SSCP Systems and Application Security Questions and Answers — Questions and Answers
Question 1: A system administrator notices that a server is exhibiting unusual behavior, including hidden network connections and processes that are not visible with standard system utilities. An antivirus scan of the file system reports no infections. Which type of malware is MOST likely responsible for this activity?
- Worm
- Rootkit (Correct answer)
- Trojan
- Spyware
Correct answer: Rootkit
A rootkit is a type of malicious software designed to gain administrative-level control over a computer system while remaining hidden from standard detection methods. [20, 30] By manipulating core operating system components, it can conceal files, processes, and network activity, making it extremely difficult to detect with conventional tools. [2, 12, 21] Trojans, worms, and spyware do not inherently possess this level of stealth and system-level modification capability.
Question 2: A web developer needs to secure a new feature that allows users to post comments, which are then displayed to other users. To prevent attackers from injecting malicious scripts into the comments, which of the following is the MOST effective primary defense?
- Implementing a strong Content Security Policy (CSP)
- Using prepared statements for all database interactions
- Performing output encoding on user-supplied data before rendering it in the browser (Correct answer)
- Enforcing a strict character limit on the comment input field
Correct answer: Performing output encoding on user-supplied data before rendering it in the browser
The most effective primary defense against stored Cross-Site Scripting (XSS) is to perform output encoding on user-controllable data just before it is rendered on a page. [7, 15, 19] This process converts potentially malicious characters (e.g., '<', '>') into their HTML entity equivalents (e.g., '<', '>'), which prevents the browser from interpreting them as executable code. [19] While CSP is a valuable defense-in-depth measure, it is a secondary control. Prepared statements prevent SQL injection, not XSS. Character limits are easily bypassed.
Question 3: Which of the following activities is a fundamental part of the system hardening process aimed at reducing a server's attack surface?
- Configuring daily incremental backups to an offsite location
- Installing a host-based intrusion prevention system (HIPS)
- Deploying the server as a virtual machine for easier snapshots
- Removing or disabling unnecessary services, protocols, and accounts (Correct answer)
Correct answer: Removing or disabling unnecessary services, protocols, and accounts
A primary goal of system hardening is to reduce the attack surface. [6, 13] This is most directly achieved by uninstalling unnecessary software and disabling non-essential services, ports, and user accounts. [10, 32] Each running service or open port represents a potential vector for attack. While backups, HIPS, and virtualization are all valuable security practices, they are separate controls and not the most fundamental aspect of minimizing the initial attack surface through configuration.
Question 4: A security analyst is investigating a breach within a multi-tenant cloud environment. The investigation reveals that an attacker, who initially compromised a single virtual machine (VM), was able to exploit a hypervisor vulnerability to gain unauthorized access to the host operating system and other VMs. What is this type of attack called?
- VM escape (Correct answer)
- Hyperjacking
- VM sprawl
- Lateral movement
Correct answer: VM escape
A VM escape is an exploit where an attacker breaks out of the isolated environment of a guest virtual machine to access the host hypervisor or other VMs. [4, 33, 34] This attack undermines the core security principle of virtualization, which is the isolation between guest machines. [4] Hyperjacking involves compromising the hypervisor first to control the VMs, VM sprawl is a management issue of having too many unused VMs, and lateral movement is a broader term for moving between any systems on a network.
Question 5: During the development phase of the Secure Software Development Lifecycle (SSDLC), a team uses an automated tool to analyze the application's source code for security flaws without executing the program. Which of the following BEST describes this activity?
- Fuzzing
- Dynamic Application Security Testing (DAST)
- Static Application Security Testing (SAST) (Correct answer)
- Penetration Testing
Correct answer: Static Application Security Testing (SAST)
Static Application Security Testing (SAST) involves analyzing an application's source code, bytecode, or binaries for security vulnerabilities without running the application. [8, 16, 18] This "white-box" testing approach is performed early in the SDLC to find flaws in the code itself. [5, 22] DAST, fuzzing, and penetration testing are all "black-box" or dynamic methods that test the application while it is in a running state.
Question 6: A developer is creating a web application that takes user input to search a product database. To provide the strongest defense against SQL injection attacks, which of the following techniques should be implemented?
- Implementing an allow-list for specific special characters in the input field.
- Sanitizing user input by stripping out keywords like 'SELECT' and 'DROP'.
- Using parameterized queries or prepared statements. (Correct answer)
- Hashing all user input before appending it to the SQL query string.
Correct answer: Using parameterized queries or prepared statements.
The most effective and recommended defense against SQL injection is the use of parameterized queries, also known as prepared statements. [3, 11, 17] This technique separates the SQL command logic from the data, ensuring that user input is treated as literal data and cannot be executed as part of the command. [27] Input sanitization and block-listing can be incomplete and bypassed, while hashing is used for storing passwords, not for querying data.
SSCP Systems and Application Security Questions and Answers
A system administrator notices that a server is exhibiting unusual behavior, including hidden network connections and processes that are not visible with standard system utilities.
An antivirus scan of the file system reports no infections.
Which type of malware is MOST likely responsible for this activity?