SSCP Practice Test 23 — 15 Questions

Question 1

In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?

Accepted Answer

To request service tickets from the Ticket Granting Service (TGS). The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.

Answer

To store the user's password hash securely

Answer

To provide a session key for encrypting communications

Answer

To authenticate the user to the Key Distribution Center (KDC)

Question 2

An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?

Accepted Answer

Smart card. Something you have includes physical tokens like smart cards and hardware tokens. Biometrics are something you are, and passwords are something you know.

Answer

Answer

Retina scan

Answer

Fingerprint

Question 3

Match each security control to its type (administrative, technical, physical).

Accepted Answer

Firewall: Technical. Firewall, security policy, and biometric lock are correctly matched to technical, administrative, and physical controls respectively. Common confusions include misclassifying firewalls as physical controls or security policies as technical controls.

Answer

Firewall: Physical

Answer

Security Policy: Technical

Question 4

A security administrator is implementing the 3-2-1 backup rule. Which THREE actions are required to comply with this rule? (Select THREE.)

Accepted Answer

Store one copy offsite. The 3-2-1 backup rule requires three things: at least three copies of the data (option B), stored on two different media types (option C), with one copy kept offsite (option A). Option B is correct because the '3' means the original data plus two backup copies, totaling three copies. Option C is correct because the '2' means two distinct media or storage types, such as disk and tape, to avoid a single failure mode. Option A is correct because the '1' means at least one copy must be stored offsite for disaster recovery. Option D is not required by the rule, since backup frequency is a separate scheduling decision. Option E is also not part of the 3-2-1 rule, as encryption is a security control rather than a copy-count or media requirement.

Answer

Perform daily full backups

Answer

Use encryption for all backup copies

Question 5

Refer to the exhibit. An AWS S3 bucket policy is defined as shown. Which statement about this policy is TRUE?

Accepted Answer

Any user can read objects in the company-public bucket. The S3 bucket policy shown in the exhibit includes an Allow statement granting s3:GetObject to Principal '*' on the company-public bucket, which means any user (authenticated or anonymous) can read objects in that bucket. The Deny statement applies only to the company-private bucket, so it does not affect the public bucket. Therefore, the true statement is that any user can read objects in the company-public bucket.

Answer

The company-public bucket objects are completely private

Answer

The Deny statement prevents all access to both buckets

Answer

The policy applies to all buckets in the account

Question 6

Which THREE are common types of network-based attacks? (Choose three.)

Accepted Answer

ARP spoofing. ARP spoofing, SYN flood, and DNS amplification are all common network-based attacks. ARP spoofing operates at Layer 2 by sending falsified ARP messages to associate the attacker's MAC with a legitimate IP, enabling traffic interception. SYN flood exploits the TCP three-way handshake by sending numerous SYN packets without completing the handshake, exhausting server resources. DNS amplification is a volumetric attack that uses open DNS servers to amplify traffic by sending small queries that generate large responses. Buffer overflow and SQL injection are application-layer attacks, not network-based.

Answer

Buffer overflow

Answer

SQL injection

Question 7

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

Accepted Answer

Implement compensating controls such as network segmentation and strict access control. Since the legacy medical devices cannot be patched due to vendor obsolescence, the most appropriate risk treatment strategy is to implement compensating controls. Network segmentation (e.g., VLANs or firewalls) isolates the devices from the main hospital network, while strict access control (e.g., 802.1X or MAC-based filtering) limits exposure to threats. This reduces the likelihood of exploitation without relying on patching the outdated operating systems.

Answer

Remediate by applying vendor patches

Answer

Retire and replace all devices immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 8

An organization's incident response plan is tested annually. After a real incident, the team finds that the plan did not address cloud-based assets. What is the BEST action?

Accepted Answer

Update the incident response plan to include cloud scenarios. The BEST action is to update the existing incident response plan to include cloud scenarios, because the IR plan is a living document that must reflect the organization's actual environment. Since the gap was identified after a real incident, incorporating cloud assets into the same plan ensures a unified, tested response rather than fragmented procedures.

