SSCP Practice Test 20 — 15 Questions

Question 1

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Provider (IdP). In a federated identity trust, the home domain that authenticates the user and issues the security token is the Identity Provider (IdP). The partner domain that consumes that assertion and grants access is the Relying Party (or Service Provider). The IdP is trusted because it vouches for the user's identity.

Answer

Relying Party

Answer

Service Provider (SP)

Answer

Kerberos Distribution Center (KDC)

Question 2

An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?

Accepted Answer

ARP spoofing; risk is man-in-the-middle traffic interception.. A gratuitous ARP reply that binds the attacker's MAC to the gateway's IP is the classic ARP spoofing (ARP poisoning) attack. The victim's ARP cache is poisoned so traffic destined for the gateway is sent to the attacker, enabling man-in-the-middle interception, modification, or denial of service.

Answer

DNS poisoning; risk is traffic redirection to malicious sites.

Answer

DHCP starvation; risk is denial of service.

Answer

SYN flood; risk is resource exhaustion.

Question 3

Which transport layer protocol is used by DNS for its queries and responses, and why is it appropriate?

Accepted Answer

UDP, because it is connectionless and fast, suitable for short exchanges.. DNS primarily uses UDP on port 53 because queries and responses are typically small, single-packet exchanges where the low overhead and lack of connection setup make UDP fast and efficient. TCP is used only for large responses (e.g., zone transfers or DNSSEC) or when truncation occurs.

Answer

UDP, because it guarantees packet ordering.

Answer

TCP, because it provides error checking and retransmission.

Answer

TCP, because reliability is critical for DNS resolution.

Question 4

An organization is planning to deploy a remote access VPN for employees. The solution must support strong encryption, mutual authentication, and work through firewalls without requiring additional ports. Which technology is most suitable?

Accepted Answer

SSL/TLS VPN. SSL/TLS VPNs (e.g., clientless or client-based SSL VPNs) use TLS over TCP port 443, which is almost universally allowed through firewalls, and they support strong encryption (AES) and mutual authentication via certificates or client certificates. Because they ride on standard HTTPS, no additional ports need to be opened, satisfying all stated requirements.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec tunnel mode

Question 5

A security policy requires that all access to sensitive data be logged. Which access control function does this support?

Accepted Answer

Accounting. The requirement to log all access to sensitive data directly supports the Accounting (auditing) function of access controls. Accounting tracks user activities and resource usage, providing an audit trail that can be reviewed for compliance, security incidents, and policy enforcement. This is distinct from Authentication (verifying identity) and Authorization (granting permissions), which do not inherently produce logs of access events.

Answer

Authentication

Answer

Authorization

Answer

Provisioning

Question 6

Based on the exhibit, which of the following best describes the firewall configuration?

Accepted Answer

The firewall allows SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic.. The exhibit shows an access control list (ACL) that explicitly permits TCP traffic on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) from the internal subnet (e.g., 192.168.1.0/24) to any destination, followed by an implicit deny all rule. This configuration allows only SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic, matching option C.

Answer

The firewall allows only loopback traffic.

Answer

The firewall allows all traffic from the internal subnet.

Answer

The firewall allows all traffic from external sources.

Question 7

An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning in a PAM solution grants elevated privileges only for the duration of a specific task and then automatically revokes them, which is exactly the 'temporary elevated access' described. It minimizes standing privileges and reduces the attack surface. Other PAM features like vaulting and session recording support security but do not provide on-demand, time-bound elevation.

Answer

Session recording

Answer

Password vaulting

Answer

Role-based access control

Question 8

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Accepted Answer

CMDB. A Configuration Management Database (CMDB) is the authoritative repository for recording configuration items (CIs) such as hardware assets, their serial numbers, locations, owners, relationships, and lifecycle states. It underpins ITIL/ITSM processes like change, incident, and asset management. Tracking hardware serial numbers and physical locations is a canonical CMDB use case.

Answer

Patch management tool

Answer

Vulnerability database

Answer

SIEM

Question 9

An attacker sends a flood of DHCP request packets with spoofed MAC addresses to exhaust the DHCP server's IP address pool, preventing legitimate clients from obtaining IP addresses. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation exhausts the IP pool by sending many fake DHCP requests, leading to denial of service.

Answer

ARP poisoning

Answer

MAC flooding

Answer

DHCP spoofing

Question 10

Which term describes the process of verifying the identity of a user, system, or entity?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity — typically by validating credentials such as passwords, biometrics, or tokens against stored data. It answers the question 'Are you who you say you are?' Identification is the prior step of claiming an identity, and authorization determines what that identity can do.

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 11

Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?

Accepted Answer

Smart card and PIN. A smart card (something you have) combined with a PIN (something you know) satisfies the two-factor requirement using two distinct authentication factor categories. This is the classic possession-plus-knowledge MFA pairing and is widely deployed in PIV/CAC and physical access systems. The other options either use two factors from the same category or only one factor.

Answer

Fingerprint and retina scan

Answer

Password and security question

Answer

Username and password

Question 12

A Linux administrator needs to configure access controls so that a specific user can run certain commands with root privileges without entering a password. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file defines which users or groups may run which commands as root (or other users), and supports the NOPASSWD tag to allow passwordless execution. Editing it with visudo ensures syntax validation and prevents concurrent-edit corruption. This is the standard mechanism for granting granular, password-free privilege escalation on Linux.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/security/limits.conf

Question 13

Which protocol is used for secure web browsing and operates on TCP port 443?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Answer

HTTP

Answer

SSH

Answer

FTP

Question 14

You are a security analyst at a financial institution. The company uses a role-based access control (RBAC) system for its internal banking application. Recently, the compliance team discovered that a teller, who should only have access to customer account information for their branch, was able to view account details for customers in other branches. The RBAC system assigns roles based on job titles. You review the configuration and find that the 'Teller' role has a permission that allows viewing all customer accounts, regardless of branch. The company wants to enforce branch-level restrictions. Which of the following is the best approach to address this issue?

Accepted Answer

Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.. ABAC allows access decisions based on attributes of the user, resource, and environment, such as branch location. By incorporating branch as an attribute, the system can enforce fine-grained restrictions without creating numerous roles. This directly addresses the requirement to restrict tellers to their own branch while maintaining a manageable role structure.

Answer

Use mandatory access control (MAC) with labels for each customer account.

Answer

Create separate roles for each branch, such as 'Teller_Branch1', 'Teller_Branch2', etc.

Answer

Modify the 'Teller' role to remove the permission to view all accounts.

Question 15

A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity — here, validating that the password provided matches the stored credential for 'jsmith'. Identification is the act of claiming an identity (e.g., entering a username), while authentication proves it. The question explicitly describes verification of the password, which is authentication.

Answer

Authorization

Answer

Identification

Answer

Accountability