SSCP Practice Test 21 — 15 Questions

Question 1

You are the security analyst at a mid-sized retail company with 500 employees. The company recently experienced a ransomware attack that encrypted files on a file server. The infection was traced to a phishing email opened by an employee in accounting. The company has antivirus software, a firewall, and daily backups. After the incident, management wants to improve risk identification to prevent future attacks. Which of the following is the MOST effective first step to improve risk identification?

Accepted Answer

Conduct a risk assessment that includes threat modeling and vulnerability scanning. Option B is correct because performing a comprehensive risk assessment focusing on people, process, and technology will identify gaps like phishing training gaps, technical controls, etc. Option A only addresses one attack vector; C is reactive; D is a control but not a direct identification step.

Answer

Implement a data loss prevention (DLP) solution to monitor email traffic

Answer

Deploy a SIEM system to aggregate logs from all systems

Answer

Review the logs of the compromised file server for forensic details

Question 2

A security analyst notices an increase in failed login attempts from a single IP address. What is the best immediate action?

Accepted Answer

Check the SIEM for correlated events.. Checking the SIEM for correlated events (Option D) is the best immediate action because it allows the analyst to gather context around the failed login attempts—such as whether they target multiple accounts, originate from a known malicious IP, or coincide with other suspicious activity—before taking a potentially disruptive or irreversible step. This aligns with the incident response principle of 'verify before you act,' ensuring the response is proportional and informed by correlated data from multiple sources.

Answer

Run an antivirus scan.

Answer

Disable the user accounts.

Answer

Block the IP at the firewall.

Question 3

An organization experiences malware that injects code into legitimate processes. Which security feature should be enabled to prevent code execution in memory pages?

Accepted Answer

Data Execution Prevention (DEP). Data Execution Prevention (DEP) is a hardware and software security feature that marks memory pages as non-executable unless they explicitly contain executable code. By preventing code execution in data-only memory regions (such as the heap and stack), DEP stops malware that attempts to inject and run shellcode within legitimate processes, even if the process is compromised.

Answer

Encrypted File System (EFS)

Answer

Address Space Layout Randomization (ASLR)

Answer

Mandatory Access Control (MAC)

Question 4

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

Accepted Answer

Use Delegation of Control wizard to assign the 'Reset user passwords and force password change at next logon' permission.. The Delegation of Control wizard allows granular assignment of specific Active Directory permissions, such as 'Reset user passwords and force password change at next logon', without granting broader administrative rights. This follows the principle of least privilege by limiting the delegated personnel to only the necessary task. Option C is correct because it directly addresses the requirement with a built-in, secure delegation mechanism.

Answer

Place the personnel in the Account Operators group.

Answer

Add the personnel to the Domain Admins group.

Answer

Give the personnel physical access to the domain controller.

Question 5

A system administrator receives a report that a critical server is running low on disk space. After investigation, it is determined that the log files are not being rotated properly. Which of the following is the BEST solution to prevent this issue in the future?

Accepted Answer

Configure log rotation based on size and age.. Option A is correct because implementing log rotation policies ensures logs are archived and space is managed. Option B only adjusts size limit but doesn't rotate. Option C is for applications, not system logs. Option D does not reduce space usage.

Answer

Increase the maximum log file size.

Answer

Redirect logs to a different partition.

Answer

Enable compression on the log folder.

Question 6

An employee reports that they cannot access a shared folder on the network. The security administrator checks the permission and finds that the user is in the correct group, but the 'Deny' entry for a different group is blocking access. What is the MOST likely cause?

Accepted Answer

A Deny ACE is explicitly applied to the user's group.. In Windows NTFS permissions, a Deny Access Control Entry (ACE) explicitly overrides any Allow ACE, regardless of group membership order. Since the user is in the correct group but a Deny entry on a different group blocks access, the most likely cause is that a Deny ACE is explicitly applied to the user's group (or a group the user belongs to), which takes precedence over Allow permissions. This is a core principle of the Windows discretionary access control model.

Answer

The folder is encrypted with EFS.

Answer

The folder has inherited permissions from the parent.

Answer

The user is not a member of the correct group.

Question 7

A company experiences a security breach where an attacker gained access to the network through a compromised vendor account. Which of the following controls would have BEST prevented this attack?

Accepted Answer

Enable multi-factor authentication for vendor accounts.. Multi-factor authentication (MFA) for vendor accounts is the best preventive control because it adds an additional layer of security beyond just a password. Even if the attacker compromises the vendor's credentials, MFA requires a second factor (e.g., a one-time code from a token or biometric) to authenticate, effectively blocking unauthorized access. This directly addresses the attack vector of credential theft, which was the root cause of the breach.

