SSCP Practice Test 21 — 15 Questions

Question 1

A security analyst is reviewing access controls for a database server. The database administrator has granted all users in the 'sales' role SELECT, INSERT, UPDATE, and DELETE permissions on the 'orders' table. Which access control principle is being violated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Least privilege. Granting every user in the 'sales' role full SELECT, INSERT, UPDATE, and DELETE on the orders table violates least privilege, which requires granting only the minimum permissions needed for each user's job function. Most sales users likely need only SELECT (or limited INSERT), not DELETE or UPDATE. Broad role-wide grants exceed what any individual requires.

Answer

Accountability

Answer

Separation of duties

Answer

Need to know

Question 2

A company uses AWS for critical workloads. An analyst notices unauthorized API calls from an IP address outside the company. The logs show that the attacker used stolen access keys belonging to an IAM user with administrative privileges. The incident response team must contain the breach as quickly as possible. The analyst has access to the AWS Management Console and can use the CLI. The team is following the incident response plan. Which action should be taken FIRST to prevent further unauthorized actions?

Accepted Answer

Disable the compromised access keys using the IAM dashboard or CLI.. The immediate priority in an access key compromise is to invalidate the stolen credentials to stop the attacker from making further API calls. Disabling the compromised access keys via the IAM dashboard or CLI (using `aws iam update-access-key --status Inactive`) is the fastest containment action that directly revokes the attacker's authentication token without disrupting other legitimate users or services.

Answer

Create a new security group to block the attacker's source IP at the network level.

Answer

Delete the compromised IAM user immediately.

Answer

Rotate all IAM user access keys across the entire AWS account.

Question 3

A biometric system has a high false rejection rate (FRR). Which of the following is a likely consequence?

Accepted Answer

Legitimate users may be denied access, leading to frustration. A high false rejection rate (FRR) means the biometric system incorrectly rejects legitimate users. This leads to frustration and potential productivity loss as authorized individuals are denied access. FRR is a key performance metric; a high FRR indicates the system is too strict.

Answer

The system will require less frequent calibration

Answer

Unauthorized users are more likely to gain access

Answer

The system's crossover error rate (CER) will be very low

Question 4

Which of the following is the correct order of the access control process?

Accepted Answer

Identification, authentication, authorization, accountability. The access control process begins with identification, where a subject claims an identity (e.g., username). Next is authentication, verifying that identity (e.g., password). Then authorization determines what resources the authenticated subject can access. Finally, accountability involves logging and auditing actions to hold the subject responsible. This sequence is fundamental in security models.

Answer

Identification, authorization, authentication, accountability

Answer

Authorization, authentication, identification, accountability

Answer

Authentication, identification, authorization, accountability

Question 5

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) gives resource owners discretion to grant or deny access to others.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 6

In a forensic investigation, a hash of a suspect file is computed. Which of the following is the primary purpose of hashing in this context?

Accepted Answer

To verify file integrity. In forensic investigations, hashing (using algorithms like SHA-256 or MD5) produces a unique fixed-size digest of the file's contents. The primary purpose is to verify file integrity by comparing the hash before and after analysis, ensuring the evidence has not been altered. This provides a cryptographic chain of custody, as any change to the file results in a completely different hash value.

Answer

To compress the file

Answer

To decrypt the file

Answer

To identify the file owner

Question 7

A security analyst receives an alert from the EDR system indicating that a workstation has been communicating with a known malicious IP address. The analyst confirms the alert and notes that the user is still logged in. Which immediate containment action should the analyst take FIRST?

Accepted Answer

Isolate the workstation using the EDR agent's network isolation capability. Network isolation via the EDR agent is the fastest, least disruptive containment action that stops the active command-and-control channel while preserving volatile memory and forensic artifacts on the host. It cuts the malicious traffic immediately without tipping off the attacker through account lockouts or firewall changes that might be noticed. This aligns with the containment phase of incident response, where speed and evidence preservation are both prioritized.

Answer

Create a full forensic image of the hard drive

Answer

Disable the user's Active Directory account

Answer

Block the malicious IP address at the firewall

Question 8

A company deploys a guest Wi-Fi network that must be isolated from the internal network. The network team uses VLANs and a firewall. Which configuration best ensures isolation?

