SSCP Practice Exam 2 — 20 Questions

Question 1

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 2

Which TWO components are essential for an effective disaster recovery plan (DRP)?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, which directly determines the required backup frequency and data replication strategy. Without an RPO, the DRP cannot specify how much data can be lost, making it impossible to design appropriate backup and recovery mechanisms. This metric is essential because it drives the technical implementation of data protection, such as snapshot intervals or synchronous replication.

Answer

Automated failover system

Answer

Business Impact Analysis (BIA)

Answer

Redundant array of independent disks (RAID)

Question 3

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

Accepted Answer

To force the switch to act like a hub and allow packet sniffing. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of fake source MAC addresses, the attacker fills the CAM table, causing the switch to fail open and flood all incoming frames out all ports, effectively behaving like a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

To change the MAC address of the switch

Answer

To cause a denial of service on the network

Answer

To bypass 802.1X authentication

Question 4

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

Accepted Answer

MFA fatigue attack. MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Answer

Session hijacking

Answer

Man-in-the-middle (MITM) attack

Answer

Token theft from the endpoint

Question 5

Which THREE of the following are common types of network attacks?

Accepted Answer

ARP spoofing. ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Answer

Pharming

Answer

SQL injection

Question 6

Which TWO of the following are symmetric encryption algorithms? (Select exactly two.)

Accepted Answer

DES. DES (Data Encryption Standard) is a symmetric encryption algorithm that uses a single key for both encryption and decryption. It operates on 64-bit blocks with a 56-bit key, and while now considered insecure due to its small key size, it remains a foundational symmetric cipher. AES (Advanced Encryption Standard) is also symmetric, using block sizes of 128 bits and key sizes of 128, 192, or 256 bits, and is the current standard for symmetric encryption.

Answer

RSA

Answer

ECC

Answer

SHA-256

Question 7

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 8

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Accepted Answer

TCP port 443. HTTPS (HTTP over TLS) uses TCP as its transport protocol because it requires reliable, connection-oriented delivery for secure web traffic. The default port for HTTPS is 443, as defined in RFC 2818. Therefore, allowing TCP port 443 is the correct firewall rule.

Answer

UDP port 80

Answer

UDP port 443

Answer

TCP port 80

Question 9

Refer to the exhibit. A security analyst reviews this AWS IAM policy and notices that delete operations on objects in the corporate-bucket are being denied unexpectedly. What is the most likely issue?

Accepted Answer

The Deny statement requires objects to be encrypted with AES256 for delete operations. Option A is correct because the Deny statement includes a condition that requires objects to be encrypted with AES256 for all operations, including delete. Since the condition is not limited to specific actions, any delete request on an object that is not encrypted with AES256 will be denied, even if the Allow statement grants s3:DeleteObject permissions. This is a common misconfiguration where encryption requirements inadvertently block operations that do not involve encryption checks.

Answer

The Allow statement is being overridden by the Deny, but the cause is the encryption requirement

Answer

The condition on the Deny statement is not matching any objects

Answer

The policy has a syntax error in the Condition element

Question 10

A security engineer is designing a system to store passwords securely. Which of the following is the most robust approach for password storage?

Accepted Answer

Use bcrypt with a high cost factor. Bcrypt is the most robust option because it incorporates a salt to defend against rainbow table attacks and uses a configurable cost factor to deliberately slow down the hashing process, making brute-force attacks computationally expensive. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password storage and resists GPU-accelerated attacks by requiring significant memory and time per attempt.

Answer

Hash passwords with SHA-256

Answer

Encode passwords with Base64

Answer

Encrypt passwords using AES-256 and store the key separately

Question 11

Which TWO of the following are common weaknesses in cryptographic implementations that an SSCP should be aware of? (Select exactly 2.)

Accepted Answer

Weak random number generation. Weak random number generation is a critical flaw because cryptographic keys, nonces, and initialization vectors rely on unpredictability. If an attacker can predict or reproduce the random values (e.g., due to a low-entropy source or a flawed PRNG like a linear congruential generator), they can derive secret keys or break session security. This undermines the entire cryptographic system regardless of the algorithm strength.

