SSCP Practice Test 12 — 15 Questions

Question 1

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password history. The requirement that users cannot reuse any of the last 10 passwords is specifically addressing password history, which prevents users from cycling back to previous passwords. This element enforces a memory of past passwords to avoid reuse.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 2

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 3

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure (network, OS, hypervisor, runtime), while the customer is responsible for the security of their application code and data. Securing application code against SQL injection is therefore the customer's responsibility. The other options are provider-managed in PaaS.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 4

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

Accepted Answer

Smurf attack. A Smurf attack sends a flood of forged ICMP echo requests to a network's broadcast address with the source IP spoofed as the target's IP. All hosts on the network respond to the broadcast, overwhelming the target with ICMP echo replies. This is a classic amplification attack. Therefore, Smurf attack is correct.

Answer

Ping of death

Answer

SYN flood

Answer

DNS amplification

Question 5

An organization allows employees to use personal smartphones to access corporate email and data. Which control is MOST important to protect corporate data if a device is lost or stolen?

Accepted Answer

Implement remote wipe capability. Remote wipe capability is the most important control because it allows the organization to remotely erase corporate data from a lost or stolen device, directly mitigating the risk of unauthorized access. While encryption, strong passwords, and screen locks provide defense-in-depth, they do not guarantee data destruction if the device falls into the wrong hands. Remote wipe is the only control that ensures corporate data is removed from the device, addressing the specific threat of loss or theft.

Answer

Require device encryption

Answer

Require strong passwords with complexity requirements

Answer

Enforce a screen lock timeout of 1 minute

Question 6

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a small number of failed attempts directly defeats brute-force attacks by halting the attack after a threshold, regardless of password complexity. Even a 12-character complex password can eventually be brute-forced given unlimited attempts; lockout removes that unlimited-attempt advantage. This is the most effective additional control because it targets the attack mechanism itself rather than the password's guessability.

Answer

Use a password blacklist

Answer

Increase minimum password length to 16 characters

Answer

Require password change every 30 days

Question 7

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

Accepted Answer

To force the switch to act like a hub and allow packet sniffing. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of fake source MAC addresses, the attacker fills the CAM table, causing the switch to fail open and flood all incoming frames out all ports, effectively behaving like a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

To change the MAC address of the switch

Answer

To cause a denial of service on the network

Answer

To bypass 802.1X authentication

Question 8

A medium-sized financial services company has recently deployed a new web application that processes sensitive customer data, including Social Security numbers and account balances. The security team implemented network segmentation, a web application firewall (WAF) from a reputable vendor, and quarterly vulnerability scans. The developers assert that they use parameterized queries for all database calls in the main application code. During a recent penetration test, testers successfully exploited a SQL injection vulnerability, extracting the entire customer database. Further investigation reveals that the main application indeed uses parameterized queries, but a third-party reporting module, integrated to generate compliance reports, constructs SQL queries by concatenating user-supplied date range inputs directly into SQL strings. The WAF is configured with a generic rule set and has not been tuned to the application's specific traffic patterns. What is the most effective course of action to remediate this vulnerability and prevent future occurrences?

Accepted Answer

Replace the third-party reporting module with an alternative that uses parameterized queries.. The root cause is the third-party module's insecure query construction. Replacing it with a module that uses parameterized queries directly eliminates the vulnerability at its source. Input validation (A) is a defense-in-depth measure but not sufficient if concatenation is still used. Increasing scan frequency (C) does not fix the underlying issue. Configuring the WAF (D) provides a layer of defense but can be bypassed and is not as reliable as eliminating the vulnerable code.

Answer

Implement strict input validation to sanitize user-supplied date inputs.

Answer

Increase the frequency of vulnerability scans from quarterly to monthly.

Answer

Configure the WAF to block SQL injection patterns with custom rules.

Question 9

Which THREE are effective controls against internal network threats?