Accepted Answer

Create a separate VLAN for guest traffic with a firewall rule blocking access to internal subnets.. Creating a separate VLAN for guest traffic logically segments the network at Layer 2, and adding a firewall rule that explicitly blocks access to internal subnets enforces isolation at Layer 3/4. This ensures guest devices cannot reach internal resources, even if they are on the same physical infrastructure.

Answer

Configure the same SSID for both guest and internal networks but use different passwords.

Answer

Use WPA2 encryption with a pre-shared key and disable SSID broadcast.

Answer

Assign guest devices to the same subnet as internal devices but enforce MAC filtering.

Question 9

Which access control model allows the owner of a resource to grant access permissions to other users?

Accepted Answer

DAC (Discretionary Access Control). DAC (Discretionary Access Control) is defined by the resource owner having discretion to grant or revoke access to other subjects, typically via ACLs or Unix file permissions. The owner decides who gets access, which is the defining characteristic of discretionary control. This is contrasted with MAC, where the system enforces access based on labels and clearances, not owner choice.

Answer

RBAC (Role-Based Access Control)

Answer

MAC (Mandatory Access Control)

Answer

ABAC (Attribute-Based Access Control)

Question 10

A system administrator is applying CIS Benchmarks to a Windows server. Which TWO hardening measures are typically recommended by CIS? (Select TWO.)

Accepted Answer

Enforce strong password policies. Option C (Enforce strong password policies) is correct because CIS Benchmarks for Windows Server explicitly require configuring account policies such as minimum password length (typically 14 characters), password complexity, maximum password age, and password history to reduce the risk of brute-force and credential-guessing attacks. Option D (Disable unused services) is correct because CIS hardening guidance mandates disabling or setting to Disabled any unnecessary services (e.g., Fax, Windows Search, Remote Registry) to shrink the attack surface and eliminate unneeded listening ports and privileged functionality. Option A is wrong because enabling all Windows features by default directly contradicts CIS least-functionality principles, which call for removing or not installing unneeded roles and features. Option B is wrong because CIS Benchmarks require enabling and configuring audit logging (e.g., via Advanced Audit Policy) to capture security-relevant events, not disabling it. Option E is wrong because allowing anonymous enumeration of SAM accounts is a known information-disclosure weakness that CIS explicitly prohibits by requiring the Anonymous Enumeration of SAM Accounts and Shares setting to be Disabled.

Answer

Enable all Windows features by default

Answer

Disable audit logging

Answer

Allow anonymous enumeration of SAM accounts

Question 11

A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?

Accepted Answer

Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.. Applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.

Answer

Add a firewall rule to block all traffic to and from the server's IP.

Answer

Move the server to a quarantine VLAN with no route to the internet.

Answer

Shut down the switch port to disconnect the server immediately.

Question 12

An organization using cloud IAM wants to grant a compute instance permissions to access a cloud storage bucket without storing long-term credentials on the instance. Which IAM feature should be used?

Accepted Answer

IAM role assigned to the compute instance. IAM roles for compute instances allow the instance to assume a role and obtain temporary credentials from a security token service, avoiding the need for long-term keys.

Answer

Service-level access policies

Answer

Long-term user access keys

Answer

Resource-based policies on the storage bucket

Question 13

A company is migrating to the cloud and wants to understand the shared responsibility model. For an IaaS deployment, which THREE are customer responsibilities? (Select THREE.)

Accepted Answer

Managing application security (e.g., patching web app code). In IaaS, customer manages OS, applications, and network traffic controls (guest OS firewall).

Answer

Physical security of the data center

Answer

Securing the hypervisor

Question 14

A security administrator is reviewing Linux audit logs to detect unauthorized file access. Which Linux component is primarily responsible for generating these security audit logs?

Accepted Answer

auditd. auditd is the userspace component of the Linux Audit system that writes audit records to disk.

Answer

systemd-journald

Answer

SELinux

Answer

PAM

Question 15

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Incremental backup

Answer

Snapshot backup

Answer

Full backup