SSCP Practice Test 1 — 10 Questions

Question 1

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 2

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Business Impact Analysis (BIA) identifies the critical business functions and the maximum tolerable downtime, so the Recovery Time Objective (RTO) is a core output — it defines how quickly a process or system must be restored after disruption, directly driving continuity and recovery strategies. Criticality analysis is also a key BIA component because it ranks business processes and assets by their importance to the organization, typically using impact categories such as financial, operational, legal, and reputational, which determines prioritization for recovery. Vulnerability assessment (B) is a risk-assessment activity that identifies weaknesses in systems, not a BIA component, and it focuses on exposure rather than business impact. Likelihood estimation (D) belongs to risk analysis, where the probability of a threat event is evaluated, whereas the BIA focuses on consequences and tolerances. Threat modeling (E) is a security design technique for identifying threats and attack paths, not a BIA element, since the BIA is threat-agnostic and centers on business process impact.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 3

Which of the following is a secure remote access VPN protocol that uses TLS for encryption and is commonly used with Cisco AnyConnect?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN uses TLS (typically over TCP port 443) to encrypt traffic and is the protocol underlying Cisco AnyConnect, which is a classic example of a client-based SSL VPN. It provides secure remote access without requiring IPsec's UDP ports, making it firewall-friendly.

Answer

IPsec

Answer

L2TP/IPsec

Answer

PPTP

Question 4

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Accepted Answer

Second pre-image resistance. When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.

Answer

Avalanche effect

Answer

Collision resistance

Answer

Pre-image resistance

Question 5

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

Accepted Answer

Deviation detection. SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Answer

Patch management

Answer

Vulnerability scanning

Answer

Asset management

Question 6

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the server is low criticality, a CVSS score of 9.8 with active exploitation represents an urgent risk that must be addressed. The administrator should prioritize patching through the change management process to ensure proper approval, testing, and documentation while still expediting the fix.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 7

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. Option C is correct because an incident response plan must include a communication plan with up-to-date contact information for key stakeholders (e.g., incident handlers, management, legal, PR, and law enforcement) so that notifications and escalations occur quickly and in the proper order during an incident. Option E is correct because detailed recovery procedures for each critical system provide the documented, tested steps (such as restoration order, RTO/RPO targets, and system-specific rebuild or failover instructions) needed to return operations to normal after containment and eradication. Option A is not essential to the plan itself, since vendor lists support logistics but are not a core IR plan component. Option B is incorrect and a security risk, as storing all employee passwords violates least privilege and credential-management best practices. Option D, while useful for scoping and containment, is supporting documentation rather than one of the two essential components emphasized here.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 8

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. A patch management process must include testing patches in a staging environment before production deployment to validate compatibility and avoid breaking critical systems. Without staging validation, patches can introduce regressions, incompatibilities, or outages in production. This is a critical gap because it removes the safety net that catches patch-related issues before they impact live operations.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 9

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 10

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, Reporting. NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Answer

Detection & Analysis, Containment/Eradication/Recovery, Preparation, Post-Incident Activity, Reporting

Answer

Preparation, Containment/Eradication/Recovery, Detection & Analysis, Post-Incident Activity, Reporting

Answer

Preparation, Detection & Analysis, Post-Incident Activity, Containment/Eradication/Recovery, Reporting