SSCP Practice Exam 3 — 20 Questions

Question 1

A network administrator notices that wireless users are experiencing intermittent connectivity. The controller shows excessive deauthentication frames. What is the most likely cause?

Accepted Answer

Rogue access point performing a deauthentication attack. Excessive deauthentication frames are a hallmark of a deauthentication attack, where a rogue access point sends forged 802.11 management frames to disconnect clients. This causes intermittent connectivity as clients repeatedly lose association and attempt to reconnect. The controller logs these frames as a clear indicator of an active attack.

Answer

Channel interference

Answer

Power save mode

Answer

DHCP server exhaustion

Answer

Weak encryption

Question 2

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs

Question 3

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

Accepted Answer

Escalate the incident to the incident response manager and legal counsel. When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Answer

Notify the affected customers of the data breach

Answer

Create a forensic image of the compromised server

Answer

Begin containment by isolating affected systems

Question 4

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 5

Refer to the exhibit. An administrator applies this ACL to the external interface. What specific traffic is blocked?

Accepted Answer

All ping requests. The ACL is applied to the external interface and denies ICMP echo-request (type 8) packets while permitting ICMP echo-reply (type 0) packets. This blocks only ping requests (echo-requests) from entering the network, but allows ping replies (echo-replies) to return for outbound-initiated traffic. Therefore, option D is correct because the ACL specifically targets and blocks all ping requests.

Answer

Both ping requests and replies

Answer

Only ping replies

Answer

All ICMP traffic

Question 6

Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?

Accepted Answer

WPA2. WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption, as defined in 802.11i.

Answer

WEP

Answer

WPA

Answer

WPA3

Question 7

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. The number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Question 8

A security analyst reviews the TLS configuration of a web server and notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is enabled. The analyst recommends disabling RSA key exchange and enabling ECDHE. Which security property does ECDHE provide that RSA key exchange lacks?

Accepted Answer

ECDHE provides perfect forward secrecy.. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides Perfect Forward Secrecy (PFS), meaning that if the server's long-term private key is compromised, past session keys cannot be derived. RSA key exchange does not provide PFS because the session key is encrypted with the server's static RSA public key; if the private key is later exposed, all recorded sessions can be decrypted.

Answer

ECDHE is faster than RSA key exchange.

Answer

ECDHE is required by PCI DSS for all web transactions.

Answer

ECDHE uses smaller key sizes for equivalent security.

Question 9

Which THREE of the following are common methods for identifying risks? (Select three.)

Accepted Answer

Threat modeling. Threat modeling is a structured approach for identifying risks by analyzing potential threats, vulnerabilities, and attack vectors in a system. It involves creating diagrams, identifying assets, and applying frameworks like STRIDE or PASTA to systematically uncover risks before they are exploited. This makes it a core risk identification method in the SSCP domain.

Answer

SWOT analysis

Answer

Penetration testing

Question 10

An organization is redesigning its DMZ to host a public web server and an internal file server. Which architecture provides the strongest security?

Accepted Answer

Place the web server in the DMZ and the file server on the internal network; allow only HTTP/HTTPS from web server to file server.. It follows the principle of least privilege and defense in depth by placing the public-facing web server in the DMZ, where it can be accessed from the internet, while the internal file server remains on the internal network, isolated from direct external access. Only HTTP/HTTPS traffic is allowed from the web server to the file server, typically enforced by a stateful firewall or an application-layer gateway, which minimizes the attack surface and prevents lateral movement if the web server is compromised.

Answer

Place both servers in the DMZ with no firewall between them.

Answer

Place the web server on the internal network and the file server in the DMZ with a VPN.

Answer

Place both servers on the internal network with a stateful firewall inspecting traffic.

Question 11

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

Accepted Answer

Recognizing phishing attempts. Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

Answer

Proper use of social media

Answer

Physical security procedures

Answer

Data backup procedures

Question 12

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise

Question 13

A financial services company has recently deployed a new customer-facing web application on port 443. The application is essential for client transactions. Within the first week, the security team's monitoring system detected thousands of failed login attempts originating from a wide range of IP addresses across multiple countries. The attempts are using common usernames and passwords, indicating a coordinated brute-force attack. The company's perimeter firewall is configured with a default allow rule for inbound TCP traffic on port 443 to the web server's public IP address. The company operates with a small IT team and has a limited security budget. The web application is custom-developed and cannot be modified quickly. The security analyst must recommend a solution to mitigate the attack while maintaining availability for legitimate users. Which of the following is the most effective first step?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with rate limiting and CAPTCHA challenges. Deploying a Web Application Firewall (WAF) with rate limiting and CAPTCHA is the most effective solution because it can identify and block malicious traffic patterns without requiring application changes. It operates at the application layer and can enforce policies such as rate limiting per IP, geolocation blocking, and CAPTCHA challenges, which directly mitigate brute-force attacks while minimizing impact on legitimate users. Other options are less effective: IP blacklisting is reactive and cannot handle distributed attacks; changing ports only provides obscurity; enabling SSH does not address the web application attack.

Answer

Implement IP blacklisting by manually adding offending IP addresses to the firewall's deny list

Answer

Change the web server port from 443 to a non-standard high port

Answer

Enable SSH access to the web server for administrative purposes

Question 14

Drag and drop the steps for configuring a Windows Firewall rule to allow inbound RDP traffic into the correct order.

Accepted Answer

Create inbound rule for port 3389 → Allow connection → Select profiles → Name it. Windows Firewall: create inbound rule for port 3389, allow connection, select profiles, name it.

Answer

Create inbound rule for port 3389 → Select profiles → Allow connection → Name it

Answer

Allow connection → Create inbound rule for port 3389 → Select profiles → Name it

Answer

Name it → Create inbound rule for port 3389 → Allow connection → Select profiles

Question 15

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 16

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Accepted Answer

Perform memory forensics before disconnecting. Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Answer

Block the C2 IP at the perimeter

Answer

Shut down the host

Answer

Disconnect the host from the network immediately

Question 17

During a quantitative risk analysis, the asset value is $500,000, the exposure factor is 40%, and the annual rate of occurrence is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). SLE is asset value ($500,000) times exposure factor (40%) = $200,000. ALE = $200,000 × 0.5 = $100,000. This is the standard quantitative risk analysis formula per NIST SP 800-30.

Answer

$200,000

Answer

$500,000

Answer

$250,000

Question 18

A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?

Accepted Answer

Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.. Replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.

Answer

Continue using RC4 and accept the risk, since the network is isolated.

Answer

Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.

Answer

Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.

Question 19

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 20

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect