SSCP Practice Test 2 — 10 Questions

Question 1

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

Accepted Answer

Differential backup. The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Answer

Full backup

Answer

Copy backup

Answer

Incremental backup

Question 2

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Accepted Answer

Second pre-image resistance. When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.

Answer

Avalanche effect

Answer

Collision resistance

Answer

Pre-image resistance

Question 3

A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?

Accepted Answer

Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.. The root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.

Answer

Publish a certificate revocation list (CRL) and wait for existing certificates to expire.

Answer

Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.

Answer

Enable OCSP stapling on all web servers to check revocation status in real time.

Question 4

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

Accepted Answer

Relationships between configuration items. A CMDB is a repository that stores information about configuration items (CIs) and their relationships. Option C is correct because relationships between CIs are fundamental to understanding how changes affect the IT infrastructure. Option E is correct because hardware inventory details like serial numbers are typical attributes stored for each CI, enabling asset tracking and impact analysis.

Answer

Password hashes

Answer

Change request approvals

Answer

Incident tickets

Question 5

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash of the memory dump immediately after capture is the most important step to ensure evidence integrity, as it provides a unique fingerprint to verify that the data has not been altered. Write blockers are used for storage media, not memory captures. Storing the dump on the same server risks modification or loss. Running antivirus is irrelevant and could alter the dump.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 6

Which TWO actions are part of the containment phase of incident response?

Accepted Answer

Applying temporary patches. During the containment phase of incident response, the immediate priority is to stop the incident from spreading or causing further damage. Applying temporary patches (C) can quickly close a vulnerability that is being exploited, while isolating affected systems (D) prevents lateral movement and further compromise. Both actions are short-term measures to contain the threat before eradication and recovery begin.

Answer

Restoring from backups

Answer

Analyzing root cause

Answer

Preserving evidence

Question 7

A company uses a SIEM to monitor security events. Recently, they are experiencing false positives from a new IDS rule. Which approach would best reduce false positives while maintaining detection?

Accepted Answer

Adjust the rule threshold.. Adjusting the rule threshold (Option D) is the best approach because it fine-tunes the sensitivity of the IDS rule to reduce false positives without completely disabling detection. By raising the threshold (e.g., increasing the number of matching packets or the time window), the SIEM will only generate an alert when the rule's criteria are met more persistently, filtering out noise while still capturing genuine threats. This maintains the rule's detection capability for actual attacks that exceed the adjusted threshold.

Answer

Disable the rule.

Answer

Increase the log review frequency.

Answer

Whitelist false positive sources.

Question 8

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?

Accepted Answer

SAML. SAML uses XML assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 9

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)

Question 10

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. Failure to test patches in a staging environment can lead to instability when deployed to production.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release