Answer

Migrate all cloud assets back on-premises

Answer

Retrain the IR team on cloud incident response

Answer

Create a separate cloud incident response plan

Question 9

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

Accepted Answer

Crossover error rate (CER). The crossover error rate (CER), also called the equal error rate (EER), is the point on the biometric operating curve where the false rejection rate equals the false acceptance rate. It is the standard metric for comparing the accuracy of different biometric systems — a lower CER indicates a more accurate system. The other options name individual rates or a different concept, not the crossover point.

Answer

False acceptance rate (FAR)

Answer

Failure to enroll rate

Answer

False rejection rate (FRR)

Question 10

During a user offboarding process, the security team must ensure that the former employee's access is revoked immediately. However, the user's manager requests that the account remain active for a week to review files. What is the BEST practice?

Accepted Answer

Disable the account immediately and transfer ownership of files to the manager. Best practice for offboarding is to disable the account immediately upon termination to eliminate the risk of unauthorized access, while preserving the account for audit and file-ownership purposes. File ownership and access to needed data should be transferred to the manager or another designated employee, satisfying the business need without keeping credentials live. This balances security with operational continuity.

Answer

Change the account to a service account and keep it active

Answer

Keep the account active but change the password and share it with the manager

Answer

Leave the account as-is and monitor activity for the week

Question 11

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

Accepted Answer

Encrypt all sensitive data stored on the device using a key derived from the user's passcode.. Encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.

Answer

Require a strong screen lock passcode.

Answer

Disable cloud backups for the app.

Answer

Use app sandboxing to isolate app data from other apps.

Question 12

Which UDP port is used by the Domain Name System (DNS) for name resolution queries?

Accepted Answer

UDP 53. DNS uses UDP port 53 for standard name resolution queries because the request and response are small and UDP's low overhead is ideal for the query-response pattern. TCP port 53 is used only for zone transfers (AXFR/IXFR), DNSSEC responses exceeding 512 bytes, or when the TC (truncated) bit forces a TCP retry.

Answer

UDP 161

Answer

UDP 67

Answer

UDP 123

Question 13

Which THREE of the following are key steps in performing a business impact analysis (BIA)?

Accepted Answer

Assessing the financial and operational impact of disruptions. A BIA is fundamentally about identifying what the business needs to keep running and what happens if it stops, so option D (identifying critical business processes) is a core step because you must first determine which processes, systems, and functions are essential to delivering products and services. Option C (assessing the financial and operational impact of disruptions) is also central, since the BIA quantifies the consequences of outages in terms of revenue loss, regulatory penalties, customer impact, and operational degradation. Option E (determining maximum tolerable downtime, MTD) belongs because the BIA establishes how long each critical process can be unavailable before the impact becomes unacceptable, which later drives RTO/RPO decisions. Option A (assigning likelihood ratings to threats) is part of a risk assessment rather than a BIA, which focuses on impact and criticality rather than threat probability. Option B (selecting backup and recovery solutions) is a subsequent recovery-strategy and solution-design activity that follows the BIA, not a step within it.

Answer

Assigning likelihood ratings to threats

Answer

Selecting backup and recovery solutions

Question 14

A security analyst is reviewing a digital signature implementation. The signer uses their private key to encrypt the hash of a message. What does the recipient use to verify the signature?

Accepted Answer

The signer's public key. Digital signatures use asymmetric cryptography where the signer encrypts the message hash with their private key. The recipient decrypts that encrypted hash using the signer's public key, then compares it to a locally computed hash of the received message. If they match, the signature is verified, proving both authenticity and integrity.

Answer

The recipient's private key

Answer

The signer's private key

Answer

The recipient's public key

Question 15

A company's incident response plan includes a requirement to notify law enforcement within 24 hours of certain security incidents. Which regulation most likely mandates this requirement?

Accepted Answer

PCI DSS. PCI DSS Requirement 12.10.1 mandates that the incident response plan includes specific procedures to notify law enforcement within 24 hours of detecting a breach involving cardholder data. This is because PCI DSS is a contractual security standard for entities that handle payment card information, and timely law enforcement notification is critical for forensic investigation and legal compliance in payment card fraud cases.

Answer

SOX

Answer

GDPR

Answer

HIPAA