SSCP Practice Test 21 — 15 Questions

Question 1

In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?

Accepted Answer

The Simple Security Property (no read up). The Simple Security Property (no read up) ensures subjects cannot access objects above their clearance level, protecting confidentiality.

Answer

The *-property (no write down)

Answer

The Discretionary Security Property

Answer

The Lattice Security Property

Question 2

In Role-Based Access Control (RBAC), what is the purpose of role hierarchy?

Accepted Answer

To inherit permissions from higher-level roles. Role hierarchy allows senior roles to inherit permissions from junior roles, simplifying permission management and reflecting organizational structure.

Answer

To enforce separation of duties

Answer

To allow users to have multiple roles

Answer

To reduce the number of roles

Question 3

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 4

Which TWO of the following are best practices for securing a wireless network? (Choose two.)

Accepted Answer

Disable SSID broadcast. Disabling SSID broadcast prevents the access point from including the network name in beacon frames, making the network less visible to casual scanning tools. However, it is not a security measure because the SSID is still transmitted in probe requests and responses, and can be easily discovered using packet capture tools like Wireshark or airodump-ng. It is considered a best practice only as a minor obscurity layer, not a replacement for strong encryption.

Answer

Set a short, simple pre-shared key for convenience

Answer

Use WEP encryption

Answer

Enable MAC address filtering

Question 5

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

Accepted Answer

Signature-based detection. The NIDS generated an alert based on a known exploit signature, which means it compared network traffic against a database of predefined patterns or fingerprints of known attacks. This is the defining characteristic of signature-based detection, where the system relies on exact or pattern matches to known malicious activity.

Answer

Anomaly-based detection

Answer

Behavior-based detection

Answer

Heuristic detection

Question 6

A mid-sized company has deployed a web application that handles sensitive customer data. The application uses TLS to encrypt data in transit. Recently, the company received a penetration test report indicating that an attacker could potentially downgrade the TLS connection to an older, weaker version (e.g., TLS 1.0) by performing a man-in-the-middle attack. The application server runs on Windows Server 2022 with IIS 10. The security team wants to disable all versions of TLS below 1.2 on the server. However, after making registry changes to disable TLS 1.0 and 1.1, some legacy clients that only support TLS 1.0 are unable to connect. The business requires that these legacy clients still be able to access the application securely, but the security team insists on disabling weak protocols. The server currently has a valid certificate from a public CA. Which of the following is the most appropriate course of action?

Accepted Answer

Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.. Deploying a TLS-terminating reverse proxy allows the server to enforce TLS 1.2+ on the backend while the proxy handles legacy TLS 1.0 connections from older clients. This satisfies both the security requirement to disable weak protocols on the origin server and the business need to support legacy clients, without exposing the server to downgrade attacks. The proxy can be configured with separate TLS policies per listener, ensuring that only the proxy accepts weaker TLS versions while the IIS server remains locked down.

Answer

Switch the application to use a VPN instead of TLS for legacy client access.

Answer

Upgrade all legacy clients to support TLS 1.2 or later immediately.

Answer

Re-enable TLS 1.0 and 1.1 on the server, as the business requirement outweighs security concerns.

Question 7

An administrator reports that a TLS handshake fails between a web server and client. The server supports TLS 1.2 with ciphers ECDHE-RSA-AES128-GCM-SHA256 and RSA-AES256-CBC-SHA256. The client supports only TLS 1.0 with ciphers RSA-RC4-SHA and RSA-AES128-SHA. What is the most likely cause?

Accepted Answer

No common TLS version. The TLS handshake fails because the server supports only TLS 1.2, while the client supports only TLS 1.0. During the handshake, the client sends a ClientHello with its highest supported version (1.0), and the server responds with a ServerHello indicating its highest supported version (1.2). Since neither side can downgrade to a mutually supported version, the handshake aborts. This is a version negotiation failure, not a cipher mismatch.

Answer

Cipher suite order misconfiguration

Answer

Certificate validation failure

Answer

No common cipher suite

Question 8

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

Accepted Answer

Lessons learned report. A lessons learned report is a post-incident document that captures what happened during a security incident, including affected assets, the attack vector, and financial impact. It is used to improve future incident response processes and is distinct from operational plans or risk assessments.