Accepted Answer

Network segmentation. Network segmentation (A) is correct because dividing the internal network into isolated zones (e.g., VLANs, subnets, or microsegmentation) limits lateral movement, so a compromised host cannot freely reach other internal systems. Employee security awareness training (B) is correct because many internal threats—such as phishing, social engineering, and accidental data mishandling—originate from insiders, and trained users are a primary preventive control. Data loss prevention (DLP) (E) is correct because DLP tools inspect and block sensitive data (e.g., PII, credit card numbers) from leaving or being exfiltrated across endpoints, email, and network channels, directly mitigating insider data theft or leakage. An IDS (C) is not among the correct answers because it is primarily a detective control that alerts on suspicious traffic rather than preventing internal threats. Single sign-on (D) is not among the correct answers because SSO is a convenience/authentication mechanism that centralizes access, and while it can aid auditing, it does not by itself control internal threats and can even widen exposure if credentials are compromised.

Answer

Intrusion detection system (IDS)

Answer

Single sign-on (SSO)

Question 10

A user reports that they cannot access a network share. The administrator checks the share permissions and NTFS permissions. The share permission allows Everyone: Read, and the NTFS permission allows the user: Full Control. What is the user's effective access?

Accepted Answer

Read. When accessing a network share, the effective permissions are the most restrictive of the share permissions and the NTFS permissions. Here, the share permission is Read and the NTFS permission is Full Control. The most restrictive permission is Read, so the user's effective access is Read.

Answer

Full Control

Answer

No access

Answer

Modify

Question 11

Which security control can prevent a rogue DHCP server from assigning incorrect gateway addresses to clients?

Accepted Answer

DHCP snooping. DHCP snooping is a switch feature that filters DHCP messages based on trusted ports, blocking rogue DHCP servers.

Answer

IP source guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 12

In RSA, the public exponent e is often chosen as 65537. What is the primary reason for this choice?

Accepted Answer

It offers a balance between security and performance due to low Hamming weight. 65537 (0x10001) has a low Hamming weight of only 2 bits set, which makes modular exponentiation significantly faster than using a random large exponent, while still providing strong security. This choice balances computational efficiency with cryptographic strength, as a larger exponent would slow down encryption without proportional security gains.

Answer

It ensures that the private key d is small

Answer

It prevents side-channel attacks

Answer

It provides the highest security level

Question 13

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

Accepted Answer

Perform a threat modeling exercise such as STRIDE. Threat modeling with STRIDE is the best approach because it systematically identifies threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) specific to the CRM's architecture, data flows, and trust boundaries. Unlike generic scans or assessments, STRIDE focuses on the unique attack surface of a cloud-based system, such as API endpoints, multi-tenancy risks, and shared responsibility model gaps.

Answer

Run a vulnerability scan on the CRM

Answer

Execute a business impact analysis (BIA)

Answer

Conduct a qualitative risk assessment using a generic framework

Question 14

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

Accepted Answer

User identity, time of day, and device compliance status. ABAC (Attribute-Based Access Control) evaluates policies against attributes of the subject, resource, action, and environment. To allow access only during business hours from a managed device, the policy must combine a time-of-day environmental attribute with a device compliance attribute, plus the user identity to identify the subject. Option B lists exactly these three: user identity, time of day, and device compliance status.

Answer

User department and document creation date

Answer

User role and document classification

Answer

Document owner and file size

Question 15

A company uses digital signatures to ensure the integrity and non-repudiation of internal contracts. The private key used for signing is stored in a hardware security module (HSM). A junior administrator asks why the HSM is necessary. What is the primary reason?

Accepted Answer

It provides non-repudiation by protecting the private key.. The primary reason for using an HSM is to protect the private key from unauthorized access or extraction. Non-repudiation relies on the assurance that only the legitimate signer could have used the private key; if the key is compromised, that assurance is lost. The HSM provides a tamper-resistant environment that performs signing operations internally, ensuring the private key never leaves the secure hardware.

Answer

It reduces network latency during signing.

Answer

It enables symmetric key exchange for large files.

Answer

It allows the signing process to be faster.