SSCP Practice Test 5 — 25 Questions

Question 1

An organization requires that all laptops used by employees be encrypted. Which type of encryption should be used to protect the entire hard drive?

Accepted Answer

Full disk encryption (FDE). Full disk encryption (FDE) encrypts the entire hard drive, including the operating system and all files, providing the strongest protection for data at rest on lost or stolen laptops. File-level encryption only encrypts individual files, leaving metadata and other files exposed. Folder-level encryption is similar but at the folder level. Transport encryption (TLS) protects data in transit, not at rest. Application-level encryption encrypts data within a specific application, not the entire drive. Therefore, full disk encryption (Option B) is the correct choice for protecting the entire hard drive.

Answer

File-level encryption

Answer

Transport encryption (TLS)

Answer

Application-level encryption

Answer

Folder-level encryption

Question 2

During a security audit, it is discovered that a legacy system uses SNMPv1 for network monitoring. Which of the following is the primary security concern?

Accepted Answer

Community strings transmitted in cleartext. SNMPv1 transmits community strings (effectively passwords) in cleartext over the network. An attacker capturing network traffic can directly read the community string and gain unauthorized access to SNMP-managed devices. This lack of confidentiality is the primary security concern because it exposes the entire monitoring infrastructure to compromise.

Answer

Weak hashing

Answer

No access control

Answer

Lack of encryption

Question 3

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

Accepted Answer

Place the workstation into a quarantine VLAN via switch configuration. Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Answer

Apply a host-based firewall rule to block all inbound traffic

Answer

Physically unplug the network cable

Answer

Disable the user's Active Directory account

Question 4

During a forensic investigation, you find that the attacker used a legitimate Windows tool to exfiltrate data. Which tool is commonly abused for this purpose?

Accepted Answer

PowerShell. PowerShell is a legitimate Windows administrative tool that attackers commonly abuse for data exfiltration because it provides native access to network protocols (e.g., HTTP, HTTPS, FTP, SMB) and can download/upload files directly from the command line without additional binaries. Its deep integration with the Windows operating system allows scripts to run in memory, bypassing traditional file-based detection mechanisms, making it a favored tool for post-exploitation data theft.

Answer

Telnet

Answer

Netcat

Answer

FTP

Question 5

Which protocol is used to automatically assign IP addresses to devices on a network?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. This eliminates the need for manual IP configuration and reduces the risk of address conflicts.

Answer

ARP

Answer

DNS

Answer

ICMP

Question 6

Which of the following best describes the function of SYN cookies in mitigating SYN flood attacks?

Accepted Answer

They encode connection state in the SYN-ACK sequence number, allowing the server to avoid storing state until the ACK is received.. SYN cookies encode the connection state (such as sequence numbers and timestamps) into the initial sequence number of the SYN-ACK. This allows the server to avoid allocating resources until the final ACK is received, mitigating SYN flood attacks that exhaust the backlog queue.

Answer

They block all incoming SYN packets from suspicious sources.

Answer

They increase the backlog queue size to accommodate more half-open connections.

Answer

They require clients to solve a computational puzzle before completing the handshake.

Question 7

You are the security administrator for a mid-sized financial company that processes credit card transactions. The company has a mix of on-premises servers and cloud-based services. Recently, the company experienced a data breach where an attacker exfiltrated customer data from a database server. The investigation reveals that the attacker used compromised credentials of a database administrator (DBA) account. The DBA account had been used by multiple administrators without proper auditing. The company wants to implement a solution to prevent such incidents in the future. The solution must: 1) ensure that each administrator has a unique account for database access, 2) require approval for privileged actions, 3) provide a full audit trail of all privileged activities, and 4) be cost-effective. Which of the following is the best course of action?

Accepted Answer

Implement a privileged access management (PAM) solution that provides just-in-time access and session recording.. A privileged access management (PAM) solution provides just-in-time access, approval workflows for privileged actions, and session recording for a full audit trail, directly addressing all four requirements. It ensures each administrator has a unique account by vaulting credentials and allowing check-out, and it is cost-effective compared to building custom controls. MFA alone does not provide approval or session recording, and DAM only logs queries without controlling access.

Answer

Enforce the use of a shared DBA account with a complex password that is changed monthly.

Answer

Require multi-factor authentication for all database access without any additional controls.

Answer

Install a database activity monitoring (DAM) solution that logs all SQL queries.

Question 8

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Accepted Answer

IEEE 802.1X port-based authentication. IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Answer

Port security with sticky MAC

Answer

MAC address filtering

Answer

VLAN segmentation

Question 9

An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?

Accepted Answer

$12,500. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $25,000 and an ARO of 0.5, the ALE is $25,000 × 0.5 = $12,500. This quantifies the expected annual financial loss from the SQL injection vulnerability.

