SSCP Practice Test 14 — 15 Questions

Question 1

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Accepted Answer

To establish a minimum level of security for system configurations. The primary purpose of implementing a security baseline such as the CIS Benchmarks is to establish a minimum level of security for system configurations. These benchmarks provide prescriptive, consensus-based configuration guidelines (e.g., disabling unnecessary services, setting file permissions, enforcing password policies) that reduce the attack surface and ensure a consistent, hardened starting point across all systems in an organization.

Answer

To automate incident response procedures

Answer

To detect real-time threats

Answer

To comply with regulatory requirements for log retention

Question 2

A security team is conducting a penetration test. In which phase would they attempt to exploit vulnerabilities found during scanning?

Accepted Answer

Gaining access.. The gaining access phase is where the penetration tester actively exploits vulnerabilities discovered during scanning to obtain unauthorized entry into the system. This phase involves using tools like Metasploit or custom exploits to leverage specific weaknesses, such as unpatched software or misconfigured services, to achieve initial foothold. It directly follows the scanning phase and precedes maintaining access, making D the correct choice.

Answer

Maintaining access.

Answer

Scanning.

Answer

Reconnaissance.

Question 3

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

Accepted Answer

Deny. The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).

Answer

Permit

Answer

Indeterminate

Answer

Not applicable

Question 4

A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?

Accepted Answer

Report the issue to the CAB and request a revised change. Reporting the issue to the CAB and requesting a revised change is the best course because the change management process requires that any significant deviation from the approved change, such as a major compatibility issue, be re-evaluated by the CAB. This ensures proper risk assessment and approval before proceeding. It maintains the integrity of the change control process and prevents unintended outages.

Answer

Reject the change request and close it permanently

Answer

Implement the change but have a rollback plan ready

Answer

Proceed with the change and resolve the issue after implementation

Question 5

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

Accepted Answer

Assess the risk and implement compensating controls if possible. Assessing the risk and implementing compensating controls if possible is the first step because it balances the need to address the critical vulnerability with the business impact of downtime. This approach follows risk management principles: evaluate the severity, exploitability, and potential impact, then apply mitigations such as virtual patching, network segmentation, or increased monitoring until a patch can be safely applied. It is not prudent to ignore or immediately disrupt business operations without analysis.

Answer

Schedule the patch for the next maintenance window without further analysis

Answer

Apply the patch immediately during business hours

Answer

Document the exception and ignore the vulnerability

Question 6

Which three of the following are best practices for securing a wireless network? (Choose three.)

Accepted Answer

Disable SSID broadcast. Disabling SSID broadcast prevents the access point from including its network name in beacon frames, making the network less visible to casual scanning tools. While this does not provide true security (as the SSID can still be discovered via passive monitoring of probe responses or association frames), it reduces the attack surface by hiding the network from non-malicious users and automated discovery scripts.

Answer

Use MAC address filtering

Answer

Set a weak passphrase for guest network

Question 7

Which THREE of the following are best practices for securely managing cryptographic keys in an enterprise environment?

Accepted Answer

Implement key escrow to allow recovery of encrypted data.. Option C is correct because key escrow provides a controlled recovery mechanism so that encrypted data remains accessible if the original key is lost or an authorized party leaves, which is a recognized enterprise best practice for business continuity. Option D is correct because regular key rotation limits the amount of data protected by any single key and reduces the impact of an undetected compromise, while immediate rotation upon suspected compromise is essential to contain exposure. Option E is correct because an HSM is a tamper-resistant hardware device that generates, stores, and performs cryptographic operations with keys in a protected boundary, preventing key extraction and satisfying strong key-protection requirements. Option A is wrong because key separation is required: a symmetric key used for encryption/decryption should not also be used for signing, since reusing one key across different cryptographic purposes weakens security. Option B is wrong because emailing keys, even encrypted to the recipient's public key, exposes them to mail-server storage, forwarding, and endpoint compromise; keys should be distributed through secure out-of-band or automated key-management channels.

Answer

Use the same key for encryption and decryption (symmetric) and also for signing.

Answer

Share keys via email encrypted with the recipient's public key.

Question 8

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Accepted Answer

SCAP scanner. SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Answer

Vulnerability scanner

Answer

Asset management database

Answer

SIEM

Question 9

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Full backup

Answer

Incremental backup

Answer

Snapshot backup

Question 10

A security engineer needs to choose an asymmetric algorithm for a system with limited computational resources, such as an IoT device. The algorithm must provide equivalent security to RSA 2048-bit while using smaller key sizes. Which algorithm should they choose?

Accepted Answer

Elliptic Curve Cryptography (ECC) with 256-bit keys. Elliptic Curve Cryptography (ECC) with 256-bit keys provides equivalent security to RSA 2048-bit because the elliptic curve discrete logarithm problem is significantly harder to solve than the integer factorization problem for the same key length. This allows ECC to achieve strong security with much smaller key sizes, making it ideal for resource-constrained IoT devices where memory, power, and processing are limited.

Answer

RSA with 2048-bit keys

Answer

Diffie-Hellman with 2048-bit keys

Answer

3DES with 168-bit keys

Question 11

You work for a financial services firm that must comply with GDPR and PCI DSS. The company uses a cloud-based CRM to store customer data. The security team recently discovered that the CRM vendor had a data breach that exposed the company's customer records. An investigation shows that the breach occurred because the vendor did not have multi-factor authentication (MFA) enabled for administrative accounts. The contract with the vendor states that the vendor is responsible for security of their platform. However, your company had not conducted a risk assessment of the vendor before signing the contract. Management wants to improve risk identification for third-party relationships. Which of the following is the BEST long-term solution?

Accepted Answer

Implement a third-party risk management program with periodic security assessments and contractual security requirements. A third-party risk management (TPRM) program with periodic security assessments and contractual security requirements directly addresses the root cause: the lack of pre-contract risk identification and ongoing vendor oversight. By embedding MFA requirements into contracts and performing regular assessments (e.g., reviewing SOC 2 reports, conducting penetration tests), the company can proactively enforce security controls like MFA for administrative accounts, preventing future breaches. This is a sustainable, long-term solution that aligns with GDPR and PCI DSS due diligence obligations.

Answer

Demand that the vendor reimburse the company for breach costs

Answer

Cancel the contract with the vendor and move to a private cloud solution

Answer

Require all vendors to provide SOC 2 reports

Question 12

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors with automated alerting. Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.

Answer

Implementing stricter access control policies

Answer

Conducting more frequent tabletop exercises

Answer

Increasing the frequency of full system backups

Question 13

An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?

Accepted Answer

To obtain service tickets for accessing resources. The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.

Answer

To encrypt all network traffic

Answer

To provide a digital signature for emails

Answer

To authenticate the user to the network

Question 14

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

Accepted Answer

To prove that evidence has not been altered or tampered with from collection to presentation. The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Answer

To determine the priority of the incident

Answer

To ensure that evidence is stored in a secure location

Answer

To identify which forensic tools were used during analysis

Question 15

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

Accepted Answer

Signature-based detection. The NIDS generated an alert based on a known exploit signature, which means it compared network traffic against a database of predefined patterns or fingerprints of known attacks. This is the defining characteristic of signature-based detection, where the system relies on exact or pattern matches to known malicious activity.

Answer

Anomaly-based detection

Answer

Behavior-based detection

Answer

Heuristic detection