SSCP Certification SSCP Systems and Application Security 3 ā Questions and Answers
Question 1: Which malware category is specifically designed to remain hidden on a compromised system by modifying OS components to conceal its presence?
- Ransomware
- Rootkit (Correct answer)
- Worm
- Adware
Correct answer: Rootkit
Rootkits modify operating system components such as system calls or kernel modules to hide processes, files, and network connections from administrators.
Question 2: What is the primary purpose of Address Space Layout Randomization (ASLR) as an exploit mitigation?
- Encrypting memory pages containing sensitive data at rest
- Randomizing the memory addresses of process components to make exploitation harder (Correct answer)
- Preventing execution of code marked as data in the NX bit
- Scanning heap memory for known shellcode signatures
Correct answer: Randomizing the memory addresses of process components to make exploitation harder
ASLR randomizes the base addresses of the stack, heap, and libraries so attackers cannot reliably predict memory locations needed for exploitation.
Question 3: An attacker intercepts traffic between a mobile banking app and its server and replaces the TLS certificate with their own. Which control would have PREVENTED this attack?
- Enabling device encryption on the mobile device
- Implementing certificate pinning in the mobile application (Correct answer)
- Using HTTP instead of HTTPS to avoid certificate issues
- Requiring biometric authentication at app launch
Correct answer: Implementing certificate pinning in the mobile application
Certificate pinning causes the app to reject any certificate that does not match the expected pinned value, blocking man-in-the-middle certificate substitution.
Question 4: Which software development practice MOST directly reduces the attack surface of an application at the design phase?
- Conducting penetration testing after deployment
- Applying the principle of least privilege and minimizing exposed interfaces (Correct answer)
- Using only open-source frameworks
- Logging all user actions to a SIEM
Correct answer: Applying the principle of least privilege and minimizing exposed interfaces
Minimizing exposed interfaces and granting only necessary privileges during design reduces the number of potential attack vectors before code is written.
Question 5: A user reports their system shows a ransom note demanding cryptocurrency, and all personal files have the extension '.locked'. Which type of malware has infected the system?
- Spyware
- Ransomware (Correct answer)
- Rootkit
- Trojan horse
Correct answer: Ransomware
Ransomware encrypts victim files and demands payment for the decryption key, commonly appending a new extension to encrypted files.
Question 6: In secure application development, what does the term 'input validation' primarily aim to prevent?
- Unauthorized access to administrative functions
- Injection attacks caused by untrusted data being processed as commands (Correct answer)
- Weak password storage using reversible encryption
- Man-in-the-middle attacks during data transmission
Correct answer: Injection attacks caused by untrusted data being processed as commands
Input validation ensures that user-supplied data conforms to expected formats, preventing it from being interpreted as executable commands in SQL, OS, or other interpreters.
Question 7: Which of the following BEST describes a supply chain attack in the context of software security?
- An attacker exploiting a buffer overflow in the target application directly
- Compromising a trusted third-party component, library, or build process to deliver malicious code (Correct answer)
- Using social engineering to obtain developer credentials
- Performing a denial-of-service attack on the software vendor's update servers
Correct answer: Compromising a trusted third-party component, library, or build process to deliver malicious code
Supply chain attacks target trusted upstream componentsāsuch as open-source libraries or CI/CD pipelinesāto inject malicious code that is then distributed to all downstream users.
SSCP Certification SSCP Systems and Application Security 3
Which malware category is specifically designed to remain hidden on a compromised system by modifying OS components to conceal its presence?