SSCP Practice Test 16 — 15 Questions

Question 1

Which of the following is the primary purpose of a configuration management database (CMDB)?

Accepted Answer

To provide a centralized repository of configuration items and their relationships. A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.

Answer

To track changes to network devices in real time

Answer

To automate the deployment of patches

Answer

To store backup copies of configuration files

Question 2

Refer to the exhibit. A security analyst reviews a Windows Security event log entry showing multiple logon failures for user 'admin' from IP 10.0.0.100 within 5 minutes. What type of attack is most likely occurring?

Accepted Answer

Brute force attack. Multiple logon failures for the same user from a single IP within a short time frame is characteristic of a brute force attack, where an attacker systematically tries many passwords to gain access.

Answer

Kerberos ticket replay

Answer

Pass-the-hash attack

Answer

Privilege escalation

Question 3

Which THREE of the following are common types of network attacks?

Accepted Answer

ARP spoofing. ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Answer

Pharming

Answer

SQL injection

Question 4

A university's IT department manages a network used by students and faculty. The security team notices an unusual increase in outbound traffic from the student dormitory network during late hours. Upon investigation, they discover that several student laptops are infected with malware that is attempting to connect to external command-and-control (C2) servers. The team needs to contain the incident quickly while minimizing impact on legitimate users. Which of the following is the BEST immediate containment measure?

Accepted Answer

Disconnect the infected laptops from the network and take them offline for remediation. Disconnecting the infected laptops and taking them offline for remediation is the most targeted containment measure: it stops C2 communication immediately while leaving the rest of the dormitory network operational for legitimate users. This satisfies the requirement to contain quickly with minimal impact on unaffected users. It also preserves the infected hosts for forensic analysis before remediation.

Answer

Shut down the entire dormitory network

Answer

Block all outbound traffic from the dormitory subnet

Answer

Update the antivirus definitions on the infected laptops

Question 5

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. Option E (Contents of RAM using LiME) is correct because RAM is the most volatile evidence on a running Linux system and is lost on shutdown or reboot; LiME (Linux Memory Extractor) is a kernel module that captures physical memory to a file for later forensic analysis, preserving running processes, encryption keys, and network state. Option D (List of active network connections using netstat) is correct because active connections, listening sockets, and associated PIDs are highly volatile and change within seconds, so capturing them early preserves evidence of command-and-control channels and lateral movement; netstat (or its modern replacement ss) reads this state directly from the kernel. Option A (Disk image of the system drive) is not first because disk contents are persistent and can be acquired later without loss, and imaging a live disk is slower and less volatile than memory or network state. Option B (System log files from /var/log) is not first because logs are stored on disk and persist across reboots, so they are less volatile than RAM or active connections. Option C (Hardware configuration inventory) is not first because hardware configuration is static and remains available after the incident, making it the least volatile category of evidence.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 6

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Accepted Answer

User is terminated. Option A (User is terminated) is correct because when an employee leaves the organization, all access rights, accounts, and credentials must be revoked immediately to prevent unauthorized access and satisfy offboarding/least-privilege controls. Option B (User changes job roles) is correct because a role change triggers a review of existing permissions; access tied to the old role should be revoked and replaced with only the entitlements required for the new role, enforcing least privilege and separation of duties. Option C (User password expires) is not a revocation reason—an expired password simply requires a reset/change, and the account remains active. Option D (User completes quarterly training) is unrelated to access rights; completing training does not remove entitlements. Option E (User updates personal information) is also unrelated—updating profile data such as contact details does not affect authorization or account status.

Answer

User password expires

Answer

User completes quarterly training

Answer

User updates personal information

Question 7

Which type of disaster recovery test involves running the DR systems alongside production systems to verify functionality without impacting operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Answer

Tabletop exercise

Answer

Full interruption test

Answer

Simulation test

Question 8

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

Accepted Answer

To prove that the evidence has not been tampered with and is admissible in legal proceedings. The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Answer

To determine the cost of the forensic investigation

Answer

To ensure the hard drive is stored in a secure location

Answer

To track the productivity of forensic analysts

Question 9

Which TWO are benefits of network segmentation using VLANs? (Choose two.)

