SSCP Practice Exam 3 — 20 Questions

Question 1

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers

Question 2

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. The Clean Desk Policy is violated because it requires employees to keep their workspaces free of sensitive information, including passwords, when not in use. Writing passwords on sticky notes and attaching them to monitors leaves credentials exposed, directly contravening this policy. The Clean Desk Policy aims to reduce the risk of unauthorized access to information.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 3

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 4

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password, RFC 6238) generates a one-time password derived from a shared secret and the current time step (typically 30 seconds), so the code is valid only within a short time window. This time-bound validity is exactly what the question describes.

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password

Question 5

A PKI administrator needs to check the revocation status of a digital certificate without requiring the client to download the entire CRL. Which method is designed for online, real-time certificate status checking?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) is designed for online, real-time certificate status checking. It allows a client to query an OCSP responder for the revocation status of a specific certificate without downloading the entire CRL.

Answer

OCSP stapling

Answer

CRL

Answer

Certificate transparency

Question 6

What is the primary purpose of a baseline configuration in configuration management?

Accepted Answer

To provide a consistent, secure starting point for systems. A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

Answer

To store configuration items in the CMDB

Answer

To detect malware infections

Answer

To track software licenses

Question 7

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 8

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Accepted Answer

Backup, Overwrite, Verify, Destroy, Document. The proper order for disposing of a hard drive with sensitive data is: first, backup any data that needs to be retained; second, overwrite the entire drive to sanitize it; third, verify that the overwrite was successful using a tool; fourth, physically destroy the drive (e.g., shredding or crushing); and finally, document the process for audit trails and compliance. This sequence ensures data confidentiality and availability of necessary data.

Answer

Overwrite, Verify, Backup, Destroy, Document

Answer

Destroy, Backup, Overwrite, Verify, Document

Answer

Backup, Verify, Overwrite, Destroy, Document

Question 9

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity

Question 10

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy is the correct answer because it is a centralized management feature in Windows Active Directory that allows administrators to define and enforce security policies—such as password complexity, account lockout thresholds, and audit settings—across multiple systems in a domain. Group Policy Objects (GPOs) are linked to sites, domains, or organizational units (OUs) and are applied to computers and users at logon or startup, ensuring consistent policy enforcement. This centralized approach is essential for enterprise environments where local settings would be impractical to manage individually.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)

Question 11

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Accepted Answer

Risk register. The risk register is the formal document used to track identified risks, their assessed likelihood and impact, and the chosen risk response. When a residual risk remains after controls are implemented, the risk register records that residual risk level and formally documents management's decision to accept it, including the rationale and approval. This ensures auditability and accountability for the accepted risk.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Security baseline

Question 12

A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?

Accepted Answer

An earlier deny rule matches the traffic before the permit rule. The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.

Answer

The firewall rule is disabled

Answer

The database server is down

Answer

The internal IP is on a blacklist

Question 13

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Accepted Answer

Create a SIEM correlation rule to alert on multiple failed logins from the same source. A SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.

Answer

Enable signature-based detection on the IDS

Answer

Implement a host-based IDS on the server

Answer

Increase log retention to 1 year

Question 14

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Accepted Answer

To provide a secure configuration standard for systems. A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.

Answer

To calculate annualized loss expectancy

Answer

To replace the need for vulnerability scanning

Answer

To detect intrusions in real-time

Question 15

Which of the following protocols operates on TCP port 443 and provides encrypted communication between a web browser and a web server?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) operates on TCP port 443 and provides encrypted communication between a web browser and a web server using TLS. It is the standard secure web protocol and the only option that matches both the port and the encryption requirement.

Answer

SMTP

Answer

SSH

Answer

HTTP

Question 16

During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

High. In a standard 3x3 qualitative risk matrix, likelihood and impact are each rated Low, Medium, or High, and the intersection of Medium likelihood with High impact yields a High overall risk rating. This is the conventional mapping used in most risk frameworks. The combination is serious enough to warrant prioritized treatment but does not reach the highest tier.

Answer

Medium

Answer

Low

Answer

Critical

Question 17

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. The best action is to remove Telnet and use SSH instead because Telnet transmits data, including credentials, in cleartext, making it inherently insecure. SSH provides encrypted communication, eliminating the vulnerability. Removing the service also reduces the attack surface.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 18

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

Accepted Answer

Classify the incident and determine if escalation is needed.. During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Answer

Immediately disconnect the user's workstation from the network.

Answer

Rebuild the user's workstation from a known-good image.

Answer

Ignore the event as it may be a false positive.

Question 19

A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?

Accepted Answer

Remote access policy. The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

Answer

Data handling policy

Answer

Password policy

Answer

Acceptable use policy (AUP)

Question 20

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery