SSCP Practice Test 17 — 15 Questions

Question 1

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Length, complexity, and expiry. The policy specifies length, complexity (character types), and expiry (change interval). History and lockout are not mentioned.

Answer

Complexity, expiry, and lockout

Answer

Length, complexity, and history

Answer

Length, complexity, and lockout

Question 2

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Accepted Answer

The email creates a sense of urgency or threatens negative consequences. Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

Answer

The email contains an attachment from an unknown sender

Answer

The email has grammatical errors or misspellings

Answer

The email address of the sender closely resembles a legitimate domain

Question 3

What is the primary purpose of account deprovisioning in the account lifecycle?

Accepted Answer

To immediately disable accounts and preserve evidence. Deprovisioning ensures that when an employee leaves, access is revoked immediately to prevent unauthorized use, and evidence is preserved for investigations.

Answer

To modify user roles and permissions

Answer

To enforce password policies

Answer

To create new user accounts

Question 4

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

Accepted Answer

SIEM with change detection rules. SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.

Answer

Configuration management database (CMDB)

Answer

Vulnerability scanner

Answer

Patch management tool

Question 5

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

Accepted Answer

Audit logging and monitoring of privileged actions. Separation of duties is enforced through role-based access control (assigning conflicting roles to different users), requiring dual authorization for critical actions, and audit logging for accountability. Password complexity and biometrics are authentication, not separation of duties.

Answer

Enforcing complex password policies

Answer

Using biometric authentication

Question 6

A security administrator is implementing the 3-2-1 backup rule. Which THREE actions are required to comply with this rule? (Select THREE.)

Accepted Answer

Store one copy offsite. The 3-2-1 rule requires three copies, two different media types, and one offsite copy.

Answer

Perform daily full backups

Answer

Use encryption for all backup copies

Question 7

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

Accepted Answer

Hourly incremental backups to disk. To meet a short RTO, backup frequency should be high and restoration quick, so frequent backups to fast media are needed.

Answer

Daily full backups to disk

Answer

Weekly full backups to tape

Answer

Monthly full backups with daily differentials to tape

Question 8

An Identity Provider (IdP) sends an XML-based assertion to a Service Provider (SP) to grant access. Which federated identity standard is being used?

Accepted Answer

Security Assertion Markup Language (SAML). SAML uses XML assertions to exchange authentication and authorization data between an IdP and an SP.

Answer

OAuth 2.0

Answer

OpenID Connect (OIDC)

Answer

Kerberos

Question 9

An organization uses Kerberos for single sign-on (SSO) within its Windows domain. Which component issues ticket-granting tickets (TGTs) after verifying user credentials?

Accepted Answer

Authentication Service (AS). In Kerberos, the Authentication Service (AS) within the Key Distribution Center (KDC) authenticates users and issues TGTs. The Ticket Granting Service (TGS) issues service tickets later.

Answer

Ticket Granting Service (TGS)

Answer

Key Distribution Center (KDC)

Answer

Domain Controller

Question 10

An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning grants temporary privileges as needed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Password vaulting

Answer

Role-based access control

Question 11

A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?

Accepted Answer

Least privilege. Least privilege means users and accounts should have only the minimum permissions necessary. Service accounts rarely need domain admin rights.

Answer

Need-to-know

Answer

Separation of duties

Answer

Accountability

Question 12

Which access control model allows the owner of a resource to determine who can access it and what privileges they have?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) lets the owner control access permissions. Other models have different control mechanisms.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 13

An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning provides temporary elevated privileges that expire after use, reducing the attack surface.

Answer

Session recording

Answer

Password vaulting

Answer

Role mining

Question 14

An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?

Accepted Answer

Securing the application code from SQL injection. In PaaS, the provider manages the platform (OS, runtime), and the customer is responsible for the application code and data. Patching the runtime is the provider's duty. Database backup may be partially shared, but application code security is always the customer's.

Answer

Physical security of the data center

Answer

Patching the web server runtime

Answer

Patching the underlying operating system

Question 15

A company is migrating from 3DES to a modern encryption algorithm. Which of the following are acceptable choices? (Select TWO)

Accepted Answer

ChaCha20. AES and ChaCha20 are modern symmetric ciphers considered secure. RC4 is broken, Blowfish is older (64-bit block), and DES is obsolete.

Answer

DES

Answer

RC4

Answer

Blowfish