SSCP Practice Test 14 — 15 Questions

Question 1

Match each vulnerability assessment tool to its use.

Question 2

Match each access control model to its description.

Question 3

Match each disaster recovery site type to its description.

Question 4

Match each cryptography term to its definition.

Question 5

Match each security policy type to its purpose.

Question 6

Match each security control type to its example.

Question 7

Match each authentication factor to its category.

Question 8

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

Accepted Answer

Perform a threat modeling exercise such as STRIDE. Threat modeling with STRIDE is the best approach because it systematically identifies threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) specific to the CRM's architecture, data flows, and trust boundaries. Unlike generic scans or assessments, STRIDE focuses on the unique attack surface of a cloud-based system, such as API endpoints, multi-tenancy risks, and shared responsibility model gaps.

Answer

Run a vulnerability scan on the CRM

Answer

Execute a business impact analysis (BIA)

Answer

Conduct a qualitative risk assessment using a generic framework

Question 9

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software

Question 10

A PKI administrator is designing a key management lifecycle for a high-security environment. Which practice is most critical for ensuring long-term security of asymmetric keys?

Accepted Answer

Performing regular key rotation. Regular key rotation limits exposure in case of compromise. All other options are important but rotation is most critical for long-term security.

Answer

Using hardware security modules (HSMs)

Answer

Implementing key escrow

Answer

Maintaining a Certificate Revocation List (CRL)

Question 11

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database by monitoring DHCP traffic on untrusted ports. By enabling DHCP snooping on the switch, only DHCP servers connected to trusted ports can assign IP addresses, preventing rogue DHCP server attacks.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 12

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Accepted Answer

IEEE 802.1X port-based authentication. IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Answer

Port security with sticky MAC

Answer

MAC address filtering

Answer

VLAN segmentation

Question 13

Which THREE of the following are characteristics of a stateful firewall?

Accepted Answer

Is generally slower than a stateless firewall. Stateful firewalls maintain a state table that tracks the state of active connections, allowing them to make decisions based on the context of traffic patterns, such as the TCP three-way handshake. This additional processing overhead generally makes them slower than stateless firewalls, which only inspect packet headers individually without connection tracking.

Answer

Operates only at the network layer (Layer 3)

Answer

Performs deep packet inspection (DPI)

Question 14

A security analyst reviews the syslog message from a router. What does this log entry indicate?

Accepted Answer

An internal host attempted to access an external web server and was blocked.. The log entry shows a packet from source IP 10.0.0.2 (internal) to destination IP 203.0.113.5 (external) on port 80 (HTTP) being denied by the router's access control list (ACL). The 'DENY' action indicates the traffic was blocked, not allowed. Since the source is internal and the destination is external, this matches an outbound connection attempt being blocked.

Answer

The router's ACL is misconfigured and is blocking all traffic.

Answer

An external host attempted to access an internal web server and was blocked.

Answer

An internal host successfully accessed an external web server.

Question 15

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Accepted Answer

Disable SSID broadcast. Disabling SSID broadcast prevents the access point from including the network name in beacon frames, making the network less visible to casual scanning tools. However, it is not a security measure because the SSID is still transmitted in probe requests and responses, and can be easily discovered using packet capture tools like Wireshark or airodump-ng. It is considered a best practice only as a minor obscurity layer, not a replacement for strong encryption.

Answer

Set a short, simple pre-shared key for convenience

Answer

Use WEP encryption

Answer

Enable MAC address filtering