SSCP Certification SSCP Systems and Application Security 2 — Questions and Answers
Question 1: Which technique does a Web Application Firewall (WAF) primarily use to detect SQL injection attacks?
- Deep packet inspection of network headers
- Signature-based pattern matching against request payloads (Correct answer)
- Behavioral analysis of user login times
- Certificate pinning on HTTPS connections
Correct answer: Signature-based pattern matching against request payloads
WAFs primarily use signature-based pattern matching to compare HTTP request payloads against known malicious patterns like SQL injection syntax.
Question 2: A developer stores session tokens in HTML5 localStorage. What is the primary security risk?
- Tokens expire too quickly due to browser caching
- localStorage is accessible by any JavaScript on the same origin, enabling XSS theft (Correct answer)
- Tokens are sent in HTTP headers automatically, causing CSRF
- localStorage is not persistent across browser tabs
Correct answer: localStorage is accessible by any JavaScript on the same origin, enabling XSS theft
localStorage is accessible to all scripts on the same origin, so an XSS vulnerability allows attackers to steal session tokens directly.
Question 3: Which sandboxing approach isolates a mobile application from directly accessing other apps' data?
- Role-based access control at the OS kernel level
- Per-application UID-based process isolation enforced by the OS (Correct answer)
- Mandatory use of HTTPS for all inter-app communication
- Application whitelisting on the device firewall
Correct answer: Per-application UID-based process isolation enforced by the OS
Mobile OSes assign each application a unique UID so the kernel prevents one app's process from reading another app's files or memory.
Question 4: During a code review, you find that error messages include full database stack traces returned to the user. This BEST exemplifies which vulnerability class?
- Insecure deserialization
- Security misconfiguration / information disclosure (Correct answer)
- Broken authentication
- Insufficient logging
Correct answer: Security misconfiguration / information disclosure
Exposing internal stack traces to end users is a security misconfiguration that discloses sensitive implementation details to attackers.
Question 5: An organization wants to verify that a third-party library has not been tampered with before deployment. Which control BEST achieves this?
- Scanning the library with antivirus software only
- Verifying the library's cryptographic hash against the publisher's published checksum (Correct answer)
- Running the library in a test environment for 24 hours
- Reviewing the library's source code comments
Correct answer: Verifying the library's cryptographic hash against the publisher's published checksum
Comparing the library's hash to the vendor-published checksum confirms integrity and detects any unauthorized modification.
Question 6: Which mobile security control prevents an application from communicating with a fraudulent server even if the device trusts a rogue CA certificate?
- Certificate transparency logging
- Certificate pinning embedded in the application (Correct answer)
- HTTP Strict Transport Security (HSTS) headers
- Two-factor authentication at login
Correct answer: Certificate pinning embedded in the application
Certificate pinning hardcodes the expected certificate or public key within the app, rejecting connections to servers presenting different certificates.
Question 7: A security team is evaluating container security. Which risk is MOST unique to containerized environments compared to traditional VMs?
- Unpatched guest OS kernels
- Container escape allowing access to the shared host kernel (Correct answer)
- Weak administrative passwords on management consoles
- Unencrypted data at rest on storage volumes
Correct answer: Container escape allowing access to the shared host kernel
Containers share the host OS kernel, so a container escape vulnerability can give an attacker access to the host and all other containers.
SSCP Certification SSCP Systems and Application Security 2
Which technique does a Web Application Firewall (WAF) primarily use to detect SQL injection attacks?