Answer

Incident response plan

Answer

Risk register

Answer

Business impact analysis (BIA)

Question 9

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

Accepted Answer

To request service tickets from the Ticket Granting Service (TGS). The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.

Answer

To store the user's password hash securely

Answer

To provide a session key for encrypting communications

Answer

To authenticate the user to the Key Distribution Center (KDC)

Question 10

Which TWO of the following are examples of multifactor authentication? (Choose two.)

Accepted Answer

Smart card and PIN. Multifactor authentication (MFA) requires at least two distinct factors from different categories: something you know, something you have, and something you are. Option A (Smart card and PIN) combines 'something you have' (smart card) and 'something you know' (PIN), satisfying MFA. Option E (Fingerprint and smart card) combines 'something you are' (fingerprint) and 'something you have' (smart card), also satisfying MFA. Options B, C, and D either use two factors from the same category or are not valid factor combinations.

Answer

SMS code and password

Answer

Password and security question

Answer

Voice recognition and iris scan

Question 11

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Accepted Answer

$133,180. The net present value (NPV) is calculated by subtracting the initial control cost from the present value of the annual savings over 5 years. The control reduces the ALE by 80%, saving $40,000 per year ($50,000 × 0.8). Using a 5% discount rate, the present value of these savings is $40,000 × 4.3295 (PV annuity factor for 5 years at 5%) = $173,180. Subtracting the $40,000 implementation cost gives an NPV of $133,180.

Answer

$120,000

Answer

$200,000

Answer

$160,000

Question 12

A company uses digital signatures to ensure the integrity and non-repudiation of internal contracts. The private key used for signing is stored in a hardware security module (HSM). A junior administrator asks why the HSM is necessary. What is the primary reason?

Accepted Answer

It provides non-repudiation by protecting the private key.. The primary reason for using an HSM is to protect the private key from unauthorized access or extraction. Non-repudiation relies on the assurance that only the legitimate signer could have used the private key; if the key is compromised, that assurance is lost. The HSM provides a tamper-resistant environment that performs signing operations internally, ensuring the private key never leaves the secure hardware.

Answer

It reduces network latency during signing.

Answer

It enables symmetric key exchange for large files.

Answer

It allows the signing process to be faster.

Question 13

After a security incident, the CSIRT is conducting lessons learned. Which output is most directly used to update the risk management process?

Accepted Answer

Risk register updates.. The risk management process is directly updated by incorporating new risk information derived from incident analysis. Risk register updates (option B) capture newly identified risks, changes in risk likelihood or impact, and the effectiveness of existing controls, which are the primary outputs that feed back into risk treatment decisions.

Answer

Updated incident response plan.

Answer

Corrective actions.

Answer

Forensic report.

Question 14

A company is implementing encryption for data at rest in a file server. Which TWO of the following algorithms are suitable for this purpose? (Select TWO.)

Accepted Answer

Blowfish. Blowfish is a symmetric block cipher that supports variable key lengths (32–448 bits), making it suitable for encrypting data at rest on a file server. It is designed for fast encryption in software and has been widely used for file and disk encryption, though it is now considered less secure than modern alternatives like AES.

Answer

3DES

Answer

SHA-256

Answer

RSA-2048

Question 15

Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.

Accepted Answer

Step 1: Define security levels and categories. Step 2: Label all objects with sensitivity labels. Step 3: Assign security clearances to subjects. Step 4: Configure the reference monitor to enforce MAC rules (no read up, no write down).. MAC relies on predefined labels; subjects and objects are labeled, then the reference monitor enforces rules like no read up, no write down.

Answer

Step 1: Define security levels and categories. Step 2: Assign security clearances to subjects. Step 3: Label all objects with sensitivity labels. Step 4: Configure the reference monitor to enforce MAC rules.

Answer

Step 1: Define security levels and categories. Step 2: Configure the reference monitor to enforce MAC rules. Step 3: Label all objects with sensitivity labels. Step 4: Assign security clearances to subjects.

Answer

Step 1: Label all objects with sensitivity labels. Step 2: Define security levels and categories. Step 3: Assign security clearances to subjects. Step 4: Configure the reference monitor to enforce MAC rules.