SSCP Practice Test 12 — 15 Questions

Question 1

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 2

Which TWO of the following are characteristics of a Mandatory Access Control (MAC) system?

Accepted Answer

Access decisions are based on security labels.. Mandatory Access Control (MAC) systems use security labels (e.g., classifications like Top Secret, Secret, Confidential) attached to subjects and objects. The operating system or reference monitor enforces access decisions based on these labels and a set of rules (e.g., the Bell-LaPadula model's simple security property and *-property), not at the discretion of users or owners. This ensures that access is determined by a central policy, typically implemented via labels in systems like SELinux or Trusted Solaris.

Answer

Access is determined by the owner of the object.

Answer

It uses roles to assign permissions.

Answer

Users can change permissions on their own objects.

Question 3

Which of the following is the correct order of steps in the change management process?

Accepted Answer

Change request, impact assessment, CAB approval, testing, implementation, post-implementation review. The standard change management process begins with submitting a change request, followed by impact assessment, CAB approval, testing, implementation, and finally post-implementation review.

Answer

Change request, CAB approval, impact assessment, testing, implementation, post-implementation review

Answer

Impact assessment, change request, CAB approval, testing, implementation, post-implementation review

Answer

Change request, testing, impact assessment, CAB approval, implementation, post-implementation review

Question 4

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

Accepted Answer

Key performance indicator (KPI). A key performance indicator (KPI) measures the performance of a process or activity. Patch compliance rates are common KPIs for patch management, indicating how well the organization is meeting patching objectives.

Answer

Service level agreement (SLA)

Answer

Control objective

Answer

Key risk indicator (KRI)

Question 5

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Accepted Answer

Use the intercom to contact security. The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.

Answer

Return through the first door

Answer

Force the second door open

Answer

Wait for someone to open from the other side

Question 6

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 7

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

Accepted Answer

Prioritize patching based on vulnerability criticality. To improve patch compliance, prioritize patching based on vulnerability criticality to address highest risk first.

Answer

Increase the frequency of vulnerability scans

Answer

Disable automatic updates to prevent issues

Answer

Exclude non-critical systems from patching

Question 8

A security awareness training program aims to reduce successful phishing attacks. Which metric is most appropriate for measuring the effectiveness of this training?

Accepted Answer

Percentage of employees who click simulated phishing links. The primary goal is to reduce user susceptibility, so tracking the number of employees who click on simulated phishing links directly measures behavior change.

Answer

Training completion rate

Answer

Number of reported phishing emails

Answer

Number of security incidents caused by phishing

Question 9

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

Accepted Answer

Deny. The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).

Answer

Permit

Answer

Indeterminate

Answer

Not applicable

Question 10

Which two components are integral to a Kerberos authentication system? (Select TWO)

Accepted Answer

Key Distribution Center (KDC). The Key Distribution Center (KDC) is the core component of a Kerberos authentication system, responsible for issuing tickets and managing session keys. The Ticket Granting Ticket (TGT) is a temporary credential obtained from the Authentication Server (AS) within the KDC, used to request service tickets without re-entering credentials. Both are integral to the Kerberos protocol (RFC 4120) for secure, ticket-based authentication.

Answer

Authentication Server (AS)

Answer

Certificate Authority (CA)

Answer

Security Assertion Markup Language (SAML)

Question 11

A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is designed to establish a baseline of normal user activity and detect anomalies such as a privileged account logging in from an unusual geographic location after hours. Unlike signature or rule-based tools, UBA uses statistical modeling and machine learning to identify deviations from the user's historical patterns, making it ideal for detecting this type of credential misuse.

Answer

Signature-based IDS

Answer

Network-based IPS

Answer

Host-based IDS

Question 12

A company uses virtual machines for development. To ensure isolation between VMs on the same host, which control is most important?

Accepted Answer

Virtual network segmentation. Virtual network segmentation prevents VM-to-VM attacks by isolating traffic. Hypervisor patching is important for security but does not directly provide isolation. Strong passwords protect console access but not network traffic. Antivirus protects within each VM but not between them.

Answer

Antivirus on each VM

Answer

Hypervisor patching

Answer

Strong passwords for VM consoles

Question 13

You work for a financial services firm that must comply with GDPR and PCI DSS. The company uses a cloud-based CRM to store customer data. The security team recently discovered that the CRM vendor had a data breach that exposed the company's customer records. An investigation shows that the breach occurred because the vendor did not have multi-factor authentication (MFA) enabled for administrative accounts. The contract with the vendor states that the vendor is responsible for security of their platform. However, your company had not conducted a risk assessment of the vendor before signing the contract. Management wants to improve risk identification for third-party relationships. Which of the following is the BEST long-term solution?

Accepted Answer

Implement a third-party risk management program with periodic security assessments and contractual security requirements. A third-party risk management (TPRM) program with periodic security assessments and contractual security requirements directly addresses the root cause: the lack of pre-contract risk identification and ongoing vendor oversight. By embedding MFA requirements into contracts and performing regular assessments (e.g., reviewing SOC 2 reports, conducting penetration tests), the company can proactively enforce security controls like MFA for administrative accounts, preventing future breaches. This is a sustainable, long-term solution that aligns with GDPR and PCI DSS due diligence obligations.

Answer

Demand that the vendor reimburse the company for breach costs

Answer

Cancel the contract with the vendor and move to a private cloud solution

Answer

Require all vendors to provide SOC 2 reports

Question 14

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, process list, disk image. Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Answer

Disk image, memory dump, process list, network connections

Answer

Process list, memory dump, disk image, network connections

Answer

Network connections, memory dump, process list, disk image

Question 15

A large financial institution has deployed a new web application for customer account management. The application uses role-based access control (RBAC) with roles such as Customer, Teller, Manager, and Admin. Recently, an audit revealed that a Teller was able to view and modify account details belonging to customers outside their assigned branch. The application authenticates users via the corporate Active Directory and uses AD groups for role mapping. The Teller's AD group membership was verified to be correct. The security team suspects a flaw in the authorization logic. Which of the following is the MOST likely root cause?

Accepted Answer

The application fails to validate the user's branch attribute after authentication.. The Teller's AD group membership was verified correct, so the role mapping (RBAC) is functioning. However, the Teller could access accounts outside their assigned branch, indicating the application lacks a post-authentication check of the user's branch attribute. This is a classic failure of attribute-based access control (ABAC) within an RBAC framework, where the application must validate the user's branch (e.g., from an AD attribute like 'physicalDeliveryOfficeName' or a custom attribute) against the account's branch before allowing read/write operations.

Answer

The application's role-to-permission mapping is based on group SID rather than group name.

Answer

The application does not perform proper session management.

Answer

The application uses a horizontal privilege escalation vulnerability.