SSCP Practice Test 1 — 10 Questions

Question 1

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Accepted Answer

A malicious macro in a Word document executed the command.. The event shows a command prompt launching with a base64-encoded PowerShell command, which is a common technique used by malicious macros to download and execute payloads. Microsoft Office macros can invoke cmd.exe or PowerShell to bypass security controls, and the encoded command suggests obfuscation typical of malware, not legitimate software updates or user actions.

Answer

Microsoft Office is performing an automatic update.

Answer

A scheduled task triggered the command.

Answer

A user ran a legitimate command from the Start menu.

Question 2

A company has segmented its network into VLANs for different departments: HR, Finance, and IT. The router interconnecting the VLANs has ACLs configured to block traffic from HR to Finance. However, IT has noticed that traffic from HR VLAN is reaching the Finance VLAN. The network uses managed switches with 802.1Q trunking. All access ports are configured as untagged members of their respective VLANs. What is the most likely cause of this unauthorized traffic flow?

Accepted Answer

VLAN hopping attack via double tagging. The most likely cause is a VLAN hopping attack via double tagging. In this attack, an attacker on the HR VLAN sends a frame with two 802.1Q tags: the outer tag matches the native VLAN of the trunk (often VLAN 1), and the inner tag is the target VLAN (Finance). When the switch receives the frame on an access port, it strips the outer tag (as it is the native VLAN) and forwards the frame with the inner tag over the trunk, allowing the traffic to bypass the ACLs and reach the Finance VLAN.

Answer

DHCP snooping disabled

Answer

Default gateway misconfiguration

Answer

STP misconfiguration

Question 3

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Recovery Time Objective (RTO) is a key component of a Business Impact Analysis (BIA) because it defines the maximum acceptable downtime for a business process or system after a disruption. The BIA identifies critical functions and their dependencies, and RTO is derived from the financial and operational impact of downtime, directly informing recovery strategy and resource allocation.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 4

An organization uses role-based access control (RBAC). An employee transfers from the Sales department to the Marketing department. What is the most secure way to update the employee's access?

Accepted Answer

Remove the Sales role and then add the Marketing role. In RBAC, access is determined by the roles assigned to a user. The most secure method is to remove the old role (Sales) first to eliminate any residual permissions, then add the new role (Marketing). This ensures the employee does not retain access to Sales resources during the transition, adhering to the principle of least privilege.

Answer

Add the Marketing role and remove the Sales role after 30 days

Answer

Modify the Sales role to include Marketing permissions

Answer

Create a new custom role with combined permissions

Question 5

A cloud application uses OAuth 2.0 to authorize a third-party app to access user data. What is the primary purpose of the access token issued by the authorization server?

Accepted Answer

To grant the client application limited access to user's resources. In OAuth 2.0, the access token is a credential that represents the authorization granted to the client application by the resource owner. Its primary purpose is to allow the client to access specific, scoped resources on the resource server on behalf of the user, without exposing the user's credentials. This is defined in RFC 6749, where the token encapsulates the granted permissions and scope.

Answer

To revoke the user's access to the client application

Answer

To encrypt data exchanged between client and resource server

Answer

To authenticate the user to the resource server

Question 6

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Accepted Answer

Ability to detect previously unknown threats based on anomalous behavior. Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.

Answer

Requires less data processing than signature-based detection

Answer

Easier to configure and maintain

Answer

Lower false positive rates compared to signature-based detection

Question 7

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Accepted Answer

Reintroduction of unpatched vulnerabilities. Snapshots may contain outdated, unpatched software, reintroducing vulnerabilities when reverted.

Answer

VM escape via snapshot file corruption

Answer

Unauthorized access to snapshot data

Answer

Hypervisor memory exhaustion

Question 8

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Accepted Answer

User is terminated. When a user is terminated, their access must be immediately revoked to prevent unauthorized access to systems and data. This is a fundamental principle of access control, ensuring that former employees cannot exploit their credentials. Revocation typically involves disabling the user account, removing group memberships, and invalidating any active sessions or tokens.

Answer

User password expires

Answer

User completes quarterly training

Answer

User updates personal information

Question 9

Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks and their treatment. The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Answer

To record all security incidents after they occur

Answer

To track changes made to system configurations

Answer

To automatically detect vulnerabilities in the network

Question 10

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

Accepted Answer

24-72 hours. Critical vulnerabilities in internet-exposed systems typically require remediation within 24–72 hours under common SLAs (e.g., PCI DSS, NIST, or organizational security policies). This timeframe reflects the high risk of remote exploitation, where an attacker can compromise the server before a longer window expires.

Answer

90 days

Answer

7 days

Answer

30 days