SSCP Practice Test 2 — 25 Questions

Question 1

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 2

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Accepted Answer

Check the server's running processes and established connections.. Option C is correct because the first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Answer

Disconnect the server from the network.

Answer

Reboot the server to clear any malware.

Answer

Block the outbound traffic at the firewall.

Question 3

Which TWO of the following are best practices for securing a wireless network?

Accepted Answer

Using WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Answer

Enabling MAC address filtering

Answer

Using WEP encryption

Answer

Leaving the default administrator password

Question 4

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Accepted Answer

To establish a minimum level of security for system configurations. The primary purpose of implementing a security baseline such as the CIS Benchmarks is to establish a minimum level of security for system configurations. These benchmarks provide prescriptive, consensus-based configuration guidelines (e.g., disabling unnecessary services, setting file permissions, enforcing password policies) that reduce the attack surface and ensure a consistent, hardened starting point across all systems in an organization.

Answer

To automate incident response procedures

Answer

To detect real-time threats

Answer

To comply with regulatory requirements for log retention

Question 5

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Option D is correct because exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 6

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

Accepted Answer

Correlate high outbound DNS query volume with requests to newly registered or suspicious domains. DNS tunneling encodes data in DNS queries and responses, often generating a high volume of outbound queries to domains that are newly registered or otherwise suspicious. Correlating these two indicators—unusual query volume and suspicious domain characteristics—directly targets the behavior of DNS tunneling, making it the most effective rule for detecting this exfiltration technique.

Answer

Correlate multiple failed logins from a single IP

Answer

Alert on any single failed login attempt

Answer

Alert when a user accesses a file share after hours

Question 7

An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the correct model because it allows data owners (the users who create or own the resource) to decide who can access their resources. In DAC, the owner sets permissions (e.g., read, write, execute) on objects like files or directories, typically using Access Control Lists (ACLs). This directly matches the requirement where data owners control access decisions.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 8

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Accepted Answer

To detect errors through independent verification.. Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.

Answer

To reduce the workload on individual employees.

Answer

To simplify training requirements.

Answer

To comply with regulatory requirements.

Question 9

Which TWO are components of the AAA framework? (Choose two.)

Accepted Answer

Authorization. Authorization (A) and Authentication (E) are two of the three core components of the AAA framework, as defined by Cisco and the IETF in RFC 2903 and RFC 2904. Authentication verifies the identity of a user or device (e.g., using RADIUS or TACACS+), while Authorization determines what resources or actions that authenticated entity is permitted to access. Together with Accounting, these three form the AAA triad used in network access control and security policy enforcement.

Answer

Auditing

Answer

Accounting

Answer

Administration

Question 10

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). SLE is asset value ($5,000,000) times exposure factor (40%) = $2,000,000. Then ALE = $2,000,000 × 0.5 = $1,000,000. This quantitative risk analysis formula is standard in financial risk assessments for payment systems.

Answer

$800,000

Answer

$2,000,000

Answer

$2,500,000

Question 11

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. Option A is correct because the number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Question 12

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

Accepted Answer

Implement compensating controls such as network segmentation and strict access control. Since the legacy medical devices cannot be patched due to vendor obsolescence, the most appropriate risk treatment strategy is to implement compensating controls. Network segmentation (e.g., VLANs or firewalls) isolates the devices from the main hospital network, while strict access control (e.g., 802.1X or MAC-based filtering) limits exposure to threats. This reduces the likelihood of exploitation without relying on patching the outdated operating systems.

Answer

Remediate by applying vendor patches

Answer

Retire and replace all devices immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 13

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

Accepted Answer

Lessons learned report. A lessons learned report is a post-incident document that captures what happened during a security incident, including affected assets, the attack vector, and financial impact. It is used to improve future incident response processes and is distinct from operational plans or risk assessments.

Answer

Incident response plan

Answer

Risk register

Answer

Business impact analysis (BIA)

Question 14

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.

Answer

Threat

Answer

Risk

Answer

Exploit

Question 15

Refer to the exhibit. A security analyst reviews these logs from a server. What immediate risk is most indicated by this log pattern?

Accepted Answer

Active brute-force attack against the SSH service. The log pattern shows repeated failed SSH authentication attempts from multiple IP addresses in rapid succession, followed by a successful login from one of those IPs. This is the classic signature of a brute-force attack where an attacker tries many passwords until one works, indicating an active compromise of the SSH service.

Answer

Insider threat from user root

Answer

Malware infection on the server

Answer

Misconfigured SSH settings allowing root login

Question 16

Which THREE of the following are common techniques for identifying risks?

Accepted Answer

Stakeholder interviews. Stakeholder interviews are a common technique for identifying risks because they leverage the knowledge and experience of individuals who have a direct interest in or are affected by the project or system. By engaging stakeholders, you can uncover risks that may not be apparent from documentation or technical analysis, as they provide insights into operational, regulatory, and business-specific threats. This aligns with the risk identification process in the SSCP domain, which emphasizes gathering input from diverse sources to build a comprehensive risk profile.

Answer

Penetration testing

Answer

Quantitative risk analysis

Question 17

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Accepted Answer

User behavior risk indicator. The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Answer

Technical vulnerability indicator

Answer

Error log indicator

Answer

Configuration drift indicator

Question 18

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 19

Which TWO components are essential for an effective disaster recovery plan (DRP)?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, which directly determines the required backup frequency and data replication strategy. Without an RPO, the DRP cannot specify how much data can be lost, making it impossible to design appropriate backup and recovery mechanisms. This metric is essential because it drives the technical implementation of data protection, such as snapshot intervals or synchronous replication.

Answer

Automated failover system

Answer

Business Impact Analysis (BIA)

Answer

Redundant array of independent disks (RAID)

Question 20

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Accepted Answer

Risk mitigation. Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer