SSCP Practice Exam 2 — 20 Questions

Question 1

Which of the following best describes the purpose of a Hardware Security Module (HSM) in key management?

Accepted Answer

To store cryptographic keys in a secure, tamper-resistant environment. A Hardware Security Module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. By keeping keys within the HSM's physical and logical boundaries, it prevents unauthorized extraction even if the host system is compromised, which is the core purpose of an HSM in key management.

Answer

To replace public key infrastructure (PKI)

Answer

To accelerate network traffic encryption

Answer

To generate random numbers for non-cryptographic use

Question 2

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

Accepted Answer

Biometric reader. Biometric readers and mantraps provide strong authentication and access control.

Answer

Visitor log

Answer

Clean desk policy

Answer

Screen locks

Question 3

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

Accepted Answer

To prove that evidence has not been altered or tampered with from collection to presentation. The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Answer

To determine the priority of the incident

Answer

To ensure that evidence is stored in a secure location

Answer

To identify which forensic tools were used during analysis

Question 4

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, Reporting. NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Answer

Detection & Analysis, Containment/Eradication/Recovery, Preparation, Post-Incident Activity, Reporting

Answer

Preparation, Containment/Eradication/Recovery, Detection & Analysis, Post-Incident Activity, Reporting

Answer

Preparation, Detection & Analysis, Post-Incident Activity, Containment/Eradication/Recovery, Reporting

Question 5

Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?

Accepted Answer

Only hosts in the 10.0.0.0/8 range. The firewall rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.

Answer

No hosts can connect to the database

Answer

Both internet hosts and internal hosts

Answer

Any host on the internet

Question 6

A critical vulnerability is discovered in an application currently in use. What should be done first?

Accepted Answer

Test the patch in a non-production environment. Testing the patch in a non-production environment ensures it does not break functionality before deployment. Immediate deployment risks downtime. Disabling the application or notifying users are reactive steps, not the first.

Answer

Notify users to stop using the application

Answer

Disable the application until patch is ready

Answer

Deploy the patch immediately to all systems

Question 7

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Accepted Answer

ClientHello, then ServerHello, then EncryptedExtensions, then Finished from server, then Finished from client. TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Answer

ClientHello, then ServerHello, then Finished from client, then EncryptedExtensions, then Finished from server

Answer

ClientHello, then EncryptedExtensions, then ServerHello, then Finished from server, then Finished from client

Answer

ServerHello, then ClientHello, then EncryptedExtensions, then Finished from server, then Finished from client

Question 8

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 9

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 10

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer

Question 11

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 12

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software

Question 13

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

Accepted Answer

Assess the exploitability and impact to determine remediation priority. The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Answer

Apply the patch immediately to reduce risk

Answer

Re-scan the server to confirm the vulnerability

Answer

Ignore the vulnerability because the patch is available

Question 14

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 15

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 16

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 17

A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.

Answer

SSH (Secure Shell)

Answer

SSL 3.0

Answer

IPsec in transport mode

Question 18

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 19

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 20

An organization is implementing a new remote access VPN for employees using IPsec. Which TWO of the following are best practices for securing the IPsec VPN?

Accepted Answer

Use AES encryption with a minimum key size of 128 bits. AES encryption with a minimum key size of 128 bits is a best practice for IPsec VPNs because it provides strong, symmetric encryption that is resistant to known cryptographic attacks. AES-128 is approved by NIST and widely considered secure for protecting sensitive data over untrusted networks like the internet.

Answer

Use pre-shared keys for authentication

Answer

Disable anti-replay protection to improve performance

Answer

Allow all IP protocols through the VPN tunnel