SSCP Certification SSCP Systems and Application Security 5 — Questions and Answers
Question 1: Which secure coding practice BEST protects against path traversal attacks in a web application that serves user-requested files?
- Encoding all file names with Base64 before storage
- Canonicalizing file paths and validating they remain within an allowed base directory (Correct answer)
- Requiring HTTPS for all file download requests
- Logging all file access attempts to a SIEM
Correct answer: Canonicalizing file paths and validating they remain within an allowed base directory
Canonicalizing paths resolves '..' sequences before validation, ensuring the resulting absolute path stays within the permitted directory tree.
Question 2: Which container security best practice MOST reduces the risk of privilege escalation if a container is compromised?
- Using only official base images from public registries
- Running containers as non-root users with read-only root filesystems (Correct answer)
- Encrypting all container images at rest
- Scanning container images for vulnerabilities during CI/CD
Correct answer: Running containers as non-root users with read-only root filesystems
Running containers as non-root with read-only filesystems limits what an attacker can do after compromising a container, constraining privilege escalation paths.
Question 3: An application logs authentication failures but does not alert when 500 failed logins occur against a single account within one minute. This gap represents a failure in which control?
- Encryption of log data in transit
- Automated detection and alerting on anomalous authentication behavior (Correct answer)
- Multi-factor authentication enrollment
- Secure session token generation
Correct answer: Automated detection and alerting on anomalous authentication behavior
Logging without automated alerting on anomalous thresholds fails to detect brute-force attacks in time for defensive response.
Question 4: Which term describes a vulnerability where an application trusts a serialized object from an untrusted source, potentially leading to remote code execution?
- XML external entity (XXE) injection
- Insecure deserialization (Correct answer)
- Server-side request forgery (SSRF)
- Cross-site request forgery (CSRF)
Correct answer: Insecure deserialization
Insecure deserialization occurs when an application reconstructs objects from attacker-controlled data without validation, which can trigger malicious code execution during the deserialization process.
Question 5: A penetration tester uses a tool to automatically submit thousands of username/password combinations harvested from previously breached databases against a login portal. This attack is BEST described as:
- Dictionary attack using wordlists
- Credential stuffing using breached credential pairs (Correct answer)
- Brute-force attack using all character combinations
- Password spraying using one password against many accounts
Correct answer: Credential stuffing using breached credential pairs
Credential stuffing uses real username/password pairs from prior data breaches, exploiting password reuse across services.
Question 6: Which OWASP Top 10 category covers vulnerabilities such as JWT algorithm confusion and broken object-level authorization?
- Injection
- Broken Access Control (Correct answer)
- Security Misconfiguration
- Vulnerable and Outdated Components
Correct answer: Broken Access Control
Broken Access Control encompasses failures that allow users to act outside their intended permissions, including BOLA/IDOR and authentication token weaknesses that bypass authorization.
Question 7: During a security assessment, a tester finds that the application accepts user input in an XML document and processes it without disabling external entity references. Which attack does this enable?
- Cross-site scripting (XSS) via injected script tags
- XML External Entity (XXE) injection allowing server-side file disclosure (Correct answer)
- SQL injection via crafted XML attribute values
- Cross-site request forgery via XML-encoded form submissions
Correct answer: XML External Entity (XXE) injection allowing server-side file disclosure
XXE injection exploits XML parsers that resolve external entity references, allowing attackers to read local files, perform SSRF, or cause denial of service.
SSCP Certification SSCP Systems and Application Security 5
Which secure coding practice BEST protects against path traversal attacks in a web application that serves user-requested files?