SSCP Certification SSCP Systems and Application Security 4 — Questions and Answers
Question 1: Which virtualization security control ensures that a virtual machine cannot read the memory of another VM running on the same hypervisor?
- VM-level firewall rules between guest OSes
- Hypervisor-enforced memory isolation between VM address spaces (Correct answer)
- Encrypted virtual disk images on shared storage
- Separate VLAN assignment for each virtual machine
Correct answer: Hypervisor-enforced memory isolation between VM address spaces
The hypervisor enforces strict memory isolation so each VM's address space is inaccessible to other VMs, preventing cross-VM memory snooping.
Question 2: A developer uses parameterized queries (prepared statements) when building database calls. Which attack class does this MOST directly mitigate?
- Cross-site request forgery (CSRF)
- SQL injection (Correct answer)
- Cross-site scripting (XSS)
- Path traversal
Correct answer: SQL injection
Parameterized queries separate SQL code from user-supplied data, preventing attackers from injecting SQL syntax that alters the intended query logic.
Question 3: What distinguishes a Type 1 (bare-metal) hypervisor from a Type 2 (hosted) hypervisor in terms of security?
- Type 1 requires a host OS, which increases the attack surface compared to Type 2
- Type 1 runs directly on hardware without a host OS, reducing the attack surface (Correct answer)
- Type 2 provides stronger VM isolation because it uses hardware-assisted virtualization
- Type 2 is always more secure because it runs within a hardened OS
Correct answer: Type 1 runs directly on hardware without a host OS, reducing the attack surface
Type 1 hypervisors run directly on hardware, eliminating the host OS layer and its associated vulnerabilities, resulting in a smaller attack surface.
Question 4: Which endpoint security technology monitors and controls program execution based on a list of approved applications?
- Intrusion detection system (IDS)
- Application whitelisting (Correct answer)
- Data loss prevention (DLP)
- Network access control (NAC)
Correct answer: Application whitelisting
Application whitelisting allows only pre-approved programs to execute, blocking malware and unauthorized software by default.
Question 5: An organization discovers that an attacker exploited a vulnerability in an unpatched web server plugin that had been public for 60 days. This BEST illustrates the risk of:
- Zero-day vulnerabilities with no available patch
- Failure to apply available patches within an acceptable remediation window (Correct answer)
- Weak authentication on the web server administrative console
- Inadequate network segmentation between DMZ and internal systems
Correct answer: Failure to apply available patches within an acceptable remediation window
A 60-day-old patch represents a known, patchable vulnerability; the risk materializes from the organization's failure to apply the available fix within its remediation SLA.
Question 6: Which security feature in modern CPUs helps prevent shellcode execution by marking memory regions as either executable or non-executable?
- Address Space Layout Randomization (ASLR)
- Data Execution Prevention (DEP) / NX bit (Correct answer)
- Stack canaries
- Control Flow Integrity (CFI)
Correct answer: Data Execution Prevention (DEP) / NX bit
DEP (also called the NX/XD bit) marks data memory pages as non-executable, preventing attackers from executing shellcode injected into stack or heap regions.
Question 7: A security analyst observes that a process is making outbound connections to multiple IP addresses on port 6667 at regular intervals. This behavior MOST likely indicates:
- A legitimate software update process using a custom protocol
- Malware communicating with a command-and-control server via IRC protocol (Correct answer)
- An encrypted backup service using non-standard ports
- A misconfigured DNS resolver querying multiple upstream servers
Correct answer: Malware communicating with a command-and-control server via IRC protocol
Port 6667 is the default IRC port, and periodic beaconing to multiple external IPs is a classic indicator of botnet malware checking in with its C2 infrastructure.
SSCP Certification SSCP Systems and Application Security 4
Which virtualization security control ensures that a virtual machine cannot read the memory of another VM running on the same hypervisor?