SSCP Practice Test 24 — 15 Questions

Question 1

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

Accepted Answer

Prioritize patching based on vulnerability criticality. When patch compliance is below target, the first step is to prioritize patching based on vulnerability criticality so that the most exploitable and highest-impact systems are remediated first. This maximizes risk reduction per unit of effort and directly addresses the gap between 85% and 95% by focusing resources where they matter most. Simply scanning more or excluding systems does not improve compliance meaningfully.

Answer

Increase the frequency of vulnerability scans

Answer

Disable automatic updates to prevent issues

Answer

Exclude non-critical systems from patching

Question 2

You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?

Accepted Answer

Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration. It implements compensating controls to reduce the risk of the unpatched remote code execution vulnerability while maintaining business continuity. By deploying an application-layer firewall (e.g., a WAF or host-based IPS), disabling unnecessary services, restricting outbound traffic to only the payment processor's IP via strict egress ACLs, enabling detailed logging for monitoring, and accelerating the migration to a supported system, you align with PCI DSS Requirement 6.2 (timely patching) and Requirement 11.5 (change detection) without causing an outage. This layered defense mitigates the active exploit risk until the legacy server can be decommissioned in six months.

Answer

Immediately decommission the server and migrate to the new payment system, accepting a temporary outage

Answer

Apply the vendor's hotfix from an unofficial source to patch the vulnerability

Answer

Accept the risk and purchase additional cyber insurance to cover potential losses

Question 3

Which of the following best describes the difference between HMAC and a simple hash function like SHA-256 when used for message authentication?

Accepted Answer

HMAC provides integrity and authentication; SHA-256 provides only integrity. HMAC incorporates a secret key into the hash process, providing authentication that a simple hash cannot.

Answer

HMAC is faster than SHA-256

Answer

SHA-256 produces a larger digest than HMAC

Answer

HMAC is used for encryption, not hashing

Question 4

Which THREE of the following are common use cases for public key infrastructure (PKI)? (Select exactly three.)

Accepted Answer

Digital signatures. Digital signatures are a core use case for PKI because they rely on asymmetric cryptography where a private key signs data and the corresponding public key, bound to an identity via a digital certificate issued by a Certificate Authority (CA), verifies the signature. This ensures authenticity, integrity, and non-repudiation of the signed message or document.

Answer

Password hashing

Answer

Symmetric key exchange

Question 5

Which TWO protocols are used to secure email communication at the message level?

Accepted Answer

PGP. PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) are the two primary protocols that secure email at the message level. They encrypt the entire email body and attachments, ensuring end-to-end confidentiality and integrity regardless of the transport path. PGP uses a web of trust model, while S/MIME relies on a hierarchical public key infrastructure (PKI) with X.509 certificates.

Answer

IPsec

Answer

SSL/TLS

Answer

SSH

Question 6

A vulnerability management team is scanning a network. Which THREE factors should be considered to minimize false positives?

Accepted Answer

Tuning the scanner based on the environment. Option C is correct because tuning the scanner to the specific environment—adjusting plugin sets, port ranges, timing templates, and severity thresholds—reduces noise from irrelevant checks and mismatched assumptions, which directly lowers false positives. Option D is correct because authenticated (credentialed) scans let the scanner read actual patch levels, registry keys, and installed software instead of inferring vulnerabilities from banners or version strings, eliminating many false positives caused by backported patches or obscured services. Option E is correct because manually verifying findings (for example, confirming a suspected open port with netstat or a service banner with a targeted probe) validates scanner output before it is reported, catching false positives that automated logic cannot resolve. Option A is not correct because scanning only during peak hours does not reduce false positives and can actually increase them through timeouts and dropped packets under load. Option B is not correct because default scan profiles are generic and often produce more false positives, since they are not tailored to the target environment's operating systems, applications, or network topology.

Answer

Scanning only during peak hours

Answer

Using default scan profiles

Question 7

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is a valid method for authenticating users in a web application because it is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables single sign-on (SSO) by allowing the SP to trust the IdP's assertion of the user's identity, making it a widely adopted federated authentication protocol.

