SSCP Practice Exam 4 — 20 Questions

Question 1

Which of the following hash algorithms is considered cryptographically broken and should be avoided due to collision attacks?

Accepted Answer

MD5. MD5 is known to have collision vulnerabilities and is no longer considered secure.

Answer

SHA-3

Answer

SHA-256

Answer

HMAC-SHA256

Question 2

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 3

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 4

A system administrator needs to implement a control that ensures users can only access files necessary for their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege ensures that users are granted only the permissions necessary to perform their job functions, minimizing the attack surface and potential damage from accidental or malicious actions. In this scenario, restricting file access to only what is needed for job duties directly implements least privilege, as it limits access rights to the minimum required. This is distinct from need-to-know, which focuses on information disclosure rather than access permissions.

Answer

Need-to-know

Answer

Separation of duties

Answer

Job rotation

Question 5

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Accepted Answer

The user does not have the 'Allow log on through Remote Desktop Services' user right. The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer

The user account is locked out

Answer

The server is not a member of the domain

Answer

The user's Kerberos ticket has expired

Question 6

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 7

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Accepted Answer

Clients will receive a certificate warning or be unable to connect.. When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.

Answer

The server will automatically obtain a new certificate.

Answer

Clients will connect but with reduced cipher strength.

Answer

Clients will be able to connect without any warning.

Question 8

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 9

A security analyst notices an increase in failed login attempts from a single IP address. What is the best immediate action?

Accepted Answer

Check the SIEM for correlated events.. Checking the SIEM for correlated events (Option D) is the best immediate action because it allows the analyst to gather context around the failed login attempts—such as whether they target multiple accounts, originate from a known malicious IP, or coincide with other suspicious activity—before taking a potentially disruptive or irreversible step. This aligns with the incident response principle of 'verify before you act,' ensuring the response is proportional and informed by correlated data from multiple sources.

Answer

Run an antivirus scan.

Answer

Disable the user accounts.

Answer

Block the IP at the firewall.

Question 10

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration

Question 11

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Accepted Answer

DES. DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.

Answer

RSA-2048

Answer

AES-256

Question 12

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

Accepted Answer

Isolate the domain controller from the network.. The domain controller (DC) is showing signs of active compromise: unusual outbound traffic on port 443 (likely C2 communication) and a failed backup due to a volume shadow copy error (indicating attempted destruction of forensic evidence). Isolating the DC first stops the attacker's command-and-control channel and prevents lateral movement, which is the highest priority in incident response. Running a scan or restoring other systems before containment risks allowing the attacker to spread or destroy more data.

Answer

Run a full malware scan on the domain controller.

Answer

Restore the file server from last night's backup.

Answer

Disable the domain controller's antivirus to improve performance.

Question 13

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 14

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 15

A security analyst is evaluating encryption modes for a new system that requires authenticated encryption to ensure both confidentiality and integrity of data in transit. Which AES mode should the analyst recommend?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides authenticated encryption, combining the confidentiality of CTR mode with integrity verification via a Galois field authentication tag. This makes it ideal for securing data in transit, as it ensures both privacy and tamper detection in a single, efficient operation.

Answer

ECB

Answer

CBC

Answer

CTR

Question 16

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Accepted Answer

Step 1: Install the Active Directory Certificate Services role. Step 2: Configure the CA type (e.g., Enterprise Root CA). Step 3: Set the storage locations for certificate database and log. Step 4: Install the CA services. Step 5: Test the CA by requesting a certificate.. Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Answer

Step 1: Install the AD CS role. Step 2: Configure the CA type. Step 3: Install the CA services. Step 4: Set the storage locations. Step 5: Test the CA.

Answer

Step 1: Configure the CA type. Step 2: Install the AD CS role. Step 3: Set storage locations. Step 4: Install the CA services. Step 5: Test.

Answer

Step 1: Install the AD CS role. Step 2: Set storage locations. Step 3: Configure the CA type. Step 4: Install the CA services. Step 5: Test.

Question 17

A financial firm has deployed network-based IDS/IPS sensors at key points to detect and prevent intrusions. During a recent security audit, it was discovered that an attacker exfiltrated sensitive data using DNS over HTTPS (DoH) queries. The IDS/IPS did not generate any alerts. The firm's network policy allows all outbound HTTPS traffic to any destination. To prevent such exfiltration in the future, what is the most effective corrective action?

Accepted Answer

Deploy TLS termination at the network perimeter. Deploying TLS termination at the network perimeter allows the organization to decrypt inbound and outbound HTTPS traffic, inspect the plaintext content, and re-encrypt it before forwarding. This enables the IDS/IPS to detect malicious payloads, such as DNS over HTTPS (DoH) queries, that would otherwise be hidden inside encrypted tunnels. Since the firm's policy allows all outbound HTTPS, TLS termination is the most effective way to regain visibility into that traffic without blocking it outright.

Answer

Enable deep packet inspection on all encrypted traffic

Answer

Implement a DNS sinkhole and block non-corporate DNS servers

Answer

Configure the IDS/IPS to inspect DNS traffic on standard port 53 only

Question 18

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 19

A company wants to secure wireless communication for guests. Which protocol provides the strongest encryption for a wireless network?

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) provides the strongest encryption for wireless networks, using 128-bit AES in CCMP mode for encryption and replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks. This makes it the most secure option among the choices, especially for guest networks where authentication security is critical.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with TKIP

Answer

WPA2-PSK with AES

Question 20

Which metric is used to measure the potential loss from a single occurrence of a risk?

Accepted Answer

Single Loss Expectancy (SLE). The Single Loss Expectancy (SLE) is the metric used to measure the potential loss from a single occurrence of a risk. It is calculated as Asset Value (AV) multiplied by the Exposure Factor (EF), providing a dollar value for one incident. This directly answers the question of loss per single event.

Answer

Exposure Factor (EF)

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)