SSCP Practice Test 22 — 15 Questions

Question 1

A security analyst discovers that an internal host is sending traffic to an external IP address known to be a command-and-control server. The analyst wants to block only that specific traffic without affecting other traffic. Which firewall rule should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deny traffic from the internal host to the external IP.. It creates a specific deny rule that matches only the source IP of the internal host and the destination IP of the command-and-control server, blocking that exact traffic flow while allowing all other traffic to and from both hosts. This is the most precise and least disruptive approach, adhering to the principle of least privilege in firewall rule design.

Answer

Deny all traffic from the internal host.

Answer

Deny all traffic to the external IP.

Answer

Deny traffic on the specific port used.

Question 2

An organization is implementing a digital signature solution to ensure non-repudiation of documents. Which combination of keys is used during the signing process?

Accepted Answer

Sender's private key to sign, sender's public key to verify. Digital signatures use asymmetric cryptography where the sender creates a signature with their private key, and the recipient verifies it with the sender's public key. This ensures non-repudiation because only the sender possesses their private key, so they cannot deny having signed the document. The process typically involves hashing the document and encrypting the hash with the sender's private key.

Answer

Recipient's public key to sign, recipient's private key to verify

Answer

Sender's public key to sign, recipient's private key to verify

Answer

A shared symmetric key for both signing and verification

Question 3

Drag and drop the steps for configuring a Windows Firewall rule to allow inbound RDP traffic into the correct order.

Accepted Answer

Create inbound rule for port 3389 → Allow connection → Select profiles → Name it. Windows Firewall: create inbound rule for port 3389, allow connection, select profiles, name it.

Answer

Create inbound rule for port 3389 → Select profiles → Allow connection → Name it

Answer

Allow connection → Create inbound rule for port 3389 → Select profiles → Name it

Answer

Name it → Create inbound rule for port 3389 → Allow connection → Select profiles

Question 4

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Answer

Warm site

Answer

Mobile site

Answer

Cold site

Question 5

A security team is reviewing access control models for a new document management system. The system must support discretionary sharing where document owners can grant access to other users, but it must also enforce a mandatory rule that any document labeled 'Confidential' cannot be accessed by users without a 'Confidential' clearance, regardless of owner intent. Which access control model best satisfies both requirements?

Accepted Answer

A hybrid approach combining DAC and MAC. The scenario requires both discretionary sharing by owners and mandatory enforcement of confidentiality labels. DAC provides the former but not the latter, while MAC provides the latter but not the former. A hybrid approach that layers MAC enforcement over DAC permissions meets both requirements simultaneously, which is why it is the correct choice.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 6

Which of the following tools would best help a security team detect misconfigurations in a cloud environment, such as open storage buckets or overly permissive IAM roles?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) tools are specifically designed to continuously monitor cloud environments for misconfigurations, compliance violations, and security risks such as open storage buckets and overly permissive IAM roles. They compare the actual configuration against best practices and benchmarks (e.g., CIS, NIST) and alert on deviations. This directly addresses the need to detect misconfigurations.

Answer

Web Application Firewall (WAF)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Event Viewer

Question 7

You are the security analyst at a mid-sized retail company with 500 employees. The company recently experienced a ransomware attack that encrypted files on a file server. The infection was traced to a phishing email opened by an employee in accounting. The company has antivirus software, a firewall, and daily backups. After the incident, management wants to improve risk identification to prevent future attacks. Which of the following is the MOST effective first step to improve risk identification?

Accepted Answer

Conduct a risk assessment that includes threat modeling and vulnerability scanning. A risk assessment with threat modeling and vulnerability scanning is the foundational, proactive step that identifies, quantifies, and prioritizes risks across the environment — including the phishing vector that caused this incident. Threat modeling maps attack paths (e.g., email → endpoint → file server), while vulnerability scanning surfaces unpatched systems and misconfigurations. Together they produce the risk register and treatment plan that all subsequent controls (DLP, SIEM) should be justified against.

Answer

Implement a data loss prevention (DLP) solution to monitor email traffic

Answer

Deploy a SIEM system to aggregate logs from all systems

Answer

Review the logs of the compromised file server for forensic details

Question 8

Which TWO of the following are key components of a Security Information and Event Management (SIEM) system? (Select two.)

Accepted Answer

Centralized log collection and storage. Option B (Centralized log collection and storage) is correct because a SIEM's foundational function is to aggregate logs and event data from disparate sources—firewalls, servers, applications, network devices—into a single repository where they can be retained and searched. Option C (Correlation and analysis engine) is correct because the SIEM's core value lies in correlating events across multiple sources and applying rules, signatures, or behavioral analytics to detect patterns that indicate security incidents, then generating alerts. Option A (Vulnerability scanning) is incorrect because vulnerability scanners are separate tools that identify weaknesses in systems rather than collect and correlate event data, though they may feed findings into a SIEM. Option D (Intrusion detection system) is incorrect because an IDS is a distinct monitoring technology that detects malicious traffic or host activity; it can send alerts to a SIEM but is not itself a SIEM component. Option E (Data loss prevention) is incorrect because DLP is a separate control focused on preventing exfiltration of sensitive data, not on log aggregation or event correlation.

