SSCP Certification SSCP Systems and Application Security 2

Question 1

Which technique does a Web Application Firewall (WAF) primarily use to detect SQL injection attacks?

Accepted Answer

Signature-based pattern matching against request payloads

Answer

WAFs primarily use signature-based pattern matching to compare HTTP request payloads against known malicious patterns like SQL injection syntax.

Question 2

A developer stores session tokens in HTML5 localStorage. What is the primary security risk?

Accepted Answer

localStorage is accessible by any JavaScript on the same origin, enabling XSS theft

Answer

localStorage is accessible to all scripts on the same origin, so an XSS vulnerability allows attackers to steal session tokens directly.

Question 3

Which sandboxing approach isolates a mobile application from directly accessing other apps' data?

Accepted Answer

Per-application UID-based process isolation enforced by the OS

Answer

Mobile OSes assign each application a unique UID so the kernel prevents one app's process from reading another app's files or memory.

Question 4

During a code review, you find that error messages include full database stack traces returned to the user. This BEST exemplifies which vulnerability class?

Accepted Answer

Security misconfiguration / information disclosure

Answer

Exposing internal stack traces to end users is a security misconfiguration that discloses sensitive implementation details to attackers.

Question 5

An organization wants to verify that a third-party library has not been tampered with before deployment. Which control BEST achieves this?

Accepted Answer

Verifying the library's cryptographic hash against the publisher's published checksum

Answer

Comparing the library's hash to the vendor-published checksum confirms integrity and detects any unauthorized modification.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Systems and Application Security 2