication sends username/password in header.
E
LDAP
Why wrong: LDAP is a protocol for accessing directory services, not an authentication method per se.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full Systems and Application Security explanation →

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

Exhibit

Refer to the exhibit.

```
[IDS Alert]
Timestamp: 2023-10-05 14:23:45
Signature: ET WEB_SERVER Possible SQL Injection Attempt
Source IP: 192.168.1.100
Destination IP: 10.0.0.50
Payload: ' OR '1'='1' --
```

Trap 1: Directory traversal to read sensitive files.

No path traversal syntax in payload.

Trap 2: Remote code execution on the web server.

SQL injection does not directly execute system commands.

Trap 3: Cross-site scripting (XSS) attack leading to session theft.

The payload is SQL, not JavaScript.

Study all Systems and Application Security common traps →

A
Directory traversal to read sensitive files.
Why wrong: No path traversal syntax in payload.
B
Remote code execution on the web server.
Why wrong: SQL injection does not directly execute system commands.
C
Authentication bypass via SQL injection.
The payload modifies SQL query to always return true.
D
Cross-site scripting (XSS) attack leading to session theft.
Why wrong: The payload is SQL, not JavaScript.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Exhibit

Refer to the exhibit.

```
[Windows Security Log]
Event ID: 4688
Process Name: C:\Windows\System32\cmd.exe
Command Line: cmd.exe /c "echo %USERNAME% && whoami"
Parent Process: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
```

Trap 1: Microsoft Office is performing an automatic update.

Updates do not typically spawn cmd.exe with whoami.

Trap 2: A scheduled task triggered the command.

No indication of a scheduled task; parent process is Word.

Trap 3: A user ran a legitimate command from the Start menu.

The parent process is WINWORD, not explorer.

Study all Systems and Application Security common traps →

A
Microsoft Office is performing an automatic update.
Why wrong: Updates do not typically spawn cmd.exe with whoami.
B
A scheduled task triggered the command.
Why wrong: No indication of a scheduled task; parent process is Word.
C
A user ran a legitimate command from the Start menu.
Why wrong: The parent process is WINWORD, not explorer.
D
A malicious macro in a Word document executed the command.
Macros can execute shell commands; this is a common attack vector.

Full breakdown with real-world context →

Question 15mediumdrag order

Read the full Systems and Application Security explanation →

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediumdrag order

Read the full Systems and Application Security explanation →

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Read the full Systems and Application Security explanation →

Match each cryptography term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Same key for encryption and decryption

Key pair: public and private

One-way function producing fixed output

Ensures authenticity and non-repudiation

Question 18mediummatching

Read the full Systems and Application Security explanation →

Match each security control to its type (administrative, technical, physical).

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Administrative

Technical

Physical

Technical

Question 19mediummultiple choice

Read the full Systems and Application Security explanation →

A software development team is implementing input validation for a web application that accepts user email addresses. Which approach BEST prevents email injection attacks?

Trap 1: Blacklist known malicious email patterns

Blacklisting is reactive and can be bypassed with variations.

Trap 2: Set maximum email length to 100 characters

Length limits do not prevent injection of malicious characters.

Trap 3: Rely on client-side JavaScript validation only

Client-side validation can be easily bypassed.

Study all Systems and Application Security common traps →

A
Whitelist allowed characters: alphanumeric, @, ., -, _
Whitelisting only safe characters prevents injection.
B
Blacklist known malicious email patterns
Why wrong: Blacklisting is reactive and can be bypassed with variations.
C
Set maximum email length to 100 characters
Why wrong: Length limits do not prevent injection of malicious characters.
D
Rely on client-side JavaScript validation only
Why wrong: Client-side validation can be easily bypassed.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Systems and Application Security explanation →

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

Trap 1: Deploy email spam filtering

Reduces delivery but not all ransomware gets through email.

Trap 2: Conduct user security awareness training

Important but not a direct technical prevention control.

Trap 3: Enable file-level backup to a separate location

Helps recovery but does not prevent infection.

Study all Systems and Application Security common traps →

A
Deploy email spam filtering
Why wrong: Reduces delivery but not all ransomware gets through email.
B
Implement application whitelisting
Blocks unauthorized executables from running.
C
Conduct user security awareness training
Why wrong: Important but not a direct technical prevention control.
D
Enable file-level backup to a separate location
Why wrong: Helps recovery but does not prevent infection.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Systems and Application Security sessions

Start a Systems and Application Security only practice session

Every question in these sessions is drawn from the Systems and Application Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Systems and Application Security questions →Mixed SSCP session

Frequently asked questions

What does the SSCP exam test about Systems and Application Security?: Systems and Application Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Systems and Application Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Systems and Application Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SSCP topics?: Use the topic links above to move to related areas, or go back to the SSCP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SSCP exam covers. They are not copied from any real exam or dump site.

Systems and Application Security only

10 questions 20 questions 30 questions 50 questions

Mixed SSCP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SSCP questions Systems and Application Security domain overview SSCP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Systems and Application Security practice questions

What to know about Systems and Application Security

Common Systems and Application Security exam traps

Systems and Application Security questions

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

An organization is implementing a jump server architecture for managing critical servers. Which additional control BEST reduces the risk of lateral movement if the jump server is compromised?

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

A security analyst reviews logs and finds that an attacker exploited a vulnerability in a web application to read arbitrary files from the server. The application runs on Apache with mod_php. Which of the following is the MOST likely vulnerability?

An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?

Which TWO of the following are effective controls to prevent buffer overflow attacks? (Choose two.)

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

Exhibit

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Exhibit

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Match each cryptography term to its definition.

Match each security control to its type (administrative, technical, physical).

A software development team is implementing input validation for a web application that accepts user email addresses. Which approach BEST prevents email injection attacks?

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

Track your progress over time

Start a Systems and Application Security only practice session

Related SSCP topic practice pages

Risk Identification, Monitoring and Analysis practice questions

Network and Communications Security practice questions