SSCP Systems & Application Security

Question 1

Which secure software development practice involves reviewing code to identify security flaws before deployment?

Accepted Answer

Static code analysis

Answer

Static code analysis examines source code without executing it to find security vulnerabilities early in the development lifecycle.

Question 2

What is the primary purpose of application whitelisting?

Accepted Answer

Allowing only pre-approved applications to execute

Answer

Application whitelisting permits only explicitly approved programs to run, preventing unauthorized or malicious software from executing.

Question 3

Which vulnerability is caused when an application processes more data than a fixed-size memory buffer can hold?

Accepted Answer

Buffer overflow

Answer

A buffer overflow occurs when input data exceeds the allocated buffer size, potentially allowing attackers to overwrite adjacent memory and execute arbitrary code.

Question 4

In the context of patch management, what does 'patch prioritization' primarily consider?

Accepted Answer

The severity of the vulnerability and asset criticality

Answer

Patch prioritization weighs the CVSS severity score of the vulnerability against the criticality of the affected asset to determine remediation order.

Question 5

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To filter and monitor HTTP traffic to protect web applications from attacks

Answer

A WAF inspects HTTP/HTTPS traffic between a web application and the internet, blocking common attacks like SQL injection and XSS.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Systems & Application Security