SSCP Practice Test 14 — 15 Questions

Question 1

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Accepted Answer

JavaScript execution in the browser's developer console that was not initiated by the user. XSS attacks often inject malicious JavaScript that executes in the victim's browser without user initiation. Observing unexpected script execution in the developer console indicates that an attacker's payload has run, which is a direct sign of a successful XSS exploit.

Answer

Unusual cookie values or multiple cookies

Answer

Unusual network traffic to external IP addresses

Question 2

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Accepted Answer

Implement DNSSEC to validate DNS responses. DNSSEC validates DNS responses to prevent spoofing, and using secure DNS resolvers (like Quad9 or Cloudflare) can filter malicious domains. Disabling recursion is a best practice but not a direct countermeasure against poisoning. DHCP snooping is for DHCP attacks. Firewalls don't prevent DNS poisoning.

Answer

Configure firewall rules to block UDP port 53

Answer

Disable DNS recursion on authoritative servers

Answer

Enable DHCP snooping on switches

Question 3

A security team is implementing Network Access Control (NAC) to enforce endpoint compliance before granting network access. Which technology allows port-based authentication on wired networks?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control, commonly used with RADIUS for authentication.

Answer

RADIUS

Answer

WPA2-Enterprise

Answer

MAC filtering

Question 4

A company is migrating from WPA2 to WPA3 for wireless security. Which THREE features does WPA3 introduce? (Select three)

Accepted Answer

192-bit security suite for Enterprise networks. WPA3 introduces SAE (Simultaneous Authentication of Equals) to replace PSK, mandates PMF (Protected Management Frames), and offers 192-bit security for Enterprise mode. WPS is removed in WPA3. CCMP is used in WPA2 as well.

Answer

Wi-Fi Protected Setup (WPS)

Answer

CCMP encryption as mandatory

Question 5

Which attack exploits the lack of IV (Initialization Vector) randomness in the RC4 algorithm to recover the Wi-Fi password, and is considered completely broken?

Accepted Answer

WEP IV attack. WEP uses RC4 with weak IVs that can be captured and analyzed to recover the key, making WEP completely insecure.

Answer

PMKID attack

Answer

Evil twin attack

Answer

KRACK attack

Question 6

A company is designing a network with multiple security zones. Which TWO of the following are best practices for network segmentation? (Select TWO)

Accepted Answer

Place a firewall between each security zone to enforce traffic filtering.. Placing firewalls between zones and using VLANs for logical separation are key segmentation practices. DMZ is a specific zone, not a universal practice.

Answer

Use a single flat network to reduce complexity.

Answer

Disable logging on inter-zone firewalls to improve performance.

Answer

Place all servers in the same broadcast domain for easier management.

Question 7

An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?

Accepted Answer

ARP spoofing; risk is man-in-the-middle traffic interception.. ARP spoofing allows the attacker to intercept traffic meant for the gateway, performing a man-in-the-middle attack.

Answer

DNS poisoning; risk is traffic redirection to malicious sites.

Answer

DHCP starvation; risk is denial of service.

Answer

SYN flood; risk is resource exhaustion.

Question 8

Which of the following is a secure remote access VPN protocol that uses TLS for encryption and is commonly used with Cisco AnyConnect?

Accepted Answer

SSL/TLS VPN. SSL/TLS VPNs use TLS to provide secure remote access, often with AnyConnect client.

Answer

IPsec

Answer

L2TP/IPsec

Answer

PPTP

Question 9

Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)

Accepted Answer

Supports endpoint security posture checks. SSL/TLS VPNs use standard ports (often 443) to bypass firewalls, can perform endpoint posture checks, and allow split tunneling for performance.

Answer

Typically uses UDP port 500

Answer

Requires pre-shared keys for authentication

Question 10

During a security assessment, a penetration tester discovers that the network uses WPA2-PSK. Which attack could be used to recover the pre-shared key without interacting with the access point after capturing a single handshake?

Accepted Answer

PMKID attack. The PMKID attack allows offline cracking of the PSK using information from the first frame of the 4-way handshake, even without a full handshake.

Answer

Deauthentication attack

Answer

KRACK attack

Answer

Evil twin attack

Question 11

A security administrator is configuring a firewall to allow outbound web traffic from internal users. The firewall must inspect the application layer data to block malicious URLs. Which type of firewall should be used?

Accepted Answer

Application proxy firewall. An application proxy firewall can examine application layer content, such as HTTP requests, to enforce URL filtering.

Answer

Stateless packet filter

Answer

Stateful firewall

Answer

Network Access Control (NAC) system

Question 12

A security engineer is configuring a site-to-site VPN between two branch offices using IPsec in tunnel mode. Which protocol provides both authentication and encryption of the entire original IP packet?

Accepted Answer

ESP (Encapsulating Security Payload) in tunnel mode. ESP in tunnel mode encrypts and authenticates the entire original IP packet, while AH only authenticates.

Answer

IKEv2 in transport mode

Answer

L2TP in tunnel mode

Answer

AH (Authentication Header) in tunnel mode

Question 13

Which TCP port is commonly used for secure web traffic (HTTPS) and is often allowed through firewalls for web browsing?

Accepted Answer

443. HTTPS operates over TCP port 443, which is commonly open for secure web traffic.

Answer

22

Answer

80

Answer

3389

Question 14

A security analyst is reviewing a TLS 1.3 deployment. Which THREE of the following are features of TLS 1.3?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 removed vulnerable cipher suites, mandates forward secrecy, and supports 0-RTT for faster handshakes.

Answer

Use of static RSA key exchange

Answer

Support for SSL 3.0 compatibility

Question 15

Which UDP port is used by the Domain Name System (DNS) for name resolution queries?

Accepted Answer

UDP 53. DNS uses UDP port 53 for queries by default.

Answer

UDP 161

Answer

UDP 67

Answer

UDP 123