SSCP Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Accepted Answer

The client does not trust the issuing CA.. The 'unable to get local issuer certificate' error from OpenSSL s_client indicates that the client (the machine running the command) does not have the issuing Certificate Authority (CA) certificate in its trust store. This means the client cannot verify the server certificate's chain of trust. Option B is correct because the error specifically points to a missing or untrusted CA certificate on the client side, not a problem with the server's private key, self-signing, or expiration.

Answer

The server's private key is missing.

Answer

The server certificate is self-signed.

Answer

The server certificate has expired.

Question 2

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

Accepted Answer

Add a threshold of 5 failed logins within 5 minutes. Adding a threshold of 5 failed logins within 5 minutes reduces false positives from isolated accidental lockouts while still detecting the sustained pattern of failed attempts characteristic of brute-force attacks. This aligns with SIEM tuning best practices where aggregation over a time window filters out noise without losing signal.

Answer

Disable the rule entirely

Answer

Increase the severity level of the alert

Answer

Ignore failed logins from known users

Question 3

A company uses a SIEM to detect anomalies. An alert indicates a user logged in from two geographically distant locations within 5 minutes. What is the most likely indication?

Accepted Answer

Credential theft and reuse. A scenario where a user logs in from two geographically distant locations within a short time frame is a classic indicator of credential theft and reuse. An attacker likely obtained the user's credentials and is using them from a different location. Option A (Insider threat) is less likely because an insider would not typically need to log in from two distant locations simultaneously. Option B (Time synchronization issue) would cause log timestamps to be off, but not the pattern of two logins from different locations. Option D (Misconfigured VPN) could mask the actual location but would not typically produce two distinct distant locations. Therefore, option C is the most likely indication.

Answer

Insider threat

Answer

Time synchronization issue

Answer

Misconfigured VPN

Question 4

A security administrator is configuring a new system and wants to enforce a mandatory access control model to ensure confidentiality of classified data. Which access control model should the administrator implement?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is a mandatory access control model that focuses on confidentiality by preventing read-up and write-down.

Answer

Discretionary Access Control (DAC)

Answer

Biba

Answer

Role-Based Access Control (RBAC)

Question 5

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Accepted Answer

SLE = $20,000, ALE = $10,000. The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.

Answer

SLE = $50,000, ALE = $25,000

Answer

SLE = $10,000, ALE = $5,000

Answer

SLE = $20,000, ALE = $40,000

Question 6

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 7

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

Accepted Answer

Group policy to disable USB ports or restrict autorun. The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Answer

Block the malware's command-and-control IP at the firewall

Answer

Disable the user's account and force a password reset

Answer

Reimage the infected system immediately

Question 8

An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?

Accepted Answer

License type and number of licenses. License type and number of licenses are critical for ensuring compliance with software licensing agreements and avoiding legal or financial penalties. Tracking these allows the organization to verify that the number of installed copies does not exceed the purchased licenses, which is a core requirement of software asset management (SAM).

Answer

Physical location of the installed software

Answer

Serial number of the installation media

Answer

Name of the user who installed it

Question 9

An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?

Accepted Answer

Unpatched and misconfigured VMs. Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.

Answer

License compliance violations

Answer

Increased power consumption and cooling costs

Answer

VM escape attacks from older hypervisors

Question 10

A cloud security team wants to continuously monitor for misconfigured cloud resources that could expose data. Which tool category is specifically designed for this purpose?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM (Cloud Security Posture Management) tools detect misconfigurations like open storage buckets or overly permissive IAM roles. CWPP focuses on runtime workload protection. WAF protects web apps. IAM manages identities, not configuration monitoring.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Identity and Access Management (IAM)

Answer

Web Application Firewall (WAF)

Question 11

A security administrator is configuring a Linux server to enforce mandatory access control (MAC). Which of the following tools provides MAC on Linux?

Accepted Answer

SELinux. SELinux and AppArmor are Linux security modules that implement mandatory access control policies beyond traditional discretionary access control.

Answer

PAM

Answer

iptables

Answer

chmod

Question 12

A cloud security team is implementing CSPM (Cloud Security Posture Management) for their IaaS environment. Which THREE issues is CSPM MOST likely to detect? (Select THREE.)

Accepted Answer

IAM roles with overly permissive policies. CSPM detects misconfigurations such as open security groups, unencrypted storage, and excessive IAM permissions.

Answer

Outdated OS patches on cloud VMs

Answer

Runtime malware in a virtual machine

Question 13

A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?

Accepted Answer

Create an exception in the detection rule.. Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.

Answer

Quarantine the endpoint anyway.

Answer

Escalate to management.

Answer

Delete the alert from the SIEM.

Question 14

A security architect is reviewing cloud security for a SaaS application used by the company. According to the shared responsibility model, which security controls are PRIMARILY the customer's responsibility?

Accepted Answer

Data classification and user access management. In SaaS, the customer is responsible for data classification and managing user access (IAM).

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Operating system patching

Question 15

During an audit, it is discovered that a contractor’s account has read access to a financial database even though the contractor’s project ended six months ago. Which type of access control failure is this?

Accepted Answer

Poor account management. The contractor's account retained access privileges after the project ended, which is a failure of the account lifecycle management process. Proper account management requires disabling or removing accounts when a user's role or affiliation changes, such as when a contract terminates. This is not an authorization or authentication issue, as the access was originally granted correctly but was not revoked in a timely manner.

Answer

Inadequate authorization

Answer

Insufficient authentication

Answer

Weak password policy