SSCP Practice Test 17 — 15 Questions

Question 1

A database administrator notices unusual queries that seem to be trying to extract data via SQL injection. The application uses parameterized queries for most queries, but some dynamic queries are built using string concatenation. What is the BEST remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rewrite all dynamic queries to use parameterized queries. The BEST remediation is to rewrite all dynamic queries to use parameterized queries, as this eliminates the root cause of SQL injection by ensuring that user input is treated as data, not executable code. Parameterized queries (prepared statements) separate SQL logic from data, preventing attackers from altering the query structure. While other measures like input validation and WAFs add defense in depth, they do not fix the underlying vulnerability.

Answer

Restrict database user permissions to only necessary tables

Answer

Implement strict input validation for all user inputs

Answer

Deploy a web application firewall (WAF) in front of the application

Question 2

Which TWO controls are examples of physical security controls that can help prevent unauthorized access to a data center? (Select TWO.)

Accepted Answer

Biometric readers. Biometric readers (A) are physical security controls because they authenticate a person via a unique physical trait such as a fingerprint, iris, or retina before granting entry to the data center, directly preventing unauthorized physical access. Mantraps (C) are also physical controls: they use two interlocking doors with a small vestibule to allow only one person through at a time, preventing tailgating and piggybacking into the facility. Encryption of data at rest (B) is a logical/cryptographic control that protects data confidentiality but does not stop someone from physically entering the data center. Firewalls (D) are logical network security controls that filter traffic, not physical access controls. An intrusion detection system (E) is a logical monitoring/detection control that alerts on malicious activity but does not physically prevent unauthorized entry.

Answer

Encryption of data at rest

Answer

Firewalls

Answer

Intrusion detection system (IDS)

Question 3

A security team uses a risk matrix with likelihood (Low, Medium, High) and impact (Low, Medium, High). A vulnerability scan finds a buffer overflow in a customer-facing web application. The application is not critical but has high availability requirements. The likelihood of exploitation is considered Medium due to internal network segmentation. What is the risk level?

Accepted Answer

High. The risk level is High because the likelihood is Medium (due to internal network segmentation reducing but not eliminating the chance of exploitation) and the impact is High (the application has high availability requirements, so a buffer overflow could cause a denial of service or code execution, severely affecting availability). In a standard 3x3 risk matrix, Medium likelihood combined with High impact yields a High risk rating.

Answer

Medium

Answer

Extreme

Answer

Low

Question 4

Which of the following physical security controls is designed to prevent tailgating by requiring two doors to be interlocked?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, preventing an unauthorized person from following an authorized person through a single entry point (tailgating). This design forces each individual to be authenticated before the second door unlocks, ensuring only one person passes per authentication event.

Answer

Security guard

Answer

Biometric reader

Answer

CCTV

Question 5

A financial services organization deploys a new web application that allows customers to check account balances and transfer funds. The application uses a RESTful API with JSON payloads. Shortly after deployment, the security team notices unusual traffic patterns: many requests contain excessively long JSON strings in the 'amount' field, and some of these requests return 500 Internal Server Errors. The application logs show that these requests cause high CPU usage on the application server. The developers confirm that the input validation only checks for negative numbers and characters. Which type of attack is most likely occurring, and what is the best immediate mitigation?

Accepted Answer

The attack is a Denial of Service using large payloads; implement input size limits and validation.. The symptoms indicate a Denial of Service attack via large payloads that consume server resources. Excessive JSON string length in the 'amount' field causes high CPU usage during parsing and processing, leading to 500 errors. The best immediate mitigation is to implement input size limits and strict validation to reject oversized payloads. Option A is incorrect because brute-force attacks typically involve repeated attempts with different values, not large payloads causing CPU exhaustion; rate limiting would not address the root cause. Option B is incorrect because cross-site scripting (XSS) targets client-side script execution in the browser, not server-side CPU spikes. Option D is incorrect because SQL injection would likely return database error messages or cause data manipulation, not high CPU from JSON parsing.

Answer

The attack is a brute-force attempt on the amount field; implement rate limiting.

Answer

The attack is cross-site scripting; sanitize output.

Answer

The attack is SQL injection; use parameterized queries.

Question 6

During a risk assessment, a company identifies that a legacy system has a known CVE with a CVSS score of 9.8. The system is critical but cannot be patched immediately. The management decides to implement strict network segmentation and monitor the system continuously. This risk response is best described as:

Accepted Answer

Risk mitigation. Risk mitigation, because the company is implementing strict network segmentation and continuous monitoring to reduce the likelihood and impact of the vulnerability being exploited. This reduces the risk without eliminating it entirely, which is the essence of mitigation. The CVSS score of 9.8 indicates critical severity, and the controls (e.g., ACLs, VLANs, IDS/IPS) directly address the attack surface.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 7

A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)

Accepted Answer

Network connections and open ports. According to the order of volatility, the most perishable data must be captured first because it disappears when the system is powered off or changes rapidly. Option C (Network connections and open ports) is correct because active TCP/UDP sessions, listening sockets, and ARP/routing state exist only in memory and vanish immediately on shutdown, so tools like netstat, ss, or Get-NetTCPConnection must run first. Option D (Contents of RAM (memory dump)) is correct because physical memory holds encryption keys, injected code, and uncommitted data that is irretrievably lost once power is removed, making it the highest-priority acquisition. Option E (List of running processes) is correct because the process table, PIDs, parent-child relationships, and loaded modules are volatile kernel structures that change second by second and cannot be recovered from a later disk image. Option A (System event logs) is not among the first tier because, although logs are valuable, they are typically persisted to disk (.evtx files) and survive until overwritten, so they are collected after memory-resident artifacts. Option B (Hard drive image) is not among the first tier because disk contents are the least volatile and remain intact while live memory and network state are captured beforehand.

