SSCP Practice Test 24 — 15 Questions

Question 1

During a code review, you discover that an application stores passwords in plaintext. What is the most secure remediation?

Accepted Answer

Use bcrypt with a unique salt per password. Bcrypt with a unique salt is designed for password storage; it is slow and resistant to brute force. MD5 is fast and weak. AES encryption is reversible if the key is compromised. Database access control does not protect if the database is breached.

Answer

Hash passwords with MD5

Answer

Use AES encryption of passwords

Answer

Store passwords in a database with restricted access

Question 2

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors with automated alerting. Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.

Answer

Implementing stricter access control policies

Answer

Conducting more frequent tabletop exercises

Answer

Increasing the frequency of full system backups

Question 3

Which three of the following are best practices for securing a database? (Choose three.)

Accepted Answer

Encrypt sensitive data at rest. Encrypting sensitive data at rest protects confidentiality. Row-level security restricts access to specific rows. Least privilege limits user permissions. Default passwords are insecure. Public access exposes the database.

Answer

Use default passwords for database accounts

Answer

Enable public access to the database

Question 4

Which TWO of the following are effective controls to prevent buffer overflow attacks? (Choose two.)

Accepted Answer

Address Space Layout Randomization (ASLR). Address Space Layout Randomization (ASLR) is a memory protection technique that randomizes the base addresses of executable modules, heap, and stack regions. This makes it significantly harder for an attacker to predict the memory addresses needed to inject and execute shellcode, thereby mitigating many buffer overflow exploits that rely on fixed address references.

Answer

Input validation to reject long inputs

Answer

Code obfuscation

Answer

Stack canaries

Question 5

Refer to the exhibit. An administrator implements this firewall rule. What is the intended effect?

Accepted Answer

It prevents this computer from initiating SMB connections to other computers.. The firewall rule shown is an outbound rule that blocks TCP port 445, which is used by SMB (Server Message Block). By blocking outbound traffic on this port, the computer is prevented from initiating SMB connections to other computers, while still allowing inbound SMB connections. This is a common security measure to prevent a compromised machine from spreading malware or accessing file shares on other systems.

Answer

It blocks all inbound and outbound traffic on port 445.

Answer

It prevents inbound SMB connections from other domain computers.

Answer

It applies to all network profiles (Domain, Private, Public).

Question 6

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

Accepted Answer

Business unit leaders. Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Answer

External legal counsel

Answer

Internal audit

Answer

Only IT staff

Question 7

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select three.)

Accepted Answer

Risk retention. Risk retention (A) is a valid risk treatment option under ISO 31000 because it involves accepting the current level of risk, often when the cost of mitigation exceeds the potential impact or when the risk is within the organization's risk appetite. This is a deliberate decision to bear the risk, typically documented in a risk register and monitored for changes.

Answer

Risk elimination

Answer

Risk duplication

Question 8

During forensic analysis, which THREE pieces of evidence should be preserved in original form?

Accepted Answer

Network traffic capture. Network traffic captures (e.g., PCAP files) are raw, bit-for-bit recordings of network packets. They preserve the original timing, headers, and payloads without any transformation, which is critical for accurate forensic reconstruction and chain of custody. Any conversion or export (like CSV) would strip metadata and alter the original evidence.

Answer

Screenshots of malware dialogs

Answer

System event logs exported to CSV

Question 9

An organization implements a hybrid encryption scheme to secure sensitive emails. The email body is encrypted with AES-256, and the AES key is encrypted with RSA-2048. What is the primary advantage of this approach?

Accepted Answer

Combines performance of symmetric with secure key distribution of asymmetric. Hybrid encryption combines the speed of symmetric encryption (AES-256) for bulk data with the secure key distribution of asymmetric encryption (RSA-2048). The symmetric key encrypts the email body efficiently, while the asymmetric key encrypts only the symmetric key, solving the key distribution problem without sacrificing performance.

Answer

Ensures forward secrecy

Answer

Simplifies key management by using a single key

Answer

Provides non-repudiation for the email

Question 10

A remote employee needs secure access to corporate resources over the internet. Which protocol is considered best practice for site-to-site VPN?

Accepted Answer

IPsec with IKEv2. IPsec with IKEv2 (Internet Key Exchange version 2) is the best practice for site-to-site VPNs because it provides strong authentication, encryption, and integrity checking for all traffic between two fixed endpoints. IKEv2 offers built-in mobility, faster rekeying, and resistance to Denial-of-Service attacks compared to IKEv1, making it the recommended choice for secure, persistent site-to-site connections over the internet.

Answer

PPTP (Point-to-Point Tunneling Protocol)

Answer

SSL VPN (Secure Sockets Layer VPN)

Answer

L2TP (Layer 2 Tunneling Protocol) without IPsec

Question 11

A security engineer is designing a DMZ to host public-facing services. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Use a screened subnet with two firewalls. A screened subnet with two firewalls creates a buffer zone, and allowing inbound traffic only on required ports minimizes exposure. Placing web servers on the internal network would expose them, sharing rules with the internal network increases risk, and full mesh connectivity between DMZ hosts facilitates lateral movement.

Answer

Use the same firewall rule set for DMZ and internal network

Answer

Place web servers on the internal network

Answer

Enable full mesh connectivity between DMZ hosts

Question 12

An organization wants to prevent unauthorized persons from entering a secure server room. Which control is the MOST effective?

Accepted Answer

Require biometric authentication (fingerprint or retina scan) to unlock the door. Biometric authentication (fingerprint or retina scan) is the most effective control because it verifies the unique physiological characteristics of an individual, making it extremely difficult to bypass, share, or forge. Unlike knowledge-based (keypad code) or possession-based (key card) factors, biometrics provide strong, non-repudiable proof of identity, which is critical for high-security areas like a server room.

Answer

Install a CCTV camera at the entrance

Answer

Post a security guard at the entrance during business hours

Answer

Use a keypad with a unique code for each employee

Question 13

Which TWO of the following are key components of an organization's security policy framework? (Choose two.)

Accepted Answer

Standard operating procedures. Standard operating procedures (SOPs) are a key component of an organization's security policy framework because they provide detailed, step-by-step instructions for implementing security controls and responding to incidents. SOPs operationalize high-level policies into actionable tasks, ensuring consistency and compliance across the organization. They are formal documents that define the 'how' of security operations, such as patch management or user account provisioning.

Answer

Intrusion detection system

Answer

Access control lists

Answer

Firewall rules

Question 14

After an incident, what is the primary purpose of a lessons learned meeting?

Accepted Answer

Improve future response. The primary purpose of a lessons learned meeting after an incident is to identify what worked well and what did not during the response, enabling the team to refine procedures, update playbooks, and improve future incident response effectiveness. This aligns with the continuous improvement cycle in incident management, as outlined in NIST SP 800-61 and ISO 27035, where the focus is on process enhancement rather than punitive measures.

Answer

Update security policies

Answer

Assign blame

Answer

Document findings for litigation

Question 15

Refer to the exhibit. The analyst sees this IDS alert. What is the most likely outcome if the target web application is vulnerable?

Accepted Answer

Authentication bypass or data extraction. The IDS alert indicates a SQL injection attempt (e.g., '1=1' or similar pattern). If the web application is vulnerable, the attacker can manipulate SQL queries to bypass authentication (e.g., logging in without valid credentials) or extract data from the database (e.g., dumping user tables). This is the most direct outcome of a successful SQL injection.

Answer

Buffer overflow and remote code execution

Answer

Cross-site scripting (XSS) attack

Answer

Privilege escalation on the database server