SSCP Practice Test 25 — 15 Questions

Question 1

You are a risk analyst at a healthcare organization. The organization recently deployed a new electronic health records (EHR) system. During the first month of operation, the IT helpdesk received multiple reports from doctors that the system becomes unresponsive for 10-15 seconds several times a day. The EHR vendor attributes this to insufficient database connection pooling, but the organization's system administrator notes that the database server's CPU and memory utilization never exceed 30%. The organization has a risk management policy that requires any system with availability <99.5% to be treated as a high risk. Based on initial data, the system has been unavailable for about 0.1% of the time (excluding planned maintenance). However, doctors report that the brief unresponsiveness is causing frustration and potential misdiagnosis due to interrupted workflows. You need to recommend a risk treatment approach. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a deeper analysis to quantify the impact of these brief outages on clinical workflows and patient safety, then reassess risk. The risk management policy defines high risk based on availability <99.5%, and the system currently shows 99.9% availability (0.1% unavailability). However, the brief 10-15 second unresponsiveness may still pose a clinical safety risk that is not captured by a simple uptime metric. A deeper analysis is required to quantify the actual impact on clinical workflows and patient safety before deciding on risk treatment, as the policy may need to consider functional availability rather than just binary uptime.

Answer

Accept the current risk because the system meets the 99.5% availability threshold

Answer

Reduce the risk by implementing a load balancer and additional application servers

Answer

Document the system as high risk and require immediate remediation, such as upgrading the database server hardware

Question 2

Given the exhibit, what is the most likely conclusion?

Accepted Answer

The brute-force attack was successful and the admin account may be compromised. The exhibit shows a brute-force attack with multiple failed login attempts followed by a successful login from the same source IP. This pattern indicates that the attacker likely guessed or cracked the password, making the admin account compromised. Option D is correct because the sequence of events directly correlates with a successful brute-force attack.

Answer

The SIEM alert is a false positive and can be ignored

Answer

The authentication server logs are misconfigured

Answer

The successful login is unrelated and coincidental

Question 3

Which THREE of the following are key elements of a security incident response plan?

Accepted Answer

Preparation and training. Preparation and training (Option B) is a key element because an incident response plan must include establishing and rehearsing procedures, roles, and tools before an incident occurs. Without trained personnel and tested playbooks, the response will be chaotic and ineffective, regardless of other plan components.

Answer

Vendor management process

Answer

Restoring all systems from backup

Question 4

An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?

Accepted Answer

Kerberos. Kerberos is the correct choice because it is a ticket-based authentication protocol that provides single sign-on (SSO) capabilities. It uses a trusted third-party Key Distribution Center (KDC) to issue time-limited tickets, allowing users to authenticate once and access multiple services without re-entering credentials.

Answer

LDAP

Answer

SAML

Answer

RADIUS

Question 5

A small business wants to identify vulnerabilities in its network. Which type of scan should they perform first to get an overview?

Accepted Answer

Ping sweep.. A ping sweep (ICMP Echo Request) is the correct first step because it quickly identifies which hosts are alive on the network, providing a baseline of active IP addresses. This overview allows the business to scope the subsequent vulnerability scan to only live targets, reducing noise and scan time. Without a ping sweep, a full port or vulnerability scan would waste resources scanning dead or unresponsive hosts.

Answer

Vulnerability scan.

Answer

Stealth scan.

Answer

Full port scan.

Question 6

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

Accepted Answer

Least privilege. Least privilege ensures that a user or process is granted only the minimum permissions necessary to perform their job function. In this scenario, the help desk technician needs the ability to reset passwords but must be restricted from modifying other user attributes, such as group membership or account expiration. By applying least privilege, the technician's account is assigned a role or permission set that specifically allows password reset operations (e.g., via Active Directory delegated permissions or a custom RBAC role) while explicitly denying write access to other user object properties.

Answer

Need-to-know

Answer

Separation of duties

Answer

Mandatory access control

Question 7

A security analyst receives an alert indicating a large number of failed login attempts from a single IP. The analyst blocks the IP. What should be done next?

