SSCP Practice Test 13 — 15 Questions

Question 1

A medium-sized company recently experienced a phishing attack where an employee downloaded a malicious attachment, leading to a data breach. The incident response team has identified the affected user and the malware. However, the team is unsure whether the attacker has established persistence. The security analyst must recommend the next step. The company has a standard incident response plan that includes detection, containment, eradication, recovery, and lessons learned. The malware sample has been isolated for analysis. The user's account has been disabled temporarily. The network team has quarantined the user's workstation. The analyst needs to ensure the attacker cannot regain access after the initial cleanup. What should the analyst recommend next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check system logs for unauthorized registry modifications, scheduled tasks, or startup entries.. The immediate priority after containment is to identify and remove any persistence mechanisms the attacker may have established. Checking system logs for unauthorized registry modifications (e.g., Run keys), scheduled tasks (e.g., schtasks), and startup entries (e.g., Startup folder or services) directly addresses the uncertainty about persistence. This step ensures the attacker cannot regain access after cleanup, aligning with the eradication phase of the incident response plan.

Answer

Perform a full malware analysis of the file to understand its capabilities.

Answer

Notify affected customers immediately as required by data breach notification laws.

Answer

Reimage the user's workstation from a known good backup.

Question 2

Which backup strategy is MOST suitable for a server with an RTO of 4 hours and an RPO of 15 minutes?

Accepted Answer

Full backup daily, transaction log backup every 15 minutes. A full backup daily combined with transaction log backups every 15 minutes meets the RPO of 15 minutes by allowing point-in-time recovery to within that window, and the full backup ensures the RTO of 4 hours is achievable because restoring the full backup plus the transaction logs is a well-understood process that can complete within the time limit. Transaction log backups capture every committed change, enabling granular recovery without requiring a full backup more frequently.

Answer

Full backup daily

Answer

Full backup monthly, incremental daily

Answer

Full backup weekly, differential daily

Question 3

An organization's incident response plan is tested annually. After a real incident, the team finds that the plan did not address cloud-based assets. What is the BEST action?

Accepted Answer

Update the incident response plan to include cloud scenarios. The plan should be updated to include cloud assets. Option D is correct. Option A only addresses the symptom; Option B may be unnecessary; Option C adds complexity.

Answer

Migrate all cloud assets back on-premises

Answer

Retrain the IR team on cloud incident response

Answer

Create a separate cloud incident response plan

Question 4

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Accepted Answer

SCAP scanner. SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Answer

Vulnerability scanner

Answer

Asset management database

Answer

SIEM

Question 5

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

Accepted Answer

Implement VLANs to separate departments and use a router-on-a-stick configuration with a capable router.. Implementing VLANs segments the flat network into smaller broadcast domains, reducing ARP and broadcast traffic, which improves performance. A router-on-a-stick configuration using a capable router that supports VLAN routing (802.1Q trunking) allows inter-VLAN communication without requiring a new switch, addressing both performance and security concerns without purchasing new hardware.

Answer

Divide the network into multiple subnets and connect each to a separate port on the cable modem.

Answer

Upgrade the router to a business-grade model that supports VLAN routing and keep the network flat.

Answer

Replace the switch with a layer 3 switch to route between VLANs without a router.

Question 6

During a security incident, the IR team collects memory dumps from an infected workstation. The analysis reveals a process injecting code into 'svchost.exe'. Which technique is most likely being used?

Accepted Answer

DLL injection. DLL injection is the most likely technique because it involves a process loading a malicious DLL into the address space of a legitimate process like svchost.exe. This is typically achieved using Windows API calls such as CreateRemoteThread and LoadLibrary, allowing the attacker to execute code within the trusted svchost.exe context, evading detection by blending in with legitimate system processes.

Answer

Process hollowing

Answer

Reflective DLL injection

Answer

Token stealing

Question 7

During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

High. In a typical 3x3 risk matrix, a combination of Medium likelihood and High impact results in a High risk rating.

