SSCP Systems & Application Security 1 — Questions and Answers
Question 1: Which secure software development practice involves reviewing code to identify security flaws before deployment?
- Penetration testing
- Static code analysis (Correct answer)
- Fuzz testing
- Runtime application self-protection
Correct answer: Static code analysis
Static code analysis examines source code without executing it to find security vulnerabilities early in the development lifecycle.
Question 2: What is the primary purpose of application whitelisting?
- Blocking known malware signatures
- Allowing only pre-approved applications to execute (Correct answer)
- Encrypting application data at rest
- Logging all application activity
Correct answer: Allowing only pre-approved applications to execute
Application whitelisting permits only explicitly approved programs to run, preventing unauthorized or malicious software from executing.
Question 3: Which vulnerability is caused when an application processes more data than a fixed-size memory buffer can hold?
- SQL injection
- Cross-site scripting
- Buffer overflow (Correct answer)
- Directory traversal
Correct answer: Buffer overflow
A buffer overflow occurs when input data exceeds the allocated buffer size, potentially allowing attackers to overwrite adjacent memory and execute arbitrary code.
Question 4: In the context of patch management, what does 'patch prioritization' primarily consider?
- The size of the patch file
- The severity of the vulnerability and asset criticality (Correct answer)
- The vendor releasing the patch
- The number of users affected by the patch
Correct answer: The severity of the vulnerability and asset criticality
Patch prioritization weighs the CVSS severity score of the vulnerability against the criticality of the affected asset to determine remediation order.
Question 5: What is the purpose of a Web Application Firewall (WAF)?
- To encrypt all web traffic between client and server
- To filter and monitor HTTP traffic to protect web applications from attacks (Correct answer)
- To load-balance web requests across multiple servers
- To cache frequently accessed web content
Correct answer: To filter and monitor HTTP traffic to protect web applications from attacks
A WAF inspects HTTP/HTTPS traffic between a web application and the internet, blocking common attacks like SQL injection and XSS.
Question 6: Which concept describes running applications with the minimum permissions necessary to perform their function?
- Defense in depth
- Least privilege (Correct answer)
- Separation of duties
- Need to know
Correct answer: Least privilege
The principle of least privilege limits an application's permissions to only what is required, reducing the attack surface if the application is compromised.
Question 7: What is a 'zero-day' vulnerability?
- A vulnerability that has been patched within 24 hours
- A flaw known only to the vendor but not yet exploited
- A vulnerability that is publicly known but has no available patch (Correct answer)
- A flaw that has zero impact on system security
Correct answer: A vulnerability that is publicly known but has no available patch
A zero-day vulnerability is one that is publicly known (or known to attackers) with no vendor-supplied patch available, leaving systems exposed.
SSCP Systems & Application Security 1
Which secure software development practice involves reviewing code to identify security flaws before deployment?