SSCP Systems & Application Security 3

Question 1

Which technique tests an application by supplying random, unexpected, or malformed input to find vulnerabilities?

Accepted Answer

Fuzz testing

Answer

Regression testing

Answer

Unit testing

Answer

Integration testing

Question 2

What is the OWASP Top 10 primarily used for?

Accepted Answer

Listing the ten most critical web application security risks

Answer

Ranking the ten most dangerous cybercriminal groups worldwide

Answer

Defining the top ten compliance frameworks for software development

Answer

Providing the ten best practices for network firewall configuration

Question 3

What does 'defense in depth' mean in the context of systems security?

Accepted Answer

Applying multiple overlapping security controls so no single failure compromises the system

Answer

Using the deepest available encryption algorithms

Answer

Placing the most sensitive data in the innermost network segment

Answer

Conducting thorough security testing before any system goes live

Question 4

Which configuration management practice ensures that all changes to production systems are reviewed and approved before implementation?

Accepted Answer

Change control process

Answer

Baseline configuration

Answer

Configuration audit

Answer

Asset inventory management

Question 5

What is a 'sandbox' in the context of application security?

Accepted Answer

An isolated execution environment that restricts what a program can access or do

Answer

A test environment that mirrors production for software testing

Answer

A honeypot system designed to attract and trap malware

Answer

A container for storing cryptographic keys securely

Question 6

Which term describes the practice of keeping software current by applying vendor-released fixes for known vulnerabilities?

Accepted Answer

Patch management

Answer

Configuration management

Answer

Vulnerability disclosure

Answer

Software licensing

Question 7

What is the purpose of a 'security baseline' for a system?

Accepted Answer

It defines the minimum acceptable security configuration that all systems must meet

Answer

It records the highest level of security a system has ever achieved

Answer

It establishes the maximum number of users allowed on a system

Answer

It documents the history of all security incidents for a system