SSCP Practice Test 23 — 15 Questions

Question 1

A security analyst notices repeated failed login attempts from a single IP address within a short time window. Which control should be implemented to automatically mitigate this behavior?

Accepted Answer

Implement account lockout policy. An account lockout policy automatically disables an account after a specified number of failed login attempts within a defined time window, directly mitigating brute-force attacks from a single IP. This control is specifically designed to prevent repeated authentication failures by temporarily or permanently locking the account, stopping further attempts without manual intervention.

Answer

Set session timeout to 15 minutes

Answer

Enforce complex password policy

Answer

Require multi-factor authentication

Question 2

An organization has detected a ransomware infection on a critical file server. The incident response team has been activated. Which TWO actions should be performed FIRST during the initial response phase?

Accepted Answer

Immediately disconnect the file server from the network. Immediately disconnecting the file server from the network is a critical containment action that stops the ransomware from encrypting additional files on the server and prevents lateral movement to other systems. This aligns with the first priority in incident response: containment before eradication or recovery. Disconnecting at the switch port or disabling the network interface card (NIC) is preferred over a graceful shutdown to avoid triggering any persistence mechanisms.

Answer

Determine the type of ransomware variant

Answer

Reimage the file server using a known good backup

Answer

Notify law enforcement authorities

Question 3

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

Accepted Answer

Place the workstation into a quarantine VLAN via switch configuration. Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Answer

Apply a host-based firewall rule to block all inbound traffic

Answer

Physically unplug the network cable

Answer

Disable the user's Active Directory account

Question 4

A security team discovers that a legacy system uses ECB mode to encrypt credit card numbers. What is the primary security concern with this mode?

Accepted Answer

Identical plaintext blocks produce identical ciphertext, revealing patterns. ECB (Electronic Codebook) mode encrypts each plaintext block independently using the same key. This means identical plaintext blocks produce identical ciphertext blocks, which allows an attacker to detect patterns, data boundaries, and repetitions in the encrypted data. For credit card numbers, which often have predictable formats (e.g., BIN ranges, fixed lengths), this pattern leakage can reveal sensitive information without breaking the encryption key.

Answer

It is slow compared to other modes

Answer

It is vulnerable to padding oracle attacks

Answer

It does not provide integrity

Question 5

A company needs to ensure that when an employee leaves the organization, their accounts are disabled promptly to prevent unauthorized access. Which approach is MOST effective for timely account deactivation?

Accepted Answer

Automatically synchronize with the HR system to disable accounts upon termination.. Automatically synchronizing with the HR system ensures that account deactivation occurs immediately upon termination, eliminating human delay or error. This approach leverages identity lifecycle management (ILM) to enforce the principle of least privilege and prevent unauthorized access through orphaned accounts.

Answer

Conduct quarterly access reviews to identify and disable unused accounts.

Answer

Require managers to report departures via a ticketing system.

Answer

Implement a self-service password reset system to empower users.

Question 6

A small company with 50 employees uses a local file server for sharing documents. Each employee has a username and password for authentication. The company wants to implement an additional layer of security to protect sensitive data without incurring high costs. They are considering using smart cards or biometric scanners. However, the budget is limited, and employees often work remotely. Which of the following is the most cost-effective and practical approach to strengthen authentication?

Accepted Answer

Implement a one-time password (OTP) system via a mobile app.. One-time password (OTP) via a mobile app is low-cost, does not require additional hardware, and works well for remote employees by providing a second factor without relying on location-specific devices. Smart cards or USB tokens require hardware purchase and distribution. Biometrics like Windows Hello require compatible hardware and may not be available on all remote devices. Increasing password complexity is not multi-factor authentication and does not add a second factor.

Answer

Increase password complexity requirements and enforce periodic changes.

Answer

Issue USB tokens to all employees.

Answer

Use Windows Hello facial recognition on company laptops.

Question 7

A company runs a critical web application on an internal server that authenticates users against a Microsoft SQL Server database. The application was developed by a vendor that is no longer in business, and the source code is unavailable. The current authentication process stores user passwords using reversible encryption. The security team has identified this as a high-risk vulnerability. They propose implementing a database-level trigger that hashes the password column during INSERT and UPDATE operations, and modifying the application's stored procedures to compare hashed values during login. However, after implementation, users report that they cannot log in. The authentication logs show that the password comparison always fails. The database administrator confirms that the trigger is working and that new user registrations store the SHA-256 hash. What is the most likely cause of the login failures?

Accepted Answer

The stored procedure for login is still comparing the plain-text password with the hash.. The stored procedure for login likely still expects a plain-text password and compares it directly to the stored hash, causing failure. Option A is incorrect because the trigger should fire on all updates, including those by the same user. Option B is incorrect because the trigger uses SHA-256 and the stored procedure should use the same algorithm. Option D is incorrect because the trigger should be defined on the password column.