Answer

Frequent rekeying

Answer

Using proven encryption algorithms like AES

Answer

Following NIST guidelines

Question 12

Refer to the exhibit. A network administrator implements this ACL on a border router. What is the effect?

Accepted Answer

SSH to 192.168.1.100 is permitted from any source. Option A is correct because the ACL explicitly permits TCP traffic sourced from any IP address destined to 192.168.1.100 on port 22, which is the default port for SSH. Since the ACL is applied inbound on the border router's external interface, it allows SSH connections from any external source to reach the internal host 192.168.1.100, while implicitly denying all other traffic.

Answer

SSH is completely blocked

Answer

All traffic to 192.168.1.100 is permitted

Answer

Only SSH from external networks is blocked

Question 13

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Accepted Answer

The application passes user input to a shell command via exec() or system() functions.. Option C is correct because the scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Answer

The application uses unsanitized input in SQL queries.

Answer

The application reflects user input in HTTP responses without escaping.

Answer

The application uses hidden form fields to store session tokens.

Question 14

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Accepted Answer

Mount the /tmp and /var partitions with the 'nosuid' option.. Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.

Answer

Enable auditd to log all SUID executions.

Answer

Set the umask to 077 for all users.

Answer

Remove all SUID binaries from the system.

Question 15

Based on the exhibit, which security threat is likely being attempted?

Accepted Answer

Brute-force attack. The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.

Answer

DNS poisoning

Answer

Man-in-the-middle attack

Answer

SQL injection

Question 16

During an incident, the IR team needs to collect volatile data. Which order should they follow?

Accepted Answer

Memory, running processes, network connections, hard disk. Option D is correct because volatile data must be collected in order of decreasing volatility to minimize data loss. Memory (RAM) is the most volatile, followed by running processes, network connections, and finally the hard disk, which is non-volatile. This order ensures that transient evidence (e.g., encryption keys, active network sessions) is captured before it disappears.

Answer

Hard disk, memory, network connections, running processes

Answer

Network connections, running processes, memory, hard disk

Answer

Running processes, memory, network connections, hard disk

Question 17

Refer to the exhibit. The security analyst sees this event from a user workstation. What is the most likely conclusion?

Accepted Answer

A user is trying to escalate privileges. The event shows a user account (likely a standard user) attempting to add itself to a privileged group such as the local Administrators group. This action requires administrative rights, and the attempt by a non-admin user to modify group membership is a classic privilege escalation technique. The security analyst should recognize this as an unauthorized attempt to gain higher access, not a normal administrative action.

Answer

A malware is spreading

Answer

A legitimate administrator added a user

Answer

A failed login attempt

Question 18

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 19

Refer to the exhibit. The security group is attached to a database server. Which hosts can connect to the database?

Accepted Answer

Only hosts in the 10.0.0.0/8 range. The security group rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.

Answer

No hosts can connect to the database

Answer

Both internet hosts and internal hosts

Answer

Any host on the internet

Question 20

A company's log management solution is overwhelmed by high-volume logs from network devices, causing storage and analysis delays. Which strategy would best improve the efficiency of the log management process?

Accepted Answer

Implement log filtering and prioritization rules. Implementing log filtering and prioritization rules (Option C) directly addresses the root cause of the problem by reducing the volume of irrelevant or low-priority logs before they are stored or analyzed. This improves both storage efficiency and analysis speed, as the log management system processes only meaningful events, such as those matching security or performance thresholds, rather than being overwhelmed by high-frequency noise like repeated informational syslog messages.

Answer

Increase the storage capacity of the log server

Answer

Increase the frequency of log analysis cycles

Answer

Reduce the number of devices sending logs

SSCP Practice Exam 2 — 20 Questions

Exhibit

SSCP Practice Exam 2 — 20 Questions

Exhibit