SSCP Practice Exam 2 — 20 Questions

Question 1

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. B (CCTV) is correct because closed-circuit television cameras are a physical security control that monitors and records activity in a facility to deter and detect intrusions. D (Biometric reader) is correct because it is a physical access control device that authenticates individuals via fingerprints, iris, or facial recognition to restrict entry to a protected area. A (Firewall) is incorrect because it is a logical/network security control that filters traffic based on rules, not a physical barrier. C (Intrusion detection system) is incorrect because an IDS is a logical monitoring control that analyzes network or host activity for malicious behavior. E (Encryption) is incorrect because it is a cryptographic/logical control that protects data confidentiality, not a physical control.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption

Question 2

Which THREE of the following are data loss prevention (DLP) controls that can be implemented to protect sensitive data?

Accepted Answer

Encrypt sensitive data both at rest and in transit. Option B is correct because encryption of sensitive data at rest (e.g., AES-256 on disks/databases) and in transit (e.g., TLS 1.2+) is a core DLP control that renders intercepted or exfiltrated data unreadable, directly preventing unauthorized disclosure. Option C is correct because endpoint DLP agents enforce policies at the source by inspecting and blocking unauthorized transfers via channels such as USB, email, clipboard, and cloud uploads, which is a primary DLP enforcement mechanism. Option D is correct because data classification with sensitivity labels (e.g., Public, Internal, Confidential, Restricted) is the foundational DLP step that identifies what needs protection and drives which handling, encryption, and blocking policies apply. Option A does not belong because strong passwords are an access-control/authentication measure (identity protection), not a control that detects or prevents sensitive data from leaving the organization. Option E does not belong because blocking all outbound traffic via firewalls is a blunt network availability control, not a data-aware DLP control, and it would break legitimate business communications rather than selectively protect sensitive data.

Answer

Require strong passwords for all user accounts

Answer

Implement network firewalls to block all outbound traffic

Question 3

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 4

An attacker sends a large number of DHCP request messages with spoofed MAC addresses to a network's DHCP server, causing the server to exhaust its IP address pool and deny service to legitimate clients. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation is an attack in which the attacker floods the DHCP server with DISCOVER/REQUEST messages using spoofed MAC addresses, exhausting the available IP address pool so legitimate clients cannot obtain a lease. The scenario described — pool exhaustion and denial of service to legitimate clients — is the textbook definition of DHCP starvation.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

DHCP spoofing

Question 5

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Accepted Answer

Step 1: Install the Active Directory Certificate Services role. Step 2: Configure the CA type (e.g., Enterprise Root CA). Step 3: Set the storage locations for certificate database and log. Step 4: Install the CA services. Step 5: Test the CA by requesting a certificate.. Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Answer

Step 1: Install the AD CS role. Step 2: Configure the CA type. Step 3: Install the CA services. Step 4: Set the storage locations. Step 5: Test the CA.

Answer

Step 1: Configure the CA type. Step 2: Install the AD CS role. Step 3: Set storage locations. Step 4: Install the CA services. Step 5: Test.

Answer

Step 1: Install the AD CS role. Step 2: Set storage locations. Step 3: Configure the CA type. Step 4: Install the CA services. Step 5: Test.

Question 6

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the primary configuration file for the sudo command, defining which users or groups can run which commands on which hosts, and whether a password is required. A user with NOPASSWD: ALL in this file can execute any command as root without a password. Therefore, reviewing /etc/sudoers is the correct action to verify the auditor's finding.

Answer

/etc/shadow

Answer

/etc/group

Answer

/etc/passwd

Question 7

Which TWO of the following are examples of administrative controls? (Choose two.)

Accepted Answer

Access control policies. Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Answer

Firewall rules

Answer

Security guards

Answer

Encryption of data at rest

Question 8

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

Accepted Answer

Business unit leaders. Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Answer

External legal counsel

Answer

Internal audit

Answer

Only IT staff

Question 9

An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with the IP address of a legitimate host, causing traffic intended for that host to be sent to the attacker. This enables man-in-the-middle attacks at Layer 2. The scenario described exactly matches ARP spoofing.

