SSCP Practice Exam 1 — 20 Questions

Question 1

Refer to the exhibit. A security analyst observes this event on a workstation. What is the MOST likely explanation?

Accepted Answer

A malicious macro in a Word document executed the command.. The event shows a command prompt launching with a base64-encoded PowerShell command, which is a common technique used by malicious macros to download and execute payloads. Microsoft Office macros can invoke cmd.exe or PowerShell to bypass security controls, and the encoded command suggests obfuscation typical of malware, not legitimate software updates or user actions.

Answer

Microsoft Office is performing an automatic update.

Answer

A scheduled task triggered the command.

Answer

A user ran a legitimate command from the Start menu.

Question 2

A company has segmented its network into VLANs for different departments: HR, Finance, and IT. The router interconnecting the VLANs has ACLs configured to block traffic from HR to Finance. However, IT has noticed that traffic from HR VLAN is reaching the Finance VLAN. The network uses managed switches with 802.1Q trunking. All access ports are configured as untagged members of their respective VLANs. What is the most likely cause of this unauthorized traffic flow?

Accepted Answer

VLAN hopping attack via double tagging. The most likely cause is a VLAN hopping attack via double tagging. In this attack, an attacker on the HR VLAN sends a frame with two 802.1Q tags: the outer tag matches the native VLAN of the trunk (often VLAN 1), and the inner tag is the target VLAN (Finance). When the switch receives the frame on an access port, it strips the outer tag (as it is the native VLAN) and forwards the frame with the inner tag over the trunk, allowing the traffic to bypass the ACLs and reach the Finance VLAN.

Answer

DHCP snooping disabled

Answer

Default gateway misconfiguration

Answer

STP misconfiguration

Question 3

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Recovery Time Objective (RTO) is a key component of a Business Impact Analysis (BIA) because it defines the maximum acceptable downtime for a business process or system after a disruption. The BIA identifies critical functions and their dependencies, and RTO is derived from the financial and operational impact of downtime, directly informing recovery strategy and resource allocation.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 4

An organization uses role-based access control (RBAC). An employee transfers from the Sales department to the Marketing department. What is the most secure way to update the employee's access?

Accepted Answer

Remove the Sales role and then add the Marketing role. In RBAC, access is determined by the roles assigned to a user. The most secure method is to remove the old role (Sales) first to eliminate any residual permissions, then add the new role (Marketing). This ensures the employee does not retain access to Sales resources during the transition, adhering to the principle of least privilege.

Answer

Add the Marketing role and remove the Sales role after 30 days

Answer

Modify the Sales role to include Marketing permissions

Answer

Create a new custom role with combined permissions

Question 5

A cloud application uses OAuth 2.0 to authorize a third-party app to access user data. What is the primary purpose of the access token issued by the authorization server?

Accepted Answer

To grant the client application limited access to user's resources. In OAuth 2.0, the access token is a credential that represents the authorization granted to the client application by the resource owner. Its primary purpose is to allow the client to access specific, scoped resources on the resource server on behalf of the user, without exposing the user's credentials. This is defined in RFC 6749, where the token encapsulates the granted permissions and scope.

Answer

To revoke the user's access to the client application

Answer

To encrypt data exchanged between client and resource server

Answer

To authenticate the user to the resource server

Question 6

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Accepted Answer

Ability to detect previously unknown threats based on anomalous behavior. Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.

Answer

Requires less data processing than signature-based detection

Answer

Easier to configure and maintain

Answer

Lower false positive rates compared to signature-based detection

Question 7

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Accepted Answer

Reintroduction of unpatched vulnerabilities. Snapshots may contain outdated, unpatched software, reintroducing vulnerabilities when reverted.

Answer

VM escape via snapshot file corruption

Answer

Unauthorized access to snapshot data

Answer

Hypervisor memory exhaustion

Question 8

Which TWO are valid reasons to revoke a user's access? (Choose two.)

Accepted Answer

User is terminated. When a user is terminated, their access must be immediately revoked to prevent unauthorized access to systems and data. This is a fundamental principle of access control, ensuring that former employees cannot exploit their credentials. Revocation typically involves disabling the user account, removing group memberships, and invalidating any active sessions or tokens.

Answer

User password expires

Answer

User completes quarterly training

Answer

User updates personal information

Question 9

Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks and their treatment. The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Answer

To record all security incidents after they occur

Answer

To track changes made to system configurations

Answer

To automatically detect vulnerabilities in the network

Question 10

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

Accepted Answer

24-72 hours. Critical vulnerabilities in internet-exposed systems typically require remediation within 24–72 hours under common SLAs (e.g., PCI DSS, NIST, or organizational security policies). This timeframe reflects the high risk of remote exploitation, where an attacker can compromise the server before a longer window expires.

Answer

90 days

Answer

7 days

Answer

30 days

Question 11

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

Accepted Answer

Differential backup. The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Answer

Full backup

Answer

Copy backup

Answer

Incremental backup

Question 12

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Accepted Answer

Second pre-image resistance. When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.

Answer

Avalanche effect

Answer

Collision resistance

Answer

Pre-image resistance

Question 13

A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?

Accepted Answer

Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.. The root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.

Answer

Publish a certificate revocation list (CRL) and wait for existing certificates to expire.

Answer

Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.

Answer

Enable OCSP stapling on all web servers to check revocation status in real time.

Question 14

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

Accepted Answer

Relationships between configuration items. A CMDB is a repository that stores information about configuration items (CIs) and their relationships. Option C is correct because relationships between CIs are fundamental to understanding how changes affect the IT infrastructure. Option E is correct because hardware inventory details like serial numbers are typical attributes stored for each CI, enabling asset tracking and impact analysis.

Answer

Password hashes

Answer

Change request approvals

Answer

Incident tickets

Question 15

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash of the memory dump immediately after capture is the most important step to ensure evidence integrity, as it provides a unique fingerprint to verify that the data has not been altered. Write blockers are used for storage media, not memory captures. Storing the dump on the same server risks modification or loss. Running antivirus is irrelevant and could alter the dump.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 16

Which TWO actions are part of the containment phase of incident response?

Accepted Answer

Applying temporary patches. During the containment phase of incident response, the immediate priority is to stop the incident from spreading or causing further damage. Applying temporary patches (C) can quickly close a vulnerability that is being exploited, while isolating affected systems (D) prevents lateral movement and further compromise. Both actions are short-term measures to contain the threat before eradication and recovery begin.

Answer

Restoring from backups

Answer

Analyzing root cause

Answer

Preserving evidence

Question 17

A company uses a SIEM to monitor security events. Recently, they are experiencing false positives from a new IDS rule. Which approach would best reduce false positives while maintaining detection?

Accepted Answer

Adjust the rule threshold.. Adjusting the rule threshold (Option D) is the best approach because it fine-tunes the sensitivity of the IDS rule to reduce false positives without completely disabling detection. By raising the threshold (e.g., increasing the number of matching packets or the time window), the SIEM will only generate an alert when the rule's criteria are met more persistently, filtering out noise while still capturing genuine threats. This maintains the rule's detection capability for actual attacks that exceed the adjusted threshold.

Answer

Disable the rule.

Answer

Increase the log review frequency.

Answer

Whitelist false positive sources.

Question 18

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?

Accepted Answer

SAML. SAML uses XML assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 19

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)

Question 20

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. Failure to test patches in a staging environment can lead to instability when deployed to production.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release