SSCP Certification SSCP Systems and Application Security 3

Question 1

Which malware category is specifically designed to remain hidden on a compromised system by modifying OS components to conceal its presence?

Accepted Answer

Rootkit

Answer

Rootkits modify operating system components such as system calls or kernel modules to hide processes, files, and network connections from administrators.

Question 2

What is the primary purpose of Address Space Layout Randomization (ASLR) as an exploit mitigation?

Accepted Answer

Randomizing the memory addresses of process components to make exploitation harder

Answer

ASLR randomizes the base addresses of the stack, heap, and libraries so attackers cannot reliably predict memory locations needed for exploitation.

Question 3

An attacker intercepts traffic between a mobile banking app and its server and replaces the TLS certificate with their own. Which control would have PREVENTED this attack?

Accepted Answer

Implementing certificate pinning in the mobile application

Answer

Certificate pinning causes the app to reject any certificate that does not match the expected pinned value, blocking man-in-the-middle certificate substitution.

Question 4

Which software development practice MOST directly reduces the attack surface of an application at the design phase?

Accepted Answer

Applying the principle of least privilege and minimizing exposed interfaces

Answer

Minimizing exposed interfaces and granting only necessary privileges during design reduces the number of potential attack vectors before code is written.

Question 5

A user reports their system shows a ransom note demanding cryptocurrency, and all personal files have the extension '.locked'. Which type of malware has infected the system?

Accepted Answer

Ransomware

Answer

Ransomware encrypts victim files and demands payment for the decryption key, commonly appending a new extension to encrypted files.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Systems and Application Security 3