Answer

DNS poisoning

Answer

DHCP spoofing

Answer

MAC flooding

Question 10

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. Option E (Change request submission) is correct because the change management process formally begins when a Request for Change (RFC) is submitted and logged, often via a ticketing or ITSM system, so the change can be reviewed and authorized. Option D (Impact assessment) is correct because after the RFC is raised, the change advisory board or reviewers evaluate risk, scope, affected systems, and potential downtime to decide whether the change should be approved. Option A (Post-implementation review) is correct because after the change is deployed, the process includes verifying that it achieved its objective, did not cause unintended issues, and capturing lessons learned for future changes. Option B (Vulnerability scanning) is not a change management step; it is a security assessment activity typically performed under vulnerability management, even though its findings may trigger an RFC. Option C (Baseline configuration update) is not a step in the change management process itself; updating the configuration baseline is a configuration management activity that occurs after an approved change is implemented.

Answer

Vulnerability scanning

Answer

Baseline configuration update

Question 11

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 12

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In IaaS, the customer is responsible for securing the operating system, including patch management, because the provider only manages the hypervisor and physical infrastructure. Operating system security and patching is therefore a customer responsibility. The other options are provider responsibilities in IaaS.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 13

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.

Answer

MAC flooding

Answer

DHCP starvation

Answer

DNS poisoning

Question 14

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the memory dump immediately after capture establishes a verifiable baseline for integrity. Any subsequent modification — accidental or intentional — will change the hash, allowing the analyst to prove the evidence was not tampered with. This chain-of-custody practice is fundamental to forensic admissibility.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 15

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 16

What is the PRIMARY purpose of a lessons learned meeting after an incident?

Accepted Answer

To identify improvements in the incident response process. The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Answer

To assign blame for the incident

Answer

To satisfy regulatory compliance requirements

Answer

To calculate the financial cost of the incident

Question 17

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker is a Windows built-in feature introduced in Windows 7 and Server 2008 R2 that allows administrators to create and enforce rules specifying which applications and files users can run. It uses a whitelisting model based on file attributes such as publisher, path, or hash, and can be configured via Group Policy or PowerShell cmdlets. By default, AppLocker blocks any executable not explicitly allowed, thus ensuring only approved executables run. This directly meets the requirement for application whitelisting on Windows servers.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 18

Which of the following is a key principle of the 3-2-1 backup rule?

Accepted Answer

Three copies on two different media types with one offsite. The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

Answer

Two copies on three different media types with one onsite

Answer

One copy on two different media types with three offsite

Answer

Three copies on three different media types with two offsite

Question 19

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 20

A medium-sized e-commerce company uses a SIEM with correlation rules. During peak sales hours, the SIEM generates an alert: multiple failed login attempts from internal IP 172.16.10.50 followed by a successful login to a critical database server. The account used is 'dbadmin', which normally only authenticates from the IT department subnet. The user 'dbadmin' reports that they had to try several passwords because they forgot theirs earlier. The incident responder is under pressure to quickly restore normal operations. Which course of action should the responder take?

Accepted Answer

Investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP.. While the user's explanation seems plausible, the alert indicates a deviation from normal behavior (logins from an unexpected subnet). The responder should investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP to rule out a potential compromise. Option A (blocking the user's account immediately) could be disruptive if it's a false positive and may prevent legitimate access. Option B (resetting password and enabling MFA) is a good security measure but does not address the need to verify whether the account was actually compromised or if there is ongoing malicious activity. Option C (dismissing the alert as a false positive) is premature and ignores the possibility of credential stuffing or account takeover. Therefore, investigating further is the most appropriate course of action.

Answer

Block the user's account immediately to prevent any further access.

Answer

Reset the user's password and enable multi-factor authentication (MFA).

Answer

Dismiss the alert as a false positive since the user explained the failed attempts.