SSCP Certification SSCP Systems and Application Security 2

Question 1

Which technique does a Web Application Firewall (WAF) primarily use to detect SQL injection attacks?

Accepted Answer

Signature-based pattern matching against request payloads

Answer

Deep packet inspection of network headers

Answer

Behavioral analysis of user login times

Answer

Certificate pinning on HTTPS connections

Question 2

A developer stores session tokens in HTML5 localStorage. What is the primary security risk?

Accepted Answer

localStorage is accessible by any JavaScript on the same origin, enabling XSS theft

Answer

Tokens expire too quickly due to browser caching

Answer

Tokens are sent in HTTP headers automatically, causing CSRF

Answer

localStorage is not persistent across browser tabs

Question 3

Which sandboxing approach isolates a mobile application from directly accessing other apps' data?

Accepted Answer

Per-application UID-based process isolation enforced by the OS

Answer

Role-based access control at the OS kernel level

Answer

Mandatory use of HTTPS for all inter-app communication

Answer

Application whitelisting on the device firewall

Question 4

During a code review, you find that error messages include full database stack traces returned to the user. This BEST exemplifies which vulnerability class?

Accepted Answer

Security misconfiguration / information disclosure

Answer

Insecure deserialization

Answer

Broken authentication

Answer

Insufficient logging

Question 5

An organization wants to verify that a third-party library has not been tampered with before deployment. Which control BEST achieves this?

Accepted Answer

Verifying the library's cryptographic hash against the publisher's published checksum

Answer

Scanning the library with antivirus software only

Answer

Running the library in a test environment for 24 hours

Answer

Reviewing the library's source code comments

Question 6

Which mobile security control prevents an application from communicating with a fraudulent server even if the device trusts a rogue CA certificate?

Accepted Answer

Certificate pinning embedded in the application

Answer

Certificate transparency logging

Answer

HTTP Strict Transport Security (HSTS) headers

Answer

Two-factor authentication at login

Question 7

A security team is evaluating container security. Which risk is MOST unique to containerized environments compared to traditional VMs?

Accepted Answer

Container escape allowing access to the shared host kernel

Answer

Unpatched guest OS kernels

Answer

Weak administrative passwords on management consoles

Answer

Unencrypted data at rest on storage volumes