SSCP Practice Test 25 — 15 Questions

Question 1

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Accepted Answer

Ability to detect previously unknown threats based on anomalous behavior. Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.

Answer

Requires less data processing than signature-based detection

Answer

Easier to configure and maintain

Answer

Lower false positive rates compared to signature-based detection

Question 2

Which of the following is a cryptographic hash function that is considered cryptographically broken due to collision attacks and should not be used for security purposes?

Accepted Answer

SHA-1. SHA-1 is considered cryptographically broken due to collision attacks and should not be used for security purposes. SHA-256, SHA-3, and SHA-512 are still considered secure.

Answer

SHA-256

Answer

SHA-3

Answer

SHA-512

Question 3

An organization is designing a secure email system using S/MIME. Which of the following are essential components of the PKI that must be in place? (Select THREE)

Accepted Answer

X.509 digital certificates for each user. Option B is correct because S/MIME binds each user's public key to their identity through an X.509 digital certificate, which is required for encrypting messages and verifying digital signatures. Option C is correct because the PKI must provide a way to check certificate revocation status, typically via CRL or OCSP, so recipients can reject messages signed with compromised or expired certificates. Option E is correct because a certificate authority (CA) is needed to issue and digitally sign the X.509 certificates that S/MIME relies on for trust. Option A is not correct because a symmetric key distribution center (KDC) is associated with Kerberos-style symmetric key management, not with S/MIME's certificate-based public key infrastructure. Option D is not correct because a timestamp authority (TSA) supports trusted time-stamping for non-repudiation and is not an essential PKI component for basic S/MIME encryption and signing.

Answer

A symmetric key distribution center (KDC)

Answer

A timestamp authority (TSA)

Question 4

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Accepted Answer

Reintroduction of unpatched vulnerabilities. Old VM snapshots preserve the exact state of the VM at the time of capture, including the OS and application binaries. If a VM is reverted to a months-old snapshot, any patches applied since then are lost, reintroducing known vulnerabilities that attackers can exploit. This is the most likely and direct risk of retaining stale snapshots on the hypervisor.

Answer

VM escape via snapshot file corruption

Answer

Unauthorized access to snapshot data

Answer

Hypervisor memory exhaustion

Question 5

An organization wants to prevent unauthorized applications from running on Windows workstations. Which Windows feature should be used to enforce application whitelisting?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is Microsoft's application control feature that enforces application whitelisting by allowing only explicitly trusted code to run on Windows workstations. It uses code integrity policies (based on publisher, hash, or path) to block unauthorized executables, scripts, and drivers. WDAC is the modern successor to AppLocker and is built into Windows 10/11 and Windows Server.

Answer

User Account Control (UAC)

Answer

Windows Firewall with Advanced Security

Answer

Windows Defender Antivirus

Question 6

An organization is implementing an access control system where access decisions are based on the sensitivity of the resource and the clearance of the user. Which model is being used?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access decisions based on comparing the sensitivity label (e.g., classification level) of the resource with the clearance level of the user. This model is non-discretionary, meaning users cannot override or delegate permissions; the system centrally controls all access according to a security policy, such as Bell-LaPadula or Biba.

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 7

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change (A) is essential because it defines exactly what will be modified, including the systems, services, and scope involved, so that approvers and implementers understand the request. An impact assessment (B) is required to identify the risks, affected users, dependencies, and potential downtime, which allows the change advisory board to evaluate and prioritize the change. A rollback plan (C) is critical because it provides a tested, documented procedure to revert the change if it fails or causes an outage, minimizing business disruption. Employee performance review (D) is unrelated to change management, as it evaluates individual job performance rather than a technical or process change. Budget approval (E) may be needed for some changes, but it is not an essential element of every change request, since many changes involve no direct cost.

Answer

Employee performance review

Answer

Budget approval

Question 8

A security administrator is implementing physical security for a data center. Which THREE of the following controls should be included to provide layered security?

Accepted Answer

Mantrap at the main entrance. A mantrap at the main entrance (A) is correct because it creates a physical buffer zone that allows only one person through at a time, preventing tailgating and piggybacking into the facility. CCTV monitoring of all entry points (C) is correct because it provides continuous surveillance and recording of access points, enabling detection, deterrence, and forensic review of security incidents. Biometric readers on server room doors (E) are correct because they enforce strong authentication based on unique physiological traits for the most sensitive area, adding a distinct layer beyond perimeter controls. Screen locks on workstations (B) and a clean desk policy (D) are administrative and logical controls for protecting information, not physical controls for securing a data center's entry points and rooms.

