SSCP Practice Exam 1 — 20 Questions

Question 1

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 2

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Business Impact Analysis (BIA) identifies the critical business functions and the maximum tolerable downtime, so the Recovery Time Objective (RTO) is a core output — it defines how quickly a process or system must be restored after disruption, directly driving continuity and recovery strategies. Criticality analysis is also a key BIA component because it ranks business processes and assets by their importance to the organization, typically using impact categories such as financial, operational, legal, and reputational, which determines prioritization for recovery. Vulnerability assessment (B) is a risk-assessment activity that identifies weaknesses in systems, not a BIA component, and it focuses on exposure rather than business impact. Likelihood estimation (D) belongs to risk analysis, where the probability of a threat event is evaluated, whereas the BIA focuses on consequences and tolerances. Threat modeling (E) is a security design technique for identifying threats and attack paths, not a BIA element, since the BIA is threat-agnostic and centers on business process impact.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 3

Which of the following is a secure remote access VPN protocol that uses TLS for encryption and is commonly used with Cisco AnyConnect?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN uses TLS (typically over TCP port 443) to encrypt traffic and is the protocol underlying Cisco AnyConnect, which is a classic example of a client-based SSL VPN. It provides secure remote access without requiring IPsec's UDP ports, making it firewall-friendly.

Answer

IPsec

Answer

L2TP/IPsec

Answer

PPTP

Question 4

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Accepted Answer

Second pre-image resistance. When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.

Answer

Avalanche effect

Answer

Collision resistance

Answer

Pre-image resistance

Question 5

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

Accepted Answer

Deviation detection. SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Answer

Patch management

Answer

Vulnerability scanning

Answer

Asset management

Question 6

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the server is low criticality, a CVSS score of 9.8 with active exploitation represents an urgent risk that must be addressed. The administrator should prioritize patching through the change management process to ensure proper approval, testing, and documentation while still expediting the fix.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 7

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. Option C is correct because an incident response plan must include a communication plan with up-to-date contact information for key stakeholders (e.g., incident handlers, management, legal, PR, and law enforcement) so that notifications and escalations occur quickly and in the proper order during an incident. Option E is correct because detailed recovery procedures for each critical system provide the documented, tested steps (such as restoration order, RTO/RPO targets, and system-specific rebuild or failover instructions) needed to return operations to normal after containment and eradication. Option A is not essential to the plan itself, since vendor lists support logistics but are not a core IR plan component. Option B is incorrect and a security risk, as storing all employee passwords violates least privilege and credential-management best practices. Option D, while useful for scoping and containment, is supporting documentation rather than one of the two essential components emphasized here.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 8

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. A patch management process must include testing patches in a staging environment before production deployment to validate compatibility and avoid breaking critical systems. Without staging validation, patches can introduce regressions, incompatibilities, or outages in production. This is a critical gap because it removes the safety net that catches patch-related issues before they impact live operations.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 9

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 10

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, Reporting. NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Answer

Detection & Analysis, Containment/Eradication/Recovery, Preparation, Post-Incident Activity, Reporting

Answer

Preparation, Containment/Eradication/Recovery, Detection & Analysis, Post-Incident Activity, Reporting

Answer

Preparation, Detection & Analysis, Post-Incident Activity, Containment/Eradication/Recovery, Reporting

Question 11

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Accepted Answer

ClientHello, then ServerHello, then EncryptedExtensions, then Finished from server, then Finished from client. TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Answer

ClientHello, then ServerHello, then Finished from client, then EncryptedExtensions, then Finished from server

Answer

ClientHello, then EncryptedExtensions, then ServerHello, then Finished from server, then Finished from client

Answer

ServerHello, then ClientHello, then EncryptedExtensions, then Finished from server, then Finished from client

Question 12

Refer to the exhibit. During a security review, an analyst finds these firewall rules. Which recommendation should be made to reduce risk?

Accepted Answer

Restrict the source for rule 10 to specific administrative IPs. Rule 10 allows SSH (TCP/22) from any source (0.0.0.0/0) to the internal server, which exposes the management interface to the entire internet. Restricting the source to specific administrative IPs reduces the attack surface by limiting who can initiate SSH connections, mitigating brute-force and unauthorized access risks. This aligns with the principle of least privilege and is a fundamental access control recommendation.

Answer

Enable logging on rule 15 as well

Answer

Require VPN access for all internal traffic

Answer

Remove rule 15 entirely

Question 13

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. CVSS score quantifies the technical severity of a vulnerability (base, temporal, and environmental metrics), while asset criticality reflects the business impact if that asset is compromised. Combining these two factors ensures patches that are both highly exploitable and protect the most valuable systems are applied first, which is the standard risk-based prioritization approach in patch management frameworks like those from NIST and CIS.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 14

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed

Question 15

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. The number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Question 16

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by removing static RSA and static Diffie-Hellman key exchange, requiring ephemeral key exchange (ECDHE) for every session. This means a compromised long-term private key cannot decrypt previously recorded sessions, which is a major security improvement over TLS 1.2 where static RSA was optional but allowed. This is codified in RFC 8446.

Answer

Reduced cipher suite options including CBC mode

Answer

Use of RC4 cipher

Answer

Support for static RSA key exchange

Question 17

A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?

Accepted Answer

Create an exception in the detection rule.. Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.

Answer

Quarantine the endpoint anyway.

Answer

Escalate to management.

Answer

Delete the alert from the SIEM.

Question 18

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Accepted Answer

The user does not have the 'Allow log on through Remote Desktop Services' user right. The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer

The user account is locked out

Answer

The server is not a member of the domain

Answer

The user's Kerberos ticket has expired

Question 19

A security team detects lateral movement within the network. Which containment strategy should be applied first to limit the spread of the threat?

Accepted Answer

Isolate the affected systems by disconnecting them from the network.. Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

Answer

Disable user accounts associated with compromised systems.

Answer

Block the attacker's IP addresses at the perimeter firewall.

Answer

Reimage all compromised systems immediately.

Question 20

A company runs containerized applications in a Kubernetes cluster. They need to ensure that containers run with the least privilege and cannot escalate privileges. Which configuration change is MOST effective?

Accepted Answer

Drop all Linux capabilities from the container. Dropping all Linux capabilities is the most effective because capabilities are the granular privileges that allow a process to perform privileged operations (e.g., CAP_NET_ADMIN, CAP_SYS_ADMIN). Even a non-root user can escalate privileges if it retains capabilities. By dropping all capabilities, the container loses the ability to perform any privileged action, directly enforcing least privilege and preventing privilege escalation. This is a fundamental Kubernetes securityContext setting that aligns with the principle of least privilege.

Answer

Set the container to run as non-root user

Answer

Mount the container root filesystem as read-only

Answer

Enable SELinux enforcing mode on the host