Answer

Medium

Answer

Low

Answer

Critical

Question 8

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

Accepted Answer

Risk transfer. Transferring risk to a third party (cloud provider) is risk transfer.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 9

Which of the following is the primary purpose of a chain of custody form in digital forensics?

Accepted Answer

To track the possession and handling of evidence from collection to presentation. Chain of custody documents who handled the evidence, when, and why, ensuring it remains admissible in court.

Answer

To document the steps taken to contain an incident

Answer

To record the hash values of forensic images

Answer

To provide a list of approved forensic tools

Question 10

An organization uses a cloud-based file synchronization service to share project files with external partners. The security team discovers that an unauthorized third party accessed sensitive documents by guessing weak passwords. Which additional control would most effectively mitigate this risk?

Accepted Answer

Enforcing multi-factor authentication for all external users.. Multi-factor authentication directly addresses credential guessing by requiring a second factor. Option B is incorrect because SFTP does not inherently provide stronger authentication than HTTPS. Option C is incorrect because file-level encryption with on-premises keys does not prevent unauthorized access if the attacker already has valid credentials. Option D is incorrect because a custom domain certificate does not affect authentication strength.

Answer

Requiring all file transfers to use SFTP instead of HTTPS.

Answer

Implementing file-level encryption with keys stored on-premises.

Answer

Configuring the service to use a custom domain certificate.

Question 11

You work for a hospital that has recently transitioned to an electronic health record (EHR) system. The system stores protected health information (PHI) and must comply with HIPAA. The hospital's security policy requires that all access to PHI be logged and that any unauthorized access be detected promptly. The IT department has implemented logging on the EHR system, but the security team is overwhelmed by the volume of logs and cannot review them in a timely manner. Additionally, there have been incidents where employees accessed patient records without a legitimate need, but these were only discovered months later during random audits. The hospital needs to improve its detection capabilities. Which of the following is the most effective solution?

Accepted Answer

Deploy a Security Information and Event Management (SIEM) system with automated alerting.. A SIEM system aggregates logs from the EHR system and applies correlation rules to detect patterns indicative of unauthorized access, such as an employee viewing records outside their department or during off-hours. It generates real-time alerts, enabling the security team to respond promptly rather than relying on manual log review. This directly addresses the problem of being overwhelmed by log volume and delayed detection.

Answer

Retain logs for a longer period to allow more thorough audits.

Answer

Assign additional staff to manually review logs on a daily basis.

Answer

Increase the verbosity of logging to capture more details.

Question 12

A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?

Accepted Answer

Classify the severity of the potential incident. According to incident response best practices, after initial detection, the next step is to classify the severity of the potential incident to prioritize response efforts.

Answer

Escalate the incident to senior management

Answer

Isolate the workstation from the network immediately

Answer

Perform a forensic memory capture

Question 13

Based on the exhibit, if the user attempts to upload (write) a file to the shared data repository corporate-data, what is the result?

Accepted Answer

Denied because the explicit deny overrides any allow. The resource's access control policy includes an explicit deny statement that denies write permission for the user's principal. In standard access control policy evaluation, an explicit deny always overrides any allow, regardless of other permissions. Therefore, even if other statements allow write access, the explicit deny blocks the upload.

Answer

Allowed because the access policy likely allows public writes

Answer

Denied because write permission is not explicitly allowed

Answer

Allowed because the policy also allows read access

Question 14

An organization wants to implement a key exchange mechanism that provides forward secrecy. Which of the following should be used?

Accepted Answer

Ephemeral Diffie-Hellman. Ephemeral Diffie-Hellman (DHE or ECDHE) provides forward secrecy because the session keys are ephemeral and not derived from long-term keys.

Answer

Pre-shared key

Answer

RSA key exchange

Answer

Static Diffie-Hellman

Question 15

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Full backup

Answer

Incremental backup

Answer

Snapshot backup