Answer

$50,000

Answer

$25,000

Answer

$6,250

Question 10

A security engineer is configuring a site-to-site VPN between two branch offices using IPsec in tunnel mode. Which protocol provides both authentication and encryption of the entire original IP packet?

Accepted Answer

ESP (Encapsulating Security Payload) in tunnel mode. ESP (Encapsulating Security Payload) in tunnel mode encrypts and authenticates the entire original IP packet, then encapsulates it inside a new IP packet with new headers. This provides confidentiality, integrity, and origin authentication for the payload, making it the standard choice for site-to-site VPNs.

Answer

IKEv2 in transport mode

Answer

L2TP in tunnel mode

Answer

AH (Authentication Header) in tunnel mode

Question 11

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Accepted Answer

The application passes user input to a shell command via exec() or system() functions.. The scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Answer

The application uses unsanitized input in SQL queries.

Answer

The application reflects user input in HTTP responses without escaping.

Answer

The application uses hidden form fields to store session tokens.

Question 12

An organization uses smart cards with PKI certificates for authentication. Users must insert the card and enter a PIN. This is an example of which authentication method?

Accepted Answer

Two-factor authentication. Two-factor authentication requires two different categories of authentication factors. The smart card (something you have) plus the PIN (something you know) combine two distinct factor types, so this is two-factor authentication. The certificate on the card provides cryptographic proof of possession, while the PIN unlocks the card and proves knowledge.

Answer

Three-factor authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 13

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

Accepted Answer

Establishing a process to add approved applications to the whitelist. Application whitelisting only allows approved applications to run. To maintain operational efficiency, organizations must have a streamlined process to review and add new or updated applications to the whitelist as business needs evolve. Without this, users may be blocked from necessary tools, causing productivity loss.

Answer

Ensuring that all users have local administrator rights

Answer

Deploying a host-based firewall on each endpoint

Answer

Disabling Windows Defender Antivirus to reduce resource usage

Question 14

A medium-sized company recently experienced a phishing attack where an employee downloaded a malicious attachment, leading to a data breach. The incident response team has identified the affected user and the malware. However, the team is unsure whether the attacker has established persistence. The security analyst must recommend the next step. The company has a standard incident response plan that includes detection, containment, eradication, recovery, and lessons learned. The malware sample has been isolated for analysis. The user's account has been disabled temporarily. The network team has quarantined the user's workstation. The analyst needs to ensure the attacker cannot regain access after the initial cleanup. What should the analyst recommend next?

Accepted Answer

Check system logs for unauthorized registry modifications, scheduled tasks, or startup entries.. The immediate priority after containment is to identify and remove any persistence mechanisms the attacker may have established. Checking system logs for unauthorized registry modifications (e.g., Run keys), scheduled tasks (e.g., schtasks), and startup entries (e.g., Startup folder or services) directly addresses the uncertainty about persistence. This step ensures the attacker cannot regain access after cleanup, aligning with the eradication phase of the incident response plan.

Answer

Perform a full malware analysis of the file to understand its capabilities.

Answer

Notify affected customers immediately as required by data breach notification laws.

Answer

Reimage the user's workstation from a known good backup.

Question 15

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It uses XML assertions to convey user identity and attributes, making it the correct protocol for this scenario.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 16

An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?

Accepted Answer

Password history. The requirement that users cannot reuse any of the last 10 passwords is specifically addressing password history, which prevents users from cycling back to previous passwords. This element enforces a memory of past passwords to avoid reuse.

Answer

Password expiry

Answer

Password length

Answer

Password complexity

Question 17

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 18

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure (network, OS, hypervisor, runtime), while the customer is responsible for the security of their application code and data. Securing application code against SQL injection is therefore the customer's responsibility. The other options are provider-managed in PaaS.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 19

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

Accepted Answer

Smurf attack. A Smurf attack sends a flood of forged ICMP echo requests to a network's broadcast address with the source IP spoofed as the target's IP. All hosts on the network respond to the broadcast, overwhelming the target with ICMP echo replies. This is a classic amplification attack. Therefore, Smurf attack is correct.

Answer

Ping of death

Answer

SYN flood

Answer

DNS amplification

Question 20

An organization allows employees to use personal smartphones to access corporate email and data. Which control is MOST important to protect corporate data if a device is lost or stolen?

Accepted Answer

Implement remote wipe capability. Remote wipe capability is the most important control because it allows the organization to remotely erase corporate data from a lost or stolen device, directly mitigating the risk of unauthorized access. While encryption, strong passwords, and screen locks provide defense-in-depth, they do not guarantee data destruction if the device falls into the wrong hands. Remote wipe is the only control that ensures corporate data is removed from the device, addressing the specific threat of loss or theft.

Answer

Require device encryption

Answer

Require strong passwords with complexity requirements

Answer

Enforce a screen lock timeout of 1 minute