Answer

Screen locks on all workstations

Answer

Clean desk policy for employees

Question 9

A security engineer is designing a system that requires non-repudiation of data origin. Which cryptographic technique should be used?

Accepted Answer

Digital signature using RSA or ECDSA. Digital signatures using RSA or ECDSA provide non-repudiation of data origin because they bind the signer's identity to the data through a private key that only the signer possesses. The recipient can verify the signature with the corresponding public key, and the signer cannot later deny having signed the data, as the private key is uniquely under their control. This meets the legal and technical requirement for non-repudiation, unlike symmetric or hash-only methods.

Answer

Keyed hash (HMAC)

Answer

Hash function only

Answer

Symmetric encryption with a shared key

Question 10

A security administrator is implementing a policy that requires all employees to use a password manager and enable multi-factor authentication. This policy is BEST described as a:

Accepted Answer

Password policy. The policy requires all employees to use a password manager and enable multi-factor authentication, which directly governs the creation, storage, and authentication strength of user credentials. This is the core function of a password policy, as defined in security frameworks like NIST SP 800-53 (IA-5) and ISO 27001 (A.9.2.1). It specifically addresses password complexity, rotation, and MFA enforcement, not data classification or access methods.

Answer

Data handling policy

Answer

Social media policy

Answer

Remote access policy

Question 11

A hospital's IT department manages a network with hundreds of medical devices, including patient monitors and infusion pumps, all connected to a separate VLAN. The security team has identified that several devices are running outdated firmware with known vulnerabilities. The vendor has not released patches for these legacy devices. The hospital cannot replace them immediately due to budget constraints. The network team proposes moving the devices to a more restrictive firewall zone and implementing intrusion detection. Which of the following additional controls should be implemented to BEST reduce the risk of a breach exploiting these devices?

Accepted Answer

Implement strict network segmentation and access control lists (ACLs) to allow only necessary traffic. Strict network segmentation with ACLs limits lateral movement and restricts medical devices to only the traffic they require (e.g., specific management or telemetry flows). Since the devices cannot be patched or replaced, reducing their attack surface via network controls is the most effective compensating control. This directly addresses the risk of a breach exploiting outdated firmware.

Answer

Conduct daily vulnerability scans on the device VLAN

Answer

Deploy host-based intrusion prevention on each device

Answer

Use a web application firewall (WAF) in front of the devices

Question 12

Refer to the exhibit. A security analyst notices that multiple internal hosts are using the same inside global IP address but different port numbers. Which technology is being used?

Accepted Answer

PAT (Port Address Translation). The scenario describes multiple internal hosts sharing a single inside global IP address but using different port numbers. This is the defining behavior of Port Address Translation (PAT), also known as NAT overload. PAT maps multiple private IP addresses to one public IP by differentiating sessions based on the transport-layer port number (TCP/UDP), allowing many hosts to share a single public address.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Port forwarding

Question 13

An organization is implementing Windows Defender Application Control (WDAC) to prevent unauthorized applications from running on company workstations. Which of the following best describes the primary security benefit of this approach?

Accepted Answer

It prevents execution of any application not explicitly allowed. WDAC is an application control mechanism that enforces an allowlist of approved code, blocking execution of any binary, script, or package not explicitly permitted by policy. This default-deny posture is its primary security benefit, preventing unauthorized or malicious executables from running even if they land on the endpoint.

Answer

It encrypts application binaries at rest

Answer

It automatically updates applications from a trusted source

Answer

It ensures that all applications are digitally signed

Question 14

An administrator notices that a terminated employee's account is still active. Which access control process was likely skipped?

Accepted Answer

Provisioning. Provisioning is the access control process that includes creating, modifying, and disabling user accounts and their associated privileges. When a terminated employee's account remains active, the de-provisioning step—specifically account revocation—was likely skipped, leaving the account enabled and accessible.

Answer

Authorization

Answer

Authentication

Answer

Accounting

Question 15

During a penetration test, a security analyst captures a packet containing a gratuitous ARP reply that associates the attacker's MAC address with the default gateway's IP address. This is a classic indicator of which attack?

Accepted Answer

ARP spoofing. A gratuitous ARP reply is an ARP packet sent without a prior request, typically used to announce a change in MAC-to-IP mapping. In this case, the attacker sends a gratuitous ARP reply claiming that the default gateway's IP address now maps to the attacker's MAC address. This poisons the ARP cache of other hosts on the network, causing them to send traffic destined for the gateway to the attacker instead. This is the defining characteristic of ARP spoofing (also called ARP poisoning).

Answer

DHCP spoofing

Answer

MAC cloning

Answer

DNS poisoning