Answer

Vulnerability scanning

Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Question 9

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with multiple IP addresses, causing traffic intended for those IPs to be redirected to the attacker. This matches the scenario where one MAC address claims to be multiple IP addresses. The goal is often to intercept, modify, or block network traffic (man-in-the-middle).

Answer

SYN flood

Answer

DNS poisoning

Answer

DHCP starvation

Question 10

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Accepted Answer

Remove the users from the security group that grants access to the drives.. The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Answer

Delete the user accounts of the affected employees.

Answer

Reconfigure the shared drive to deny access to all users except HR.

Answer

Manually remove each user's permissions on the shared drive.

Question 11

Refer to the exhibit. A user at IP 10.0.0.1 reports that they cannot access a web server at 203.0.113.5 on port 443. What is the most likely cause?

Accepted Answer

The firewall does not have a rule permitting outbound traffic.. The user at 10.0.0.1 cannot reach 203.0.113.5:443, which indicates that outbound traffic to that destination is not permitted. Firewalls by default block all traffic unless explicitly allowed; if no rule permits outbound HTTPS (TCP/443) traffic, the connection will be dropped. The symptom (inability to access an external web server) points to a missing outbound rule, not an inbound rule issue.

Answer

The firewall only permits inbound traffic to specific IPs.

Answer

The firewall rule order is incorrect.

Answer

The firewall blocks all outbound traffic.

Question 12

Refer to the exhibit. A systems administrator configures this Group Policy setting. What is the direct consequence?

Accepted Answer

Members of Backup Operators cannot connect to the server using Remote Desktop.. The 'Deny log on through Remote Desktop Services' policy explicitly prevents members of Backup Operators from using Remote Desktop. Therefore, they cannot connect via RDP, making Option A correct. Option B is incorrect because the policy only affects Remote Desktop, not local console logon. Option C is incorrect because the policy denies, not allows. Option D is incorrect because it does not affect other remote access methods like SSH unless specifically configured.

Answer

Members of Backup Operators are prohibited from local console logon.

Answer

Members of Backup Operators can connect via Remote Desktop.

Answer

Members of Backup Operators are prevented from using any remote access method.

Question 13

Which three statements are true regarding mandatory access control (MAC) systems? (Select THREE)

Accepted Answer

Multilevel security is enforced. Option A is correct because MAC systems enforce multilevel security, where information flows are restricted between hierarchical sensitivity levels (e.g., Confidential, Secret, Top Secret) according to the system's policy rather than user discretion. Option B is correct because in MAC, every subject (user or process) is assigned a clearance level that determines the maximum classification of data it may access. Option C is correct because access decisions in MAC are made by comparing the security labels (classification) of objects against the clearance and labels of subjects, per rules such as Bell-LaPadula's no-read-up and no-write-down. Option D is incorrect because in MAC the owner cannot arbitrarily relabel an object; label changes are controlled by the system's security policy and typically require privileged administrative authority. Option E is incorrect because discretionary delegation of permissions to other users is characteristic of DAC, not MAC, where access is governed by system-enforced labels and clearances rather than owner-granted permissions.

Answer

The owner of an object can change its security label

Answer

Users can grant permissions to other users

Question 14

During a security audit, it is discovered that a developer has direct access to production databases. The policy requires that changes be reviewed and deployed by a separate team. Which control is being violated?

Accepted Answer

Separation of duties. The scenario describes a direct violation of separation of duties (SoD), a core access control principle that requires critical tasks to be divided among multiple individuals to prevent fraud or error. In this case, the developer both writes code and has direct access to production databases, bypassing the required review and deployment by a separate team. SoD ensures no single person has end-to-end control over a sensitive process, which is essential for maintaining integrity and accountability in production environments.

Answer

Need-to-know

Answer

Job rotation

Answer

Least privilege

Question 15

A company uses a SIEM to detect anomalies. An alert indicates a user logged in from two geographically distant locations within 5 minutes. What is the most likely indication?

Accepted Answer

Credential theft and reuse. Simultaneous logins from two geographically distant locations within a very short window is a classic impossible-travel indicator, which strongly suggests the credentials were stolen and reused by an attacker while the legitimate user is elsewhere. This pattern is a hallmark of credential theft, phishing, or credential-stuffing attacks. A SIEM correlates authentication logs with geolocation and time to flag exactly this anomaly.

Answer

Insider threat

Answer

Time synchronization issue

Answer

Misconfigured VPN