Answer

IP address whitelisting

Answer

LDAP

Question 8

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 9

An application security team is reviewing code for vulnerabilities. They find that user input is directly concatenated into an SQL query without sanitization. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Injection. Concatenating unsanitized user input directly into an SQL query is the textbook definition of an Injection vulnerability (OWASP A03:2021). The untrusted input is interpreted as SQL code rather than data, allowing an attacker to alter query logic, bypass authentication, or exfiltrate the database. This is the classic SQL injection pattern.

Answer

Cross-Site Scripting (XSS)

Answer

Security Misconfiguration

Answer

Broken Access Control

Question 10

Which TWO of the following are effective measures to prevent buffer overflow attacks in software development?

Accepted Answer

Validate all input to ensure it meets length constraints. Option A is correct because validating input against strict length constraints ensures that data written into fixed-size buffers never exceeds their allocated capacity, which is the root cause of buffer overflows. Option E is correct because bounds-checking functions such as strncpy (or safer alternatives like snprintf and strlcpy) limit the number of bytes copied, preventing writes past the end of a buffer that unchecked functions like strcpy and strcat allow. Option B is not a preventive development measure in the same sense; stack canaries are a compiler/runtime mitigation that detects a corrupted return address after the fact rather than stopping the overflow from occurring. Option C is incorrect because code obfuscation only raises the effort of reverse engineering and does not address the memory-safety flaw itself. Option D is incorrect here because ASLR is an operating-system-level randomization mitigation that makes exploitation less reliable, but it does not prevent the buffer overflow vulnerability from existing in the code.

Answer

Implement stack canaries

Answer

Obfuscate the code to make exploitation harder

Answer

Enable Address Space Layout Randomization (ASLR)

Question 11

During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object Reference (IDOR) occurs when an application exposes an internal object identifier (like a user ID in a URL) and fails to verify that the requesting user is authorized to access that object. Changing /profile?id=123 to another ID to view another user's profile is the classic IDOR pattern. It falls under OWASP's Broken Access Control category (A01:2021).

Answer

Broken Authentication

Answer

Security Misconfiguration

Answer

Injection

Question 12

A security analyst reviews the TLS configuration of a web server and notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is enabled. The analyst recommends disabling RSA key exchange and enabling ECDHE. Which security property does ECDHE provide that RSA key exchange lacks?

Accepted Answer

ECDHE provides perfect forward secrecy.. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides Perfect Forward Secrecy (PFS), meaning that if the server's long-term private key is compromised, past session keys cannot be derived. RSA key exchange does not provide PFS because the session key is encrypted with the server's static RSA public key; if the private key is later exposed, all recorded sessions can be decrypted.

Answer

ECDHE is faster than RSA key exchange.

Answer

ECDHE is required by PCI DSS for all web transactions.

Answer

ECDHE uses smaller key sizes for equivalent security.

Question 13

During a post-incident review, the incident response team identifies several areas for improvement. According to NIST SP 800-61, which THREE activities are typically part of the post-incident activity phase?

Accepted Answer

Update the incident response plan based on findings. Option B is correct because NIST SP 800-61's post-incident activity phase explicitly includes using the lessons learned and review findings to update the incident response plan, policies, and procedures so future responses improve. Option D is correct because holding a lessons learned meeting (post-incident review) with all involved parties is a core recommended activity in this phase, used to identify what happened, what was done well, and what needs improvement. Option E is correct because NIST SP 800-61 calls for using incident data to develop and track metrics, such as mean time to detect (MTTD) and mean time to recover/repair (MTTR), to measure and improve the incident response capability over time. Option A is not part of the post-incident activity phase; patching is a remediation/eradication action performed during incident handling, not a blanket post-incident review activity. Option C is likewise incorrect because immediately replacing all affected hardware is a recovery/remediation decision made during the handling phase based on the specific incident, not a standard post-incident review activity.

Answer

Patch all systems in the organization as a precaution

Answer

Replace all affected hardware immediately

Question 14

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

Accepted Answer

Risk transfer. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or outsourcing. By outsourcing data center operations to a cloud provider, the organization transfers the risks associated with physical security and hardware maintenance to the provider, making this a classic example of risk transfer.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 15

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration