SSCP Practice Test 13 — 15 Questions

Question 1

A company has 200 employees using a Windows Active Directory environment. The security administrator receives multiple alerts that user accounts are being locked out every 15 minutes. The help desk confirms that users who report the issue are able to log in successfully after unlocking their accounts, but they get locked out again shortly after. The administrator checks the domain controller security logs and sees many failed logon attempts with a specific service account name 'svc_backup' from multiple workstations. The svc_backup account is used for a backup application that runs scheduled tasks. What should the administrator do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the password for svc_backup and update the backup application with the new password. Changing the password for svc_backup and updating the backup application with the new password is correct because the symptom pattern — repeated lockouts every 15 minutes from multiple workstations with failed logons for a single service account — is the classic signature of a stale cached credential. The backup application (or a scheduled task) is still presenting the old password, and each retry trips the domain account lockout threshold. Updating the credential in the application (and any dependent scheduled tasks/services) stops the failed attempts at the source.

Answer

Disable the svc_backup account until the backup vendor releases a patch

Answer

Create a new service account with a different name and grant it the same permissions

Answer

Increase the account lockout threshold to prevent lockouts

Question 2

An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?

Accepted Answer

Securing the application code from SQL injection. Under the shared responsibility model for PaaS, the cloud provider manages the physical infrastructure, the operating system, and the runtime environment, while the customer is responsible for the security of the application code and data they deploy. Securing application code against SQL injection is therefore the customer's responsibility because it involves how the application is written and how it handles input.

Answer

Physical security of the data center

Answer

Patching the web server runtime

Answer

Patching the underlying operating system

Question 3

Which of the following protocols is used to securely transfer files over SSH and is considered a replacement for FTP?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the protocol that runs over SSH to securely transfer files and is widely regarded as the secure replacement for FTP. It encrypts both commands and data within a single SSH connection, typically on port 22. HTTPS, IPsec, and SMTPS serve different purposes and are not FTP replacements over SSH.

Answer

IPsec

Answer

HTTPS

Answer

SMTPS

Question 4

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

Accepted Answer

Least privilege. Granting a service account domain administrator privileges violates the principle of least privilege, which states that accounts should have only the minimum permissions necessary to perform their required tasks. A service account typically needs limited, specific permissions, not full domain admin rights. This over-provisioning increases the attack surface and risk.

Answer

Need-to-know

Answer

Separation of duties

Answer

Accountability

Question 5

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Accepted Answer

The client does not trust the issuing CA.. The 'unable to get local issuer certificate' error from OpenSSL s_client indicates that the client (the machine running the command) does not have the issuing Certificate Authority (CA) certificate in its trust store. This means the client cannot verify the server certificate's chain of trust. Option B is correct because the error specifically points to a missing or untrusted CA certificate on the client side, not a problem with the server's private key, self-signing, or expiration.

Answer

The server's private key is missing.

Answer

The server certificate is self-signed.

Answer

The server certificate has expired.

Question 6

A small company uses a single firewall at the network perimeter. The security team receives alerts from an IDS but cannot correlate them with firewall logs because logs are stored on separate servers with different timestamps. The CEO wants to reduce false positives and improve incident response. What should the security team do first?

Accepted Answer

Implement a SIEM to aggregate and correlate logs from multiple sources.. A SIEM (Security Information and Event Management) system aggregates logs from multiple sources, normalizes timestamps, and correlates events to reduce false positives and improve incident response. This directly addresses the core problem of disparate log sources with unsynchronized timestamps, enabling effective correlation between IDS alerts and firewall logs without replacing existing infrastructure.

Answer

Increase the IDS sensitivity to catch more threats.

Answer

Replace the IDS with a next-generation firewall.

Answer

Manually align timestamps on each server daily.

Question 7

A company's vulnerability scanner reports a critical vulnerability in a third-party library. The remediation SLA for critical vulnerabilities is 48 hours. However, the patch is not yet available from the vendor. Which of the following is the most appropriate immediate action?