Answer

Install a network-based intrusion detection system.

Answer

Require vendors to sign an NDA.

Answer

Create a separate VLAN for vendor access.

Question 8

An organization uses role-based access control (RBAC). After a merger, a user account from the acquired company is migrated into the parent company's domain. The user is assigned to multiple roles, but is unable to access a critical application that requires a specific role. The administrator verified that the user's account is enabled and the application server is reachable. What is the MOST likely cause?

Accepted Answer

The user's account was not assigned the required role.. In RBAC, access is granted based on the roles explicitly assigned to a user account. Since the administrator confirmed the account is enabled and the application server is reachable, the most likely cause is that the required role was not assigned to the migrated user. Without that role assignment, the user lacks the necessary permissions to access the critical application, regardless of other roles held.

Answer

The user's group memberships are conflicting with the required role.

Answer

There is a firewall rule blocking traffic from the user's IP range.

Answer

The application's session timeout is set too low.

Question 9

Refer to the exhibit. A security analyst reviews the log and determines that the system was under a brute force attack. However, the analyst notices that the attack stopped after 5 minutes, and the IP address was not blocked. Which of the following is the MOST likely reason the attack stopped?

Accepted Answer

The SSH server's MaxAuthTries limit was exceeded.. The SSH server's MaxAuthTries limit (default 6 in OpenSSH) causes the server to terminate the connection after a threshold of failed authentication attempts. This stops the attack on that specific TCP session, but does not block the IP address, which explains why the attack ceased after 5 minutes without any persistent block.

Answer

The system's account lockout policy prevented further attempts.

Answer

The attacker achieved successful login.

Answer

The system's firewall dropped the traffic.

Question 10

An organization wants to prevent unauthorized persons from entering a secure server room. Which control is the MOST effective?

Accepted Answer

Require biometric authentication (fingerprint or retina scan) to unlock the door. Biometric authentication (fingerprint or retina scan) is the most effective control because it verifies the unique physiological characteristics of an individual, making it extremely difficult to bypass, share, or forge. Unlike knowledge-based (keypad code) or possession-based (key card) factors, biometrics provide strong, non-repudiable proof of identity, which is critical for high-security areas like a server room.

Answer

Install a CCTV camera at the entrance

Answer

Post a security guard at the entrance during business hours

Answer

Use a keypad with a unique code for each employee

Question 11

A security analyst is reviewing the access control policy and notices that some users have been granted 'write' access to a directory that contains sensitive financial reports. Which principle of information security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting 'write' access to a directory containing sensitive financial reports to users who do not require that level of access violates this principle, as it introduces unnecessary risk of unauthorized modification or data leakage.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 12

Which THREE of the following are appropriate techniques for securely disposing of magnetic hard disk drives that contain sensitive data? (Choose three.)

Accepted Answer

Shredding. Shredding (B) physically destroys the platters, making data recovery impossible regardless of the magnetic state. This is a definitive disposal method for sensitive data on magnetic hard disk drives.

Answer

Low-level format

Answer

Quick format

Question 13

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Accepted Answer

The ACCEPT rule matches before the DROP rule.. C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Answer

The DROP rule does not apply to SSH.

Answer

The DROP rule is misconfigured with wrong source.

Answer

The default policy allows traffic, overriding the DROP rule.

Question 14

A system administrator is hardening a Windows server. Which two of the following are effective hardening measures? (Choose two.)

Accepted Answer

Disable unnecessary services. Disabling unnecessary services reduces the attack surface by removing potential entry points for malware or unauthorized access. On Windows Server, services like Print Spooler or Windows Search may be disabled if not needed, as they have historically been exploited (e.g., PrintNightmare). This aligns with the principle of least functionality.

Answer

Set file permissions to Everyone: Full Control

Answer

Enable guest account with strong password

Answer

Use Telnet for remote management

Question 15

Refer to the exhibit. What does this event indicate?

Accepted Answer

A failed logon attempt for the Administrator account from the network.. The event shows a logon failure with a status code indicating the account is disabled or locked, but the exhibit specifically references a network logon (logon type 3) for the Administrator account. Option D is correct because the failure is from the network, not interactive or locked out, and the event ID 4625 with logon type 3 indicates a failed network logon attempt.

Answer

A successful logon for the Administrator account.

Answer

An interactive logon failure for the Administrator account.

Answer

The Administrator account is locked out.