SSCP Systems and Application Security Questions and Answers

Question 1

A system administrator notices that a server is exhibiting unusual behavior, including hidden network connections and processes that are not visible with standard system utilities. An antivirus scan of the file system reports no infections. Which type of malware is MOST likely responsible for this activity?

Accepted Answer

Rootkit

Answer

A rootkit is a type of malicious software designed to gain administrative-level control over a computer system while remaining hidden from standard detection methods. [20, 30] By manipulating core operating system components, it can conceal files, processes, and network activity, making it extremely difficult to detect with conventional tools. [2, 12, 21] Trojans, worms, and spyware do not inherently possess this level of stealth and system-level modification capability.

Question 2

A web developer needs to secure a new feature that allows users to post comments, which are then displayed to other users. To prevent attackers from injecting malicious scripts into the comments, which of the following is the MOST effective primary defense?

Accepted Answer

Performing output encoding on user-supplied data before rendering it in the browser

Answer

The most effective primary defense against stored Cross-Site Scripting (XSS) is to perform output encoding on user-controllable data just before it is rendered on a page. [7, 15, 19] This process converts potentially malicious characters (e.g., '<', '>') into their HTML entity equivalents (e.g., '<', '>'), which prevents the browser from interpreting them as executable code. [19] While CSP is a valuable defense-in-depth measure, it is a secondary control. Prepared statements prevent SQL injection, not XSS. Character limits are easily bypassed.

Question 3

Which of the following activities is a fundamental part of the system hardening process aimed at reducing a server's attack surface?

Accepted Answer

Removing or disabling unnecessary services, protocols, and accounts

Answer

A primary goal of system hardening is to reduce the attack surface. [6, 13] This is most directly achieved by uninstalling unnecessary software and disabling non-essential services, ports, and user accounts. [10, 32] Each running service or open port represents a potential vector for attack. While backups, HIPS, and virtualization are all valuable security practices, they are separate controls and not the most fundamental aspect of minimizing the initial attack surface through configuration.

Question 4

A security analyst is investigating a breach within a multi-tenant cloud environment. The investigation reveals that an attacker, who initially compromised a single virtual machine (VM), was able to exploit a hypervisor vulnerability to gain unauthorized access to the host operating system and other VMs. What is this type of attack called?

Accepted Answer

VM escape

Answer

A VM escape is an exploit where an attacker breaks out of the isolated environment of a guest virtual machine to access the host hypervisor or other VMs. [4, 33, 34] This attack undermines the core security principle of virtualization, which is the isolation between guest machines. [4] Hyperjacking involves compromising the hypervisor first to control the VMs, VM sprawl is a management issue of having too many unused VMs, and lateral movement is a broader term for moving between any systems on a network.

Question 5

During the development phase of the Secure Software Development Lifecycle (SSDLC), a team uses an automated tool to analyze the application's source code for security flaws without executing the program. Which of the following BEST describes this activity?

Accepted Answer

Static Application Security Testing (SAST)

Answer

Static Application Security Testing (SAST) involves analyzing an application's source code, bytecode, or binaries for security vulnerabilities without running the application. [8, 16, 18] This "white-box" testing approach is performed early in the SDLC to find flaws in the code itself. [5, 22] DAST, fuzzing, and penetration testing are all "black-box" or dynamic methods that test the application while it is in a running state.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Systems and Application Security Questions and Answers