Answer

The trigger does not hash the password during UPDATE operations that are performed by the same user.

Answer

The application is using a different hashing algorithm than the trigger.

Answer

The trigger hashes the password only if the password column is part of a specific set of columns.

Question 8

A company uses a federated identity system where partner employees access internal applications via SAML assertions. Recently, a partner employee who should have been terminated was still able to log in. Which missing control is the most likely root cause?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning is the missing control because it ensures that user accounts are created and, more critically, disabled or removed in real-time based on the identity provider's (IdP) authoritative directory. Without JIT provisioning, the partner employee's account in the service provider (SP) remains active even after termination in the IdP, allowing continued access via valid SAML assertions. JIT provisioning would synchronize the account lifecycle by checking the IdP's user status at each authentication attempt and disabling the local account when the user is deactivated.

Answer

Identity proofing

Answer

Session timeout

Answer

Single sign-on logout

Question 9

You are the security administrator for a healthcare organization that uses a Windows Active Directory domain. The organization has recently implemented a new electronic health record (EHR) system that requires users to authenticate before accessing patient data. The EHR system uses Kerberos for authentication. Users report that they can access the EHR system from their office workstations, but when they attempt to access it remotely via VPN, they receive an 'Access Denied' error. The VPN uses RADIUS for authentication and assigns IP addresses from a separate subnet. The EHR server is in the same domain as the workstations. You verify that the users are able to connect to the VPN successfully and can access other internal resources. What is the most likely cause of the issue?

Accepted Answer

The remote user's system clock is not synchronized with the domain controller.. Kerberos authentication is highly sensitive to time skew; the default maximum tolerance is 5 minutes (RFC 4120). When users connect via VPN, their system clocks may drift from the domain controller's time, especially if they are not synchronized with the domain's time source. This time difference causes Kerberos to reject the ticket request, resulting in an 'Access Denied' error even though the VPN connection itself is successful.

Answer

The EHR server is not joined to the domain.

Answer

The VPN does not forward Kerberos traffic to the domain controller.

Answer

The user's account is not in the EHR application's access group.

Question 10

Which TWO of the following are examples of technical threat sources that should be considered during risk identification?

Accepted Answer

Hardware failure. Hardware failure (B) is a technical threat source because it involves the physical degradation or malfunction of IT infrastructure components such as hard drives, power supplies, or network interfaces. During risk identification, hardware failures are considered technical threats as they can directly cause data loss, service disruption, or system unavailability, requiring specific controls like redundancy and monitoring.

Answer

Earthquake

Answer

Unauthorized access by employee

Answer

Social engineering

Question 11

A security administrator is setting up a public key infrastructure (PKI) for internal use. Which two of the following components are essential for establishing a chain of trust from the root CA to end-entity certificates?

Accepted Answer

An intermediate (subordinate) CA certificate signed by the root CA. The root CA must be self-signed (trust anchor), and intermediate CAs (subordinate) are used to issue end-entity certificates. CRLs and OCSP are revocation mechanisms, not trust chain components. CSR is for requesting certificates.

Answer

A certificate signing request (CSR)

Answer

An online certificate status protocol (OCSP) responder

Answer

A certificate revocation list (CRL)

Question 12

A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?

Accepted Answer

AES. AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.

Answer

RSA

Answer

Diffie-Hellman

Answer

SHA-256

Question 13

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Accepted Answer

To detect errors through independent verification.. Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.

Answer

To reduce the workload on individual employees.

Answer

To simplify training requirements.

Answer

To comply with regulatory requirements.

Question 14

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

Accepted Answer

Implement compensating controls such as network segmentation and strict access control. Since the legacy medical devices cannot be patched due to vendor obsolescence, the most appropriate risk treatment strategy is to implement compensating controls. Network segmentation (e.g., VLANs or firewalls) isolates the devices from the main hospital network, while strict access control (e.g., 802.1X or MAC-based filtering) limits exposure to threats. This reduces the likelihood of exploitation without relying on patching the outdated operating systems.

Answer

Remediate by applying vendor patches

Answer

Retire and replace all devices immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 15

An organization needs to recover data from a backup after a ransomware attack. The backup was taken 12 hours ago, and the RPO is 4 hours. What is the impact?

Accepted Answer

The RPO is violated because more than 4 hours of data may be lost. RPO (Recovery Point Objective) defines the maximum acceptable data loss. If the backup is 12 hours old and RPO is 4 hours, the organization has lost 8 hours of data, exceeding the objective.

Answer

The RPO is met because data can be recovered

Answer

The RTO is exceeded

Answer

The 3-2-1 rule is violated