Answer

System event logs

Answer

Hard drive image

Question 8

During a ransomware incident, the incident response team needs to recover encrypted servers. Which THREE steps are essential for successful recovery? (Select THREE)

Accepted Answer

Restore data from the most recent clean backup. Option A is correct because restoring from the most recent clean backup is the primary and most reliable way to recover encrypted data without trusting the attacker or paying the ransom. Option C is correct because patching the vulnerability that allowed the ransomware to enter prevents immediate re-infection once systems are restored and brought back online. Option E is correct because scanning restored systems verifies that malware has been eradicated and that no residual persistence mechanisms or reinfection vectors remain before returning them to production. Option B is not appropriate because paying the ransom does not guarantee a working decryption key, funds criminal activity, and may violate organizational or legal policy. Option D is not an essential recovery step because deleting and recreating all user accounts does not address the encrypted data or the malware itself and could cause unnecessary operational disruption.

Answer

Pay the ransom to obtain the decryption key

Answer

Delete all user accounts and recreate them

Question 9

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Accepted Answer

High probability and high impact. In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.

Answer

Low probability and low impact

Answer

High probability and low impact

Answer

Low probability and high impact

Question 10

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

Accepted Answer

MTTD (Mean Time to Detect). MTTD (Mean Time to Detect) is correct because it directly measures how quickly an organization identifies an incident after it occurs, which is a core indicator of incident response effectiveness in the detection phase. MTTR (Mean Time to Respond) is correct because it measures how quickly the team responds to and contains or resolves an incident, reflecting the efficiency of the response process. Together, MTTD and MTTR are standard incident response metrics used to benchmark and improve detection and response capabilities. SLA compliance percentage is not specific to incident response effectiveness, as SLAs cover many service areas beyond security incidents. MTBF (Mean Time Between Failures) measures reliability of systems or components, not incident response performance. The number of firewall rules is a configuration or hygiene metric and does not measure how well incidents are detected or handled.

Answer

SLA (Service Level Agreement) compliance percentage

Answer

MTBF (Mean Time Between Failures)

Answer

Number of firewall rules

Question 11

A company wants to implement a policy where no single individual can approve a purchase order and also receive the goods. Which access control principle does this enforce?

Accepted Answer

Separation of duties. This policy enforces separation of duties by ensuring that no single individual has the authority to both approve a purchase order and receive the goods. This control prevents fraud and errors by requiring two different people to complete related but conflicting tasks, which is a fundamental access control principle in financial and operational systems.

Answer

Rotation of duties

Answer

Need to know

Answer

Least privilege

Question 12

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Accepted Answer

Anomaly-based IDS. Anomaly-based IDS (B) is correct because it establishes a baseline of normal network or system behavior through statistical modeling or machine learning, then flags deviations from that baseline as potential intrusions. This contrasts with signature-based systems that rely on predefined patterns of known attacks. The core mechanism involves profiling metrics such as CPU usage, network traffic volume, or protocol deviations over time to identify anomalies.

Answer

Host-based IDS (HIDS)

Answer

Network-based IDS (NIDS)

Answer

Signature-based IDS

Question 13

Which term describes the risk that remains after implementing risk mitigation controls?

Accepted Answer

Residual risk. Residual risk is the risk that remains after all risk mitigation controls have been applied. It represents the portion of the original risk that cannot be eliminated or reduced further, and it must be accepted by management if it falls within the organization's risk appetite.

Answer

Accepted risk

Answer

Inherent risk

Answer

Control risk

Question 14

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Accepted Answer

Risk mitigation by blocking the IP address. Blocking the offending IP address is a risk mitigation control that immediately reduces the likelihood of a brute-force or credential-stuffing attack succeeding. It directly addresses the active threat by cutting off the source, which is the fastest and most targeted response. Mitigation reduces risk impact or likelihood, which matches the scenario.

Answer

Risk remediation by changing all user passwords

Answer

Risk transfer

Answer

Risk acceptance

Question 15

A security administrator is reviewing backup procedures for a database server. The current backup policy mandates a full backup every Sunday and differential backups Tuesday through Friday. On Wednesday, a failure occurs, and the database is lost. The last successful full backup was completed on Sunday, and the last differential backup was completed on Tuesday. How many backup sets are needed to restore the database to its state as of Tuesday?

Accepted Answer

2. To restore the database to its state as of Tuesday, you need the last full backup (Sunday) and the last differential backup (Tuesday). A differential backup contains all changes since the last full backup, so applying the Tuesday differential to the Sunday full backup recovers all data up to Tuesday. The Wednesday failure does not affect the Tuesday state, and no other backups are required.

Answer

4

Answer

3

Answer

1