Accepted Answer

Implement compensating controls to mitigate the vulnerability. When a patch is unavailable, implementing compensating controls (e.g., network segmentation, WAF rules, disabling unused features) is the immediate action to reduce risk exposure while awaiting an official fix. This aligns with the NIST SP 800-40 risk mitigation framework, which prioritizes compensating controls when patching is not feasible. Simply removing the software (A) may break business operations, extending the SLA (B) violates policy, and accepting risk (C) ignores the need for active mitigation.

Answer

Remove the vulnerable software immediately

Answer

Extend the SLA to 30 days

Answer

Accept the risk because the vendor has not released a patch

Question 8

A company has a backup policy that performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server fails. How many backup sets are needed to restore the server to its state on Tuesday night?

Accepted Answer

Three. To restore the server to its state on Tuesday night, you need the full backup from Sunday and the incremental backups from Monday and Tuesday. Incremental backups only capture changes since the last backup (full or incremental), so you must restore them in sequence: full backup first, then Monday's incremental, then Tuesday's incremental. This requires three backup sets total, making option D correct.

Answer

One

Answer

Two

Answer

Four

Question 9

During an access control audit, you find that a user has been assigned to two mutually exclusive roles. Which TWO principles are most likely violated?

Accepted Answer

Least privilege. Option B (Least privilege) is correct because assigning a user to two mutually exclusive roles grants them more permissions than their job function requires, violating the principle that users should receive only the minimum access necessary to perform their duties. Option C (Separation of duties) is correct because mutually exclusive roles are specifically designed to prevent one person from holding conflicting responsibilities (e.g., initiating and approving a transaction), and assigning both to a single user directly defeats that control. Option A (Role hierarchy) is not necessarily violated, since a hierarchy merely organizes roles by inheritance and does not inherently prohibit holding two roles. Option D (Mandatory access control) is unrelated, as MAC relies on system-enforced labels and clearances rather than conflicting role assignments. Option E (Accountability) concerns traceability of actions to an individual, which is not directly breached by holding two mutually exclusive roles.

Answer

Role hierarchy

Answer

Mandatory access control

Answer

Accountability

Question 10

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Accepted Answer

Basic security hygiene with minimal impact. CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Answer

Maximum security with high operational impact

Answer

Equivalent to DISA STIGs

Answer

Only applicable to critical systems

Question 11

During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?

Accepted Answer

To prevent modification of the original evidence. A write blocker is a hardware or software device that intercepts and blocks any write commands from the forensic workstation to the source drive, ensuring that the original evidence remains unaltered during acquisition. This is critical for maintaining the integrity and admissibility of digital evidence in legal proceedings, as any modification could compromise the chain of custody and forensic soundness.

Answer

To encrypt the data during transfer

Answer

To speed up the imaging process

Answer

To verify the hash of the original drive

Question 12

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 13

Which TWO of the following are best practices for securing a wireless network?

Accepted Answer

Using WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Answer

Enabling MAC address filtering

Answer

Using WEP encryption

Answer

Leaving the default administrator password

Question 14

Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)

Accepted Answer

No write-up. Option A, 'No write-up,' is correct because the Biba integrity model's *-integrity axiom (the write-up rule) forbids a subject from writing to an object of higher integrity level, preventing low-integrity data from contaminating higher-integrity data. Option E, 'No read-down,' is correct because Biba's simple integrity axiom forbids a subject from reading an object of lower integrity level, preventing a high-integrity subject from being corrupted by low-integrity data. Option B, 'No write-down,' actually belongs to the Bell-LaPadula confidentiality model (the *-property), which restricts writing to lower or equal sensitivity levels, not to Biba. Option C, 'No read-up,' is also a Bell-LaPadula rule (the simple security property), prohibiting reading data at a higher classification, so it is not a Biba characteristic. Option D, 'Discretionary access,' describes discretionary access control (DAC) mechanisms such as owner-controlled ACLs, which are independent of the Biba mandatory integrity model and therefore not one of its defining characteristics.

Answer

No write-down

Answer

No read-up

Answer

Discretionary access

Question 15

In the context of risk assessment, which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that can be exploited. In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Answer

A potential event that can cause harm

Answer

The likelihood of a threat exploiting a weakness

Answer

An actual occurrence of a harmful event