SSCP Systems & Application Security 2 — Questions and Answers
Question 1: Which hardening technique involves disabling or removing unnecessary services, ports, and software from a system?
- Patch management
- Reducing the attack surface (Correct answer)
- Vulnerability scanning
- Application sandboxing
Correct answer: Reducing the attack surface
Reducing the attack surface by removing unneeded services and components limits the number of potential entry points an attacker can exploit.
Question 2: What is the primary security benefit of containerization technologies like Docker?
- They eliminate the need for operating system patches
- They isolate applications from each other and the host system (Correct answer)
- They automatically encrypt all application data
- They prevent all forms of privilege escalation
Correct answer: They isolate applications from each other and the host system
Containers provide process and filesystem isolation so that a compromised container has limited ability to affect other containers or the host OS.
Question 3: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Rootkit
- Trojan horse (Correct answer)
- Ransomware
Correct answer: Trojan horse
A Trojan horse masquerades as benign or useful software, but delivers a malicious payload once executed by an unsuspecting user.
Question 4: What is 'input validation' in the context of application security?
- Verifying user credentials before granting access
- Ensuring data entered by users meets expected format and type before processing (Correct answer)
- Logging all user inputs for audit purposes
- Encrypting user-submitted data in transit
Correct answer: Ensuring data entered by users meets expected format and type before processing
Input validation checks that user-supplied data conforms to expected formats, preventing injection attacks and other input-based vulnerabilities.
Question 5: Which security measure involves using multiple independent systems to perform the same function to verify results?
- Redundancy
- Defense in depth
- Diversity of defense (Correct answer)
- Failover clustering
Correct answer: Diversity of defense
Diversity of defense uses different, independent security controls so that a failure or bypass of one does not compromise the entire system.
Question 6: What is the purpose of code signing in application security?
- To encrypt the source code from unauthorized reading
- To verify the authenticity and integrity of software using a digital signature (Correct answer)
- To prevent reverse engineering of compiled binaries
- To license software to authorized users only
Correct answer: To verify the authenticity and integrity of software using a digital signature
Code signing uses a digital certificate to confirm the software's origin and that it has not been tampered with since it was signed.
Question 7: In a secure SDLC, during which phase should threat modeling ideally occur?
- Testing
- Deployment
- Design (Correct answer)
- Maintenance
Correct answer: Design
Threat modeling during the design phase identifies potential threats and security requirements early, when changes are least costly to implement.
SSCP Systems & Application Security 2
Which hardening technique involves disabling or removing unnecessary services, ports, and software from a system?