Accepted Answer

Conduct a thorough investigation. Blocking an IP address is an immediate containment action, but it does not confirm the root cause or scope of the incident. A thorough investigation is required to determine whether the failed logins were part of a brute-force attack, credential stuffing, or a misconfigured service, and to check for indicators of compromise (IoCs) such as successful logins from the same IP or lateral movement. Without investigation, the analyst risks missing a broader breach or violating incident response procedures like those outlined in NIST SP 800-61.

Answer

Report to management

Answer

Update the firewall rules

Answer

Monitor for recurrence

Question 8

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 9

A university's IT department manages a network used by students and faculty. The security team notices an unusual increase in outbound traffic from the student dormitory network during late hours. Upon investigation, they discover that several student laptops are infected with malware that is attempting to connect to external command-and-control (C2) servers. The team needs to contain the incident quickly while minimizing impact on legitimate users. Which of the following is the BEST immediate containment measure?

Accepted Answer

Disconnect the infected laptops from the network and take them offline for remediation. Isolating the infected devices from the network stops the C2 communication and prevents further spread, while allowing other users to continue working. Option A may block all students; C is disruptive to everyone; D does not stop communication.

Answer

Shut down the entire dormitory network

Answer

Block all outbound traffic from the dormitory subnet

Answer

Update the antivirus definitions on the infected laptops

Question 10

Which type of disaster recovery test involves running the DR systems alongside production systems to verify functionality without impacting operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Answer

Tabletop exercise

Answer

Full interruption test

Answer

Simulation test

Question 11

A healthcare organization must comply with HIPAA and requires that access to electronic protected health information (ePHI) be logged and audited. They consider using an identity management system that supports single sign-on (SSO). What is the PRIMARY security concern with SSO in this environment?

Accepted Answer

Single credential compromise leads to broad access. In a healthcare environment subject to HIPAA, the primary security concern with SSO is that a single compromised credential (e.g., a password or smart card PIN) grants an attacker immediate access to all applications and ePHI systems that the user is authorized to use. This creates a single point of failure, dramatically increasing the blast radius of a credential theft incident. Unlike separate per-application credentials, SSO eliminates the need for repeated authentication, so an attacker who obtains the SSO token or password can move laterally across the entire application portfolio without additional authentication barriers.

Answer

Increased complexity of password policies

Answer

Lack of detailed audit logs for each application

Answer

User inconvenience due to multiple logins

Question 12

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

Accepted Answer

MFA fatigue attack. MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Answer

Session hijacking

Answer

Man-in-the-middle (MITM) attack

Answer

Token theft from the endpoint

Question 13

After an incident, the team identifies that the incident was caused by a missing security patch. Which of the following is the MOST effective way to prevent recurrence?

Accepted Answer

Implement a patch management policy. A missing security patch indicates a failure in the vulnerability management lifecycle. Implementing a patch management policy ensures that patches are systematically identified, tested, and deployed, directly addressing the root cause. This is the most effective preventive measure because it establishes a recurring process to close known vulnerabilities before they can be exploited.

Answer

Conduct phishing simulations

Answer

Increase network monitoring

Answer

Update the incident response plan

Question 14

A company experiences a security breach where an attacker gained access to the network through a compromised vendor account. Which of the following controls would have BEST prevented this attack?

Accepted Answer

Enable multi-factor authentication for vendor accounts.. Multi-factor authentication (MFA) for vendor accounts is the best preventive control because it adds an additional layer of security beyond just a password. Even if the attacker compromises the vendor's credentials, MFA requires a second factor (e.g., a one-time code from a token or biometric) to authenticate, effectively blocking unauthorized access. This directly addresses the attack vector of credential theft, which was the root cause of the breach.

Answer

Install a network-based intrusion detection system.

Answer

Require vendors to sign an NDA.

Answer

Create a separate VLAN for vendor access.

Question 15

Which THREE of the following are characteristics of a stateful firewall?

Accepted Answer

Is generally slower than a stateless firewall. Stateful firewalls maintain a state table that tracks the state of active connections, allowing them to make decisions based on the context of traffic patterns, such as the TCP three-way handshake. This additional processing overhead generally makes them slower than stateless firewalls, which only inspect packet headers individually without connection tracking.

Answer

Operates only at the network layer (Layer 3)

Answer

Performs deep packet inspection (DPI)