SSCP Practice Test 10 — 10 Questions

Question 1

After a ransomware incident, the incident response team is conducting recovery. Which THREE steps are essential to ensure a secure restoration and prevent reinfection? (Choose three.)

Accepted Answer

Perform a full system scan with updated antivirus on the restored system.. Option C is correct because after restoring data or a system image, a full scan with up-to-date antivirus signatures is needed to detect any residual malware that may have been present in the backup or reintroduced during restoration, preventing reinfection. Option D is correct because ransomware and other malware often establish persistence via Run/RunOnce registry keys, services, scheduled tasks, and Startup folders; these must be identified and removed so the threat cannot re-execute after reboot. Option E is correct because the initial compromise vector—such as an unpatched SMB, RDP, or VPN vulnerability—must be remediated; otherwise the same exploit can be used again to reinfect the restored system. Option A is not appropriate because restoring from a backup without verifying its integrity risks reintroducing corrupted or already-infected data. Option B is not appropriate because reconnecting to the network immediately after restoration, before scanning, patching, and removing persistence, exposes the system to reinfection and lateral movement.

Answer

Restore from the most recent backup available, regardless of its integrity.

Answer

Reconnect the system to the network immediately after restoration to test functionality.

Question 2

Which Windows feature provides mandatory integrity controls and helps prevent unauthorized changes to system settings by requiring administrator approval?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the Windows feature that enforces mandatory integrity controls and prompts for administrator approval before allowing changes that require elevated privileges. It ensures that even administrator accounts run with standard-user rights by default and must explicitly consent to elevation, preventing unauthorized system changes.

Answer

Windows Defender Application Control

Answer

Security Audit Policy

Answer

Group Policy

Question 3

After containing a malware outbreak, the incident response team needs to ensure the malware is completely removed from all systems. Which phase of the incident response process is this?

Accepted Answer

Eradication. The eradication phase is specifically focused on removing the root cause of the incident, such as deleting malware files, registry keys, and disabling malicious services from all affected systems. After containment (which stops the spread), eradication ensures the threat is completely eliminated before recovery begins. This aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment and precedes recovery.

Answer

Post-Incident

Answer

Detection

Answer

Recovery

Question 4

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). SLE is asset value ($5,000,000) times exposure factor (40%) = $2,000,000. Then ALE = $2,000,000 × 0.5 = $1,000,000. This quantitative risk analysis formula is standard in financial risk assessments for payment systems.

Answer

$800,000

Answer

$2,000,000

Answer

$2,500,000

Question 5

A Linux system administrator needs to restrict network traffic to a server, allowing only HTTP and HTTPS from the internet. Which tool should be used to configure packet filtering rules?

Accepted Answer

iptables. iptables is the standard Linux user-space utility for configuring the kernel's Netfilter packet filtering rules, including allowing only HTTP (TCP 80) and HTTPS (TCP 443) from the internet. It operates at the network layer and is the correct tool for host-based firewall configuration on Linux.

Answer

PAM

Answer

SELinux

Answer

auditd

Question 6

Drag and drop the steps for implementing a patch management process into the correct order.

Accepted Answer

Step 1: Inventory, Step 2: Assess, Step 3: Test, Step 4: Deploy, Step 5: Verify. The correct order for patch management is Inventory, Assess, Test, Deploy, Verify. This sequence ensures that all systems are identified, patches are evaluated, tested to avoid disruptions, deployed safely, and finally confirmed as applied correctly.

Answer

Step 1: Assess, Step 2: Inventory, Step 3: Test, Step 4: Deploy, Step 5: Verify

Answer

Step 1: Inventory, Step 2: Test, Step 3: Assess, Step 4: Deploy, Step 5: Verify

Answer

Step 1: Inventory, Step 2: Assess, Step 3: Deploy, Step 4: Test, Step 5: Verify

Question 7

A company wants to ensure that data transmitted between its two branch offices remains confidential. Which cryptographic goal is primarily being addressed?

Accepted Answer

Confidentiality. Confidentiality ensures that data is accessible only to authorized parties, typically achieved through encryption. In this scenario, the company wants to prevent unauthorized interception of data between branch offices, which is the core goal of confidentiality. Technologies such as IPsec VPNs or TLS are used to encrypt the data in transit, directly addressing this requirement.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 8

An organization implements a hybrid encryption scheme to secure sensitive emails. The email body is encrypted with AES-256, and the AES key is encrypted with RSA-2048. What is the primary advantage of this approach?

Accepted Answer

Combines performance of symmetric with secure key distribution of asymmetric. Hybrid encryption combines the speed of symmetric encryption (AES-256) for bulk data with the secure key distribution of asymmetric encryption (RSA-2048). The symmetric key encrypts the email body efficiently, while the asymmetric key encrypts only the symmetric key, solving the key distribution problem without sacrificing performance.

Answer

Ensures forward secrecy

Answer

Simplifies key management by using a single key

Answer

Provides non-repudiation for the email

Question 9

A company's backup strategy includes weekly full backups and daily differential backups. A ransomware attack occurred on Wednesday, corrupting data. The last full backup was Sunday. Which backup set should be restored first?

Accepted Answer

Sunday full backup. The correct restoration order is to first restore the Sunday full backup, because differential backups contain all changes since the last full backup. Without the full backup as a base, the differential backups cannot be applied. After restoring the full backup, you would then apply the most recent differential backup (Wednesday) to bring the data to the point just before the attack.

Answer

Wednesday differential backup

Answer

Monday differential backup

Answer

Tuesday differential backup

Question 10

Which type of IDS uses a database of known attack patterns to identify malicious activity?

Accepted Answer

Signature-based IDS. Signature-based IDS (D) is correct because it relies on a pre-defined database of known attack patterns, or signatures, to match against network traffic or system activity. When a packet or event matches a signature, the IDS generates an alert. This is the traditional method used by systems like Snort, which compares traffic against rule sets containing specific byte sequences or protocol anomalies.

Answer

Behavior-based IDS

Answer

Network-based IDS

Answer

Anomaly-based IDS