SSCP Practice Questions: Systems and Application Security Domain

Correct Answer: D

Explanation: A file integrity monitoring tool is specifically designed to detect unauthorized changes to files and can provide detailed information about what was altered. While the 'last' command, log examination, and bash history can provide context, they do not directly identify file changes.

Correct Answer: A

Explanation: Resetting passwords for all users is the immediate action to prevent further unauthorized access using compromised credentials. Implementing MFA and updating policies are important but take time. Revoking all access could disrupt legitimate operations.

Correct Answer: D

Explanation: Option D is correct because successful logins from an unfamiliar IP address outside normal business hours are suspicious and may indicate unauthorized access. Option A is relevant but less critical than successful unauthorized access. Option B is normal behavior and not immediately suspicious. Option C is unrelated to access control and not useful for this investigation.

Correct Answer: C

Explanation: Reviewing and applying only critical security patches (C) is a balanced approach that addresses the most serious vulnerabilities quickly without risking system stability. Scheduling a maintenance window (A) might delay critical patches. Applying all patches immediately (B) could lead to unexpected downtime or compatibility issues. Isolating the server (D) might not be feasible for a critical server.

Correct Answer: A

Explanation: Forwarding logs from all servers to a centralized SIEM system is crucial for comprehensive monitoring and analysis of security events across the environment. While antivirus, network segmentation, and a web application firewall are important security measures, they do not provide the centralized visibility and correlation capabilities that a SIEM does.

Correct Answer: B

Explanation: The most likely reason for the firewall rules not being applied as expected is that they are in the wrong order, causing conflicts. Firewalls process rules in a top-down manner, and incorrect ordering can lead to unintended access or blocking. While other factors could contribute, rule order is a common source of such issues.

Correct Answer: A

Explanation: Using prepared statements and parameterized queries (A) is the most effective way to prevent SQL injection attacks by ensuring that user inputs are treated as data, not executable code. A WAF (B) can help but is not foolproof. Sanitizing inputs (C) is less effective than parameterization. Encrypting data (D) is important for data protection but does not prevent SQL injection.

Correct Answer: A

Explanation: Conducting a code review to identify and fix the vulnerable code is the most direct way to address SQL injection vulnerabilities. While a WAF can help filter malicious inputs, it should not be the primary defense. Updating the DBMS and changing credentials do not address the root cause of the vulnerability.

Correct Answer: D

Explanation: Option D is correct because implementing account lockout policies can immediately prevent further unauthorized access attempts. Option A may not be effective if the attacker changes IP addresses. Option B is a good practice but does not address the immediate threat. Option C is premature at this stage, as it is more appropriate after immediate threats are mitigated.

Correct Answer: C

Explanation: Option C is correct because Role-Based Access Control (RBAC) assigns access based on user roles, ensuring users have only the permissions necessary for their job functions. Option A, DAC, allows users to control access to their resources, which might not enforce strict access controls. Option B, MAC, is more rigid and typically used in environments requiring high security, like military systems. Option D, ABAC, is more complex and based on attributes, which might be overkill for simple role-based access.