SSCP Practice Test 13 — 15 Questions

Question 1

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

Accepted Answer

The service is using cached credentials that are out of sync with the domain controller.. Service accounts used for automated backups typically run as services that cache their credentials locally. When the password is changed on the domain controller, the cached credentials in the service's logon session become out of sync. The service repeatedly attempts to authenticate with the stale cached password, causing rapid lockout events within a short window.

Answer

The service account's certificate has expired.

Answer

A brute force attack is targeting the service account.

Answer

The account password has expired and needs to be reset.

Question 2

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

Accepted Answer

Risk monitoring. Option D is correct because the analyst is actively monitoring the VPN gateway for security events (failed logins) and then adjusting controls (lockout threshold, geo-IP blocking) in response to observed threats. This continuous observation and adjustment is the essence of risk monitoring, which is the ongoing process of tracking identified risks and evaluating the effectiveness of controls. The actions taken are not about identifying new risks, assessing their likelihood/impact, or formally reporting them, but rather about reacting to real-time data to maintain an acceptable risk posture.

Answer

Risk identification

Answer

Risk assessment

Answer

Risk reporting

Question 3

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack is most likely occurring because the exhibit shows repeated login attempts with different passwords for the same username, which is the hallmark of an automated password guessing attack. The rapid succession of failed authentication events indicates a systematic trial of credentials, not a single intercepted session or resource exhaustion.

Answer

Man-in-the-middle attack

Answer

Denial of service attack

Answer

Social engineering attack

Question 4

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Accepted Answer

Remove the users from the security group that grants access to the drives.. The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Answer

Delete the user accounts of the affected employees.

Answer

Reconfigure the shared drive to deny access to all users except HR.

Answer

Manually remove each user's permissions on the shared drive.

Question 5

A company's incident response plan includes a step to preserve evidence. Which action BEST ensures the integrity of forensic evidence?

Accepted Answer

Create a forensic image with write blocker and hash. Option D is correct because creating a forensic image with a write blocker ensures that the original data is not altered during acquisition, and hashing (e.g., SHA-256) provides a cryptographic integrity check that can later verify the image is an exact bit-for-bit copy. This preserves the chain of custody and admissibility of evidence in legal proceedings.

Answer

Turn off the system immediately

Answer

Copy files to a network share

Answer

Run a checksum on the live system

Question 6

A security analyst sees the event log exhibit. What does this indicate?

Accepted Answer

A remote attacker attempted to log on as Administrator. The event log shows multiple failed logon attempts for the built-in Administrator account from a remote IP address (e.g., 10.0.0.5) using different passwords, which is a classic brute-force attack pattern. Event ID 4625 (Windows Security Log) with Logon Type 3 (Network logon) and a non-zero workstation name or source network address confirms the attempts originated remotely, not from the console. This indicates a remote attacker is systematically trying to guess the Administrator password.

Answer

A local user typed wrong password at the console

Answer

An attacker used a nonexistent account

Answer

The Administrator account is locked out

Question 7

A company's policy requires that all data at rest be encrypted. Which of the following is the most effective method to encrypt files on a laptop?

Accepted Answer

Implement full disk encryption (FDE).. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, swap files, temporary files, and all user data. This ensures that if the laptop is lost or stolen, all data at rest is protected without relying on the user to selectively encrypt files or folders, which can leave sensitive data exposed in unencrypted system areas.

Answer

Encrypt only the user's home folder.

Answer

Encrypt individual files using a symmetric key.

Answer

Use a self-extracting encrypted archive.

Question 8

A security analyst detects unusual outbound traffic from a server that normally communicates only with internal systems. The firewall logs show connections to an external IP address on port 443/tcp. Which incident response step should the analyst perform FIRST?

Accepted Answer

Isolate the server from the network.. The unusual outbound traffic to an external IP on port 443/tcp from a server that normally only communicates internally indicates a potential compromise, such as a command-and-control (C2) channel. The first priority in incident response is containment to prevent further data exfiltration or lateral movement, and isolating the server from the network achieves this without destroying volatile evidence. Shutting down the server or running an antivirus scan could destroy memory-resident malware or forensic artifacts, violating the order of volatility.

Answer

Run a full antivirus scan on the server.

Answer

Immediately shut down the server.

Answer

Disconnect the entire network segment.

Question 9

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Accepted Answer

The client does not trust the issuing CA.. The 'unable to get local issuer certificate' error from OpenSSL s_client indicates that the client (the machine running the command) does not have the issuing Certificate Authority (CA) certificate in its trust store. This means the client cannot verify the server certificate's chain of trust. Option B is correct because the error specifically points to a missing or untrusted CA certificate on the client side, not a problem with the server's private key, self-signing, or expiration.

Answer

The server's private key is missing.

Answer

The server certificate is self-signed.

Answer

The server certificate has expired.

Question 10

A security analyst is reviewing logs and finds multiple failed login attempts from an external IP address followed by a successful login. Which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack involves systematically trying all possible password combinations until the correct one is found. The log pattern of multiple failed attempts from a single external IP followed by a success is the classic signature of a brute force attack, as the attacker iterates through a password list or character space against the same username.

Answer

Password spraying

Answer

Credential stuffing

Answer

Social engineering

Question 11

Refer to the exhibit. A network engineer is configuring an IPsec VPN. Which protocol does this configuration apply to?

Accepted Answer

IKE (Internet Key Exchange). The configuration shown in the exhibit is for an IPsec VPN, which relies on IKE (Internet Key Exchange) to establish security associations and negotiate cryptographic keys. IKE (RFC 7296) is the mandatory key management protocol for IPsec, handling authentication and key exchange over UDP ports 500 and 4500. Without IKE, IPsec cannot dynamically negotiate the encryption and hashing parameters required for secure tunnel establishment.

Answer

HTTPS

Answer

SSH

Answer

SSL/TLS

Question 12

Drag and drop the steps for implementing a patch management process into the correct order.

Question 13

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Question 14

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 15

Match each network security device to its function.