SSCP Practice Test 4 — 25 Questions

Question 1

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Accepted Answer

Step 1: Install the Active Directory Certificate Services role. Step 2: Configure the CA type (e.g., Enterprise Root CA). Step 3: Set the storage locations for certificate database and log. Step 4: Install the CA services. Step 5: Test the CA by requesting a certificate.. Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Answer

Step 1: Install the AD CS role. Step 2: Configure the CA type. Step 3: Install the CA services. Step 4: Set the storage locations. Step 5: Test the CA.

Answer

Step 1: Configure the CA type. Step 2: Install the AD CS role. Step 3: Set storage locations. Step 4: Install the CA services. Step 5: Test.

Answer

Step 1: Install the AD CS role. Step 2: Set storage locations. Step 3: Configure the CA type. Step 4: Install the CA services. Step 5: Test.

Question 2

A financial firm has deployed network-based IDS/IPS sensors at key points to detect and prevent intrusions. During a recent security audit, it was discovered that an attacker exfiltrated sensitive data using DNS over HTTPS (DoH) queries. The IDS/IPS did not generate any alerts. The firm's network policy allows all outbound HTTPS traffic to any destination. To prevent such exfiltration in the future, what is the most effective corrective action?

Accepted Answer

Deploy TLS termination at the network perimeter. Deploying TLS termination at the network perimeter allows the organization to decrypt inbound and outbound HTTPS traffic, inspect the plaintext content, and re-encrypt it before forwarding. This enables the IDS/IPS to detect malicious payloads, such as DNS over HTTPS (DoH) queries, that would otherwise be hidden inside encrypted tunnels. Since the firm's policy allows all outbound HTTPS, TLS termination is the most effective way to regain visibility into that traffic without blocking it outright.

Answer

Enable deep packet inspection on all encrypted traffic

Answer

Implement a DNS sinkhole and block non-corporate DNS servers

Answer

Configure the IDS/IPS to inspect DNS traffic on standard port 53 only

Question 3

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 4

A company wants to secure wireless communication for guests. Which protocol provides the strongest encryption for a wireless network?

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) provides the strongest encryption for wireless networks, using 128-bit AES in CCMP mode for encryption and replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks. This makes it the most secure option among the choices, especially for guest networks where authentication security is critical.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with TKIP

Answer

WPA2-PSK with AES

Question 5

Which metric is used to measure the potential loss from a single occurrence of a risk?

Accepted Answer

Single Loss Expectancy (SLE). The Single Loss Expectancy (SLE) is the metric used to measure the potential loss from a single occurrence of a risk. It is calculated as Asset Value (AV) multiplied by the Exposure Factor (EF), providing a dollar value for one incident. This directly answers the question of loss per single event.

Answer

Exposure Factor (EF)

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 6

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Accepted Answer

IEEE 802.1X port-based authentication. IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Answer

Port security with sticky MAC

Answer

MAC address filtering

Answer

VLAN segmentation

Question 7

Which TWO of the following are examples of administrative controls? (Choose two.)

Accepted Answer

Access control policies. Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Answer

Firewall rules

Answer

Security guards

Answer

Encryption of data at rest

Question 8

Which of the following is a technical threat source that could lead to a security breach?

Accepted Answer

Software bug. A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.

Answer

Disgruntled employee

Answer

Configuration weakness

Answer

Flood

Question 9

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the asset criticality is low, the high CVSS score and active exploitation increase the risk. The patch should be prioritized and deployed through the change management process.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 10

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Accepted Answer

False positive. A false positive occurs when a vulnerability scanner reports a finding that, upon investigation, is determined not to be a real security risk. In this case, the vulnerability is not exploitable due to compensating controls, meaning the scanner's alert was incorrect in the context of the actual environment. Therefore, the finding should be classified as a false positive, not a true vulnerability.

Answer

True positive

Answer

Risk acceptance

Answer

False negative

Question 11

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

Accepted Answer

Modify correlation rules to require multiple events before alerting. Modifying correlation rules to require multiple events before alerting reduces false positives by ensuring that a single benign event does not trigger an alert. This technique, often called 'thresholding' or 'event correlation,' filters out noise while still detecting multi-step attack patterns, such as a brute-force login attempt that requires multiple failed logins within a time window.

Answer

Increase the severity of all alerts to high

Answer

Disable all anomaly-based detection rules

Answer

Create a whitelist for known benign IP addresses

Question 12

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Accepted Answer

Ensure all data transmissions use TLS 1.2 or higher.. TLS 1.2 or higher is the standard protocol for encrypting data in transit over public networks, ensuring confidentiality and integrity between client and server. It is the most critical control because it directly protects data as it moves across the internet to the cloud, which is the primary risk in a migration scenario.

Answer

Enable server-side encryption for cloud storage.

Answer

Implement data classification labels.

Answer

Use IPsec VPNs for all cloud connections.

Question 13

A small business needs basic protection against malware. Which solution is MOST cost-effective and provides real-time protection?

Accepted Answer

Deploy an endpoint protection platform (EPP). An endpoint protection platform (EPP) provides real-time antivirus, anti-malware, and often additional features like firewall and web protection, offering continuous protection against malware. Option A is wrong because scheduling weekly scans leaves gaps where new threats can infect the system before the next scan. Option C is wrong because a host-based firewall controls network traffic but does not detect or remove malware. Option D is wrong because email encryption only protects the confidentiality of email content and does not prevent malware from being delivered via other vectors such as web downloads or USB drives.

Answer

Schedule weekly antivirus scans

Answer

Install a host-based firewall on each computer

Answer

Use email encryption for all communications

Question 14

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 15

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity

Question 16

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Accepted Answer

Risk register. The risk register is the formal document used to track identified risks, their assessed likelihood and impact, and the chosen risk response. When a residual risk remains after controls are implemented, the risk register records that residual risk level and formally documents management's decision to accept it, including the rationale and approval. This ensures auditability and accountability for the accepted risk.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Security baseline

Question 17

A security analyst is reviewing network device logs and finds multiple failed SSH login attempts from a single external IP. Which three actions should the analyst take to mitigate this brute-force attack? (Choose three.)

Accepted Answer

Disable password-based authentication for SSH.. Disabling password-based authentication for SSH (Option B) eliminates the primary vector for brute-force attacks, as attackers cannot guess passwords. This forces the use of cryptographic key pairs, which are computationally infeasible to brute-force. Combined with an ACL to block the offending IP (Option C) and enabling only public key authentication (Option D), these three actions directly mitigate the ongoing and future brute-force attempts.

Answer

Increase the SSH login timeout.

Answer

Change the SSH port to a non-standard port.

Question 18

In the context of risk assessment, which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that can be exploited. In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Answer

A potential event that can cause harm

Answer

The likelihood of a threat exploiting a weakness

Answer

An actual occurrence of a harmful event

Question 19

Which protocol is used to automatically assign IP addresses to devices on a network?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. This eliminates the need for manual IP configuration and reduces the risk of address conflicts.

Answer

ARP

Answer

DNS

Answer

ICMP

Question 20

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Accepted Answer

User behavior risk indicator. The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Answer

Technical vulnerability indicator

Answer

Error log indicator

Answer

Configuration drift indicator