Accepted Answer

Improved security through traffic isolation. Option B is correct because VLANs logically isolate groups of devices into separate broadcast domains, so traffic from one VLAN cannot reach another without an explicit Layer 3 device (router or Layer 3 switch) applying ACLs or firewall rules, which improves security through traffic isolation. Option C is correct because each VLAN forms its own broadcast domain, so broadcasts (e.g., ARP requests) are confined to the originating VLAN instead of flooding the entire flat network, thereby reducing overall broadcast traffic. Option A is not a guaranteed benefit: VLANs do not inherently increase bandwidth, and inter-VLAN traffic must still traverse a router or Layer 3 switch, which can even become a bottleneck. Option D is wrong because VLANs actually require Layer 3 routing (router-on-a-stick or an SVI on a multilayer switch) for hosts in different VLANs to communicate. Option E is wrong because IP address management is not simplified by VLANs alone; it typically requires DHCP scopes per VLAN/subnet and careful subnet planning, and can become more complex with many VLANs.

Answer

Increased available bandwidth

Answer

Elimination of routing requirements

Answer

Simplified IP address management

Question 10

A security administrator needs to dispose of hard drives that contain sensitive data. Which method provides the highest assurance that data cannot be recovered?

Accepted Answer

Physically shredding the hard drives. Physically shredding the hard drives reduces them to small particles, making any recovery of magnetic or solid-state data physically impossible. This provides the highest level of assurance because the storage media itself is destroyed, not just the data on it. It is the recommended method for media containing highly sensitive data when reuse is not required.

Answer

Deleting all files and emptying the recycle bin

Answer

Performing a quick format of the drive

Answer

Using a degausser to erase magnetic data

Question 11

Which two commands can be used to modify existing file permissions on a Linux system? (Select TWO)

Accepted Answer

setfacl. Option B, setfacl, is correct because it modifies existing file permissions by adding, modifying, or removing POSIX ACL entries (e.g., setfacl -m u:alice:rw file), which directly changes the access permissions on a file. Option E, chmod, is correct because it changes the existing permission bits (read/write/execute for user, group, and other) of a file or directory, for example chmod 640 file or chmod u+x file. Option A, chattr, does not set standard permissions; it changes extended filesystem attributes such as immutable (+i) or append-only (+a), so it is not a permission-modifying command in this sense. Option C, umask, does not modify existing file permissions; it sets the default permission mask applied only when new files and directories are created. Option D, chown, changes file ownership (user and/or group), not the permission bits themselves, so it does not modify existing permissions.

Answer

chattr

Answer

umask

Answer

chown

Question 12

An organization uses smart cards combined with a PIN to access secure facilities. This is an example of which type of authentication factor?

Accepted Answer

Two-factor authentication. Smart cards are a possession factor (something you have), and the PIN is a knowledge factor (something you know). Combining both satisfies the requirement for two distinct authentication factors, making this a textbook example of two-factor authentication (2FA). This is not single-factor because two separate categories of credentials are used, and it is not biometric because no physical characteristic is measured.

Answer

Token-based authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 13

Refer to the exhibit. Which component of the cipher suite provides perfect forward secrecy?

Accepted Answer

ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides perfect forward secrecy (PFS) because it generates a unique, ephemeral session key for each TLS session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This is defined in RFC 4492 and is a core property of ephemeral Diffie-Hellman key exchange.

Answer

TLS 1.2

Answer

AES256-GCM

Answer

SHA384

Question 14

A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?

Accepted Answer

Rule-based detection. The alert is triggered by a static threshold (10 failed attempts in 5 minutes) with no baseline learning. This is characteristic of rule-based detection, which uses predefined conditions (e.g., 'if count > 10 then alert'). Anomaly-based detection would require establishing a baseline of normal behavior and detecting deviations from that baseline. Therefore, rule-based detection is the most likely type used.

Answer

Anomaly-based detection

Answer

Signature-based detection

Answer

Behavior-based detection

Question 15

After a patch is deployed to a critical server, the system becomes unstable. The change management plan includes a rollback procedure. What should be done FIRST?

Accepted Answer

Execute the rollback procedure. When a patch deployment causes system instability, the immediate priority is to restore service stability by executing the pre-approved rollback procedure. The change management plan already includes this procedure, so no new approvals are needed; acting quickly minimizes downtime and risk.

Answer

Create a new change request for the rollback

Answer

Conduct a post-implementation review

Answer

Notify the Change Advisory Board