SSCP Practice Test 2 — 25 Questions

Question 1

A critical vulnerability is discovered in an application currently in use. What should be done first?

Accepted Answer

Test the patch in a non-production environment. Testing the patch in a non-production environment ensures it does not break functionality before deployment. Immediate deployment risks downtime. Disabling the application or notifying users are reactive steps, not the first.

Answer

Notify users to stop using the application

Answer

Disable the application until patch is ready

Answer

Deploy the patch immediately to all systems

Question 2

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Accepted Answer

ClientHello, then ServerHello, then EncryptedExtensions, then Finished from server, then Finished from client. TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Answer

ClientHello, then ServerHello, then Finished from client, then EncryptedExtensions, then Finished from server

Answer

ClientHello, then EncryptedExtensions, then ServerHello, then Finished from server, then Finished from client

Answer

ServerHello, then ClientHello, then EncryptedExtensions, then Finished from server, then Finished from client

Question 3

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 4

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 5

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer

Question 6

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 7

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software

Question 8

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

Accepted Answer

Assess the exploitability and impact to determine remediation priority. The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Answer

Apply the patch immediately to reduce risk

Answer

Re-scan the server to confirm the vulnerability

Answer

Ignore the vulnerability because the patch is available

Question 9

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 10

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 11

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 12

A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.

Answer

SSH (Secure Shell)

Answer

SSL 3.0

Answer

IPsec in transport mode

Question 13

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 14

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 15

An organization is implementing a new remote access VPN for employees using IPsec. Which TWO of the following are best practices for securing the IPsec VPN?

Accepted Answer

Use AES encryption with a minimum key size of 128 bits. AES encryption with a minimum key size of 128 bits is a best practice for IPsec VPNs because it provides strong, symmetric encryption that is resistant to known cryptographic attacks. AES-128 is approved by NIST and widely considered secure for protecting sensitive data over untrusted networks like the internet.

Answer

Use pre-shared keys for authentication

Answer

Disable anti-replay protection to improve performance

Answer

Allow all IP protocols through the VPN tunnel

Question 16

A network administrator notices that wireless users are experiencing intermittent connectivity. The controller shows excessive deauthentication frames. What is the most likely cause?

Accepted Answer

Rogue access point performing a deauthentication attack. Excessive deauthentication frames are a hallmark of a deauthentication attack, where a rogue access point sends forged 802.11 management frames to disconnect clients. This causes intermittent connectivity as clients repeatedly lose association and attempt to reconnect. The controller logs these frames as a clear indicator of an active attack.

Answer

Channel interference

Answer

Power save mode

Answer

DHCP server exhaustion

Answer

Weak encryption

Question 17

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs

Question 18

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

Accepted Answer

Escalate the incident to the incident response manager and legal counsel. When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Answer

Notify the affected customers of the data breach

Answer

Create a forensic image of the compromised server

Answer

Begin containment by isolating affected systems

Question 19

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 20

Refer to the exhibit. An administrator applies this ACL to the external interface. What specific traffic is blocked?

Accepted Answer

All ping requests. The ACL is applied to the external interface and denies ICMP echo-request (type 8) packets while permitting ICMP echo-reply (type 0) packets. This blocks only ping requests (echo-requests) from entering the network, but allows ping replies (echo-replies) to return for outbound-initiated traffic. Therefore, option D is correct because the ACL specifically targets and blocks all ping requests.

Answer

Both ping requests and replies

Answer

Only ping replies

Answer

All ICMP traffic