SSCP Systems & Application Security 3

Question 1

Which technique tests an application by supplying random, unexpected, or malformed input to find vulnerabilities?

Accepted Answer

Fuzz testing

Answer

Fuzz testing (fuzzing) automatically generates large volumes of invalid or unexpected inputs to uncover crashes, memory leaks, and security vulnerabilities.

Question 2

What is the OWASP Top 10 primarily used for?

Accepted Answer

Listing the ten most critical web application security risks

Answer

The OWASP Top 10 is a widely referenced awareness document listing the most critical security risks to web applications, used to guide secure development.

Question 3

What does 'defense in depth' mean in the context of systems security?

Accepted Answer

Applying multiple overlapping security controls so no single failure compromises the system

Answer

Defense in depth layers multiple independent security controls so that if one layer fails, others continue to protect the system.

Question 4

Which configuration management practice ensures that all changes to production systems are reviewed and approved before implementation?

Accepted Answer

Change control process

Answer

A change control process requires formal review and approval of system changes, reducing the risk of unauthorized or poorly planned modifications to production environments.

Question 5

What is a 'sandbox' in the context of application security?

Accepted Answer

An isolated execution environment that restricts what a program can access or do

Answer

A sandbox confines an application to a restricted environment, limiting its access to system resources and preventing it from affecting other processes.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Systems & Application Security 3