SSCP Practice Test 15 — 15 Questions

Question 1

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

Accepted Answer

Split tunnel VPN. A split tunnel VPN configuration allows remote users to access the corporate network securely over an encrypted tunnel while simultaneously sending internet-bound traffic directly to the internet without passing through the corporate VPN gateway. This meets the security policy requirement because only traffic destined for the corporate network is encrypted, reducing latency and bandwidth load on the VPN concentrator.

Answer

Remote Desktop Gateway

Answer

Host-to-host VPN

Answer

Full tunnel VPN

Question 2

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 3

Which of the following is the primary purpose of a security awareness program?

Accepted Answer

To teach employees about security best practices and reduce human error.. The primary purpose of a security awareness program is to educate employees on security best practices and reduce human error, which is the leading cause of security incidents. Unlike technical controls, awareness programs target the human element by teaching users to recognize phishing attempts, handle sensitive data properly, and follow secure behaviors. This aligns with the NIST SP 800-50 framework, which defines awareness as a foundational component of an organizational security posture.

Answer

To evaluate the effectiveness of security technologies.

Answer

To enforce security policies through penalties.

Answer

To train employees on advanced technical security skills.

Question 4

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

Accepted Answer

Encrypt all sensitive data stored on the device using a key derived from the user's passcode.. Option C is correct because encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.

Answer

Require a strong screen lock passcode.

Answer

Disable cloud backups for the app.

Answer

Use app sandboxing to isolate app data from other apps.

Question 5

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?

Accepted Answer

Exposure of bucket contents to the public. The S3 bucket policy grants public access via a Principal of '*' and an Effect of 'Allow' for the 's3:GetObject' action, which means any unauthenticated user on the internet can read objects in the bucket. This directly exposes the bucket contents to the public, making option D correct.

Answer

Unauthorized deletion of objects

Answer

Lack of encryption at rest

Answer

Inability to audit access

Question 6

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

Accepted Answer

Authentication bypass via SQL injection.. The payload shown is a classic SQL injection attempt, specifically targeting authentication logic by injecting a tautology (e.g., ' OR '1'='1) into a login field. If the web application is vulnerable, this bypasses authentication by making the SQL query always return true, granting unauthorized access without valid credentials.

Answer

Directory traversal to read sensitive files.

Answer

Remote code execution on the web server.

Answer

Cross-site scripting (XSS) attack leading to session theft.

Question 7

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

Accepted Answer

Rewrite the legacy module to use parameterized queries.. Option B is correct because parameterized queries (prepared statements) are the definitive defense against SQL injection, as they separate SQL logic from user data by design. Rewriting the legacy module to use parameterized queries eliminates the root cause of the vulnerability at the code level, ensuring that user input is never concatenated into the SQL statement. This is the most secure and permanent fix, as it directly addresses the injection point in the application layer.

Answer

Disable the legacy module until a full rewrite is completed.

Answer

Deploy a web application firewall (WAF) to block SQL injection patterns.

Answer

Implement input validation to reject special characters.

Question 8

An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?

Accepted Answer

Perform threat modeling to identify potential attack vectors.. Threat modeling is a proactive security activity performed during the design phase to identify potential attack vectors, trust boundaries, and threats before any code is written. By analyzing the system architecture and data flows, teams can mitigate security flaws early, reducing the cost and effort of fixing vulnerabilities later in the SDLC.

Answer

Run dynamic application security testing (DAST) tools.

Answer

Apply security patches to the development environment.

Answer

Conduct a code review for security vulnerabilities.

Question 9

Which THREE are appropriate controls to prevent unauthorized access to a data center? (Choose three.)

Accepted Answer

Biometric scanner. A biometric scanner is a physical access control that authenticates individuals based on unique physiological characteristics (e.g., fingerprints, iris patterns). It directly prevents unauthorized entry by verifying identity at the data center perimeter, making it an appropriate control for physical security.

Answer

Firewall

Answer

Encryption

Question 10

An administrator wants to ensure that users cannot share passwords. Which control is most effective at reducing the risk of password sharing?

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) is the most effective control because it requires users to present two or more distinct factors (e.g., something you know, something you have, something you are) to authenticate. Even if a user shares their password (something you know), an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or biometric). This directly reduces the risk of password sharing by making the shared credential insufficient for access.

Answer

Account lockout policies

Answer

Password complexity

Answer

Password history

Question 11

Which two components are integral to a Kerberos authentication system? (Select TWO)

Accepted Answer

Key Distribution Center (KDC). The Key Distribution Center (KDC) is the core component of a Kerberos authentication system, responsible for issuing tickets and managing session keys. The Ticket Granting Ticket (TGT) is a temporary credential obtained from the Authentication Server (AS) within the KDC, used to request service tickets without re-entering credentials. Both are integral to the Kerberos protocol (RFC 4120) for secure, ticket-based authentication.

Answer

Authentication Server (AS)

Answer

Certificate Authority (CA)

Answer

Security Assertion Markup Language (SAML)

Question 12

A company uses role-based access control (RBAC). A user is assigned to the 'Sales' role, which grants access to CRM and reporting, and also to the 'Sales Manager' role, which grants additional access to team reports. However, the user cannot access team reports. What is the most likely cause?

Accepted Answer

RBAC role hierarchy is not configured. In RBAC, role hierarchy allows roles to inherit permissions from other roles. Without a configured hierarchy, the 'Sales Manager' role does not automatically inherit permissions from the 'Sales' role, and the user may not have direct permission to access team reports if that permission is only assigned to the 'Sales Manager' role but the user's effective permissions are not properly combined. The most likely cause is that the RBAC role hierarchy is not configured, so the user's membership in both roles does not result in the union of their permissions.

Answer

An access control list on the report folder explicitly denies the 'Sales' role

Answer

The user account has been disabled

Answer

The user's session is not properly managed

Question 13

An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?

Accepted Answer

Deny. The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).

Answer

Permit

Answer

Indeterminate

Answer

Not applicable

Question 14

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option C (RBAC) uses roles, not classification levels. Option D (ABAC) is flexible but not the traditional model for military-grade security.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 15

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed