SSCP Practice Test 5 — 25 Questions

Question 1

A network administrator is configuring a VPN using IPsec. Which two protocols are used within IPsec to ensure data integrity and confidentiality? (Choose two.)

Accepted Answer

ESP (Encapsulating Security Payload). C is correct because ESP (Encapsulating Security Payload) provides both data confidentiality (via encryption) and data integrity (via authentication), making it the primary IPsec protocol for securing payloads. E is correct because AH (Authentication Header) ensures data integrity and origin authentication but does not provide confidentiality, as it does not encrypt the payload. Together, ESP and AH are the two core IPsec protocols that handle integrity and confidentiality, though ESP alone is typically used in modern deployments.

Answer

SSL (Secure Sockets Layer)

Answer

L2TP (Layer 2 Tunneling Protocol)

Answer

IKE (Internet Key Exchange)

Question 2

An organization wants to perform a risk analysis for a new cloud application. Which quantitative metric is most commonly used to calculate risk?

Accepted Answer

Annualized Loss Expectancy (ALE).. Annualized