SSCP Systems & Application Security

Question 1

Which secure software development practice involves reviewing code to identify security flaws before deployment?

Accepted Answer

Static code analysis

Answer

Penetration testing

Answer

Fuzz testing

Answer

Runtime application self-protection

Question 2

What is the primary purpose of application whitelisting?

Accepted Answer

Allowing only pre-approved applications to execute

Answer

Blocking known malware signatures

Answer

Encrypting application data at rest

Answer

Logging all application activity

Question 3

Which vulnerability is caused when an application processes more data than a fixed-size memory buffer can hold?

Accepted Answer

Buffer overflow

Answer

SQL injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 4

In the context of patch management, what does 'patch prioritization' primarily consider?

Accepted Answer

The severity of the vulnerability and asset criticality

Answer

The size of the patch file

Answer

The vendor releasing the patch

Answer

The number of users affected by the patch

Question 5

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To filter and monitor HTTP traffic to protect web applications from attacks

Answer

To encrypt all web traffic between client and server

Answer

To load-balance web requests across multiple servers

Answer

To cache frequently accessed web content

Question 6

Which concept describes running applications with the minimum permissions necessary to perform their function?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Question 7

What is a 'zero-day' vulnerability?

Accepted Answer

A vulnerability that is publicly known but has no available patch

Answer

A vulnerability that has been patched within 24 hours

Answer

A flaw known only to the vendor but not yet exploited

Answer

A flaw that has zero impact on system security