SSCP Practice Test 10 — 10 Questions

Question 1

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Accepted Answer

Risk register. The risk register is the formal document used to track identified risks, their assessed likelihood and impact, and the chosen risk response. When a residual risk remains after controls are implemented, the risk register records that residual risk level and formally documents management's decision to accept it, including the rationale and approval. This ensures auditability and accountability for the accepted risk.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Security baseline

Question 2

A security analyst is reviewing network device logs and finds multiple failed SSH login attempts from a single external IP. Which three actions should the analyst take to mitigate this brute-force attack? (Choose three.)

Accepted Answer

Disable password-based authentication for SSH.. Disabling password-based authentication for SSH (Option B) eliminates the primary vector for brute-force attacks, as attackers cannot guess passwords. This forces the use of cryptographic key pairs, which are computationally infeasible to brute-force. Combined with an ACL to block the offending IP (Option C) and enabling only public key authentication (Option D), these three actions directly mitigate the ongoing and future brute-force attempts.

Answer

Increase the SSH login timeout.

Answer

Change the SSH port to a non-standard port.

Question 3

In the context of risk assessment, which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that can be exploited. In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Answer

A potential event that can cause harm

Answer

The likelihood of a threat exploiting a weakness

Answer

An actual occurrence of a harmful event

Question 4

Which protocol is used to automatically assign IP addresses to devices on a network?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. This eliminates the need for manual IP configuration and reduces the risk of address conflicts.

Answer

ARP

Answer

DNS

Answer

ICMP

Question 5

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Accepted Answer

User behavior risk indicator. The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Answer

Technical vulnerability indicator

Answer

Error log indicator

Answer

Configuration drift indicator

Question 6

A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?

Accepted Answer

Authentication will fail because the time difference exceeds the default Kerberos clock skew limit. Kerberos authentication relies on timestamps to prevent replay attacks. The default maximum clock skew allowed between a client and a domain controller is 5 minutes (as defined in RFC 4120). Since the workstation is exactly 5 minutes ahead, it meets the threshold, but any additional delay or network latency can cause the timestamp to exceed the limit, resulting in authentication failure. Therefore, the user will be unable to authenticate.

Answer

The user would be prompted for credentials but authentication would proceed

Answer

Only NTLM authentication would be affected

Answer

No impact; Kerberos can tolerate up to 10 minutes of skew

Question 7

An organization suspects a security incident. Which initial step should the incident response team take?

Accepted Answer

Protect evidence. The initial step in incident response is to protect evidence (Option B) because preserving forensic data ensures the integrity of logs, memory dumps, and disk images for later analysis. According to NIST SP 800-61, the first priority after detection is to secure volatile data (e.g., RAM, network connections) before it is lost, which is critical for determining the scope and root cause of the incident.

Answer

Contain the incident

Answer

Identify the attacker

Answer

Notify law enforcement

Question 8

Which protocol is used for secure web browsing and operates on TCP port 443?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Answer

HTTP

Answer

SSH

Answer

FTP

Question 9

A helpdesk ticket reports that users can browse internal web servers but cannot access external websites. The IT team checks firewall logs and sees dropped packets with the DF flag set. What is the most likely cause?

Accepted Answer

A firewall is blocking ICMP 'fragmentation needed' messages, preventing Path MTU Discovery.. The DF (Don't Fragment) flag being set in dropped packets indicates that packets are too large to traverse a network path without fragmentation, but the firewall is blocking the ICMP 'fragmentation needed' (Type 3, Code 4) messages. Without these ICMP messages, Path MTU Discovery (PMTUD) fails, causing the sending host to believe the packet was delivered when it was actually dropped. This prevents external websites from loading while internal servers (likely on the same MTU-friendly network) remain accessible.

Answer

The firewall is blocking outbound TCP port 80 and 443.

Answer

The DNS server is not resolving external domain names.

Answer

The switch port connecting the firewall is set to the wrong VLAN.

Question 10

A user reports they cannot access the internet. The network administrator verifies that the user's workstation has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1. The administrator can ping the default gateway but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway has no route to the internet. The administrator can ping the default gateway (192.168.1.1) but cannot ping 8.8.8.8. This indicates that Layer 2 and Layer 3 connectivity within the local subnet is working, but traffic cannot reach the internet. The most likely cause is that the default gateway does not have a route to the internet, meaning it cannot forward packets beyond its local interface to an upstream router or ISP.

Answer

Firewall is blocking outbound traffic to port 53

Answer

DNS server is down

Answer

The workstation's subnet mask is incorrect

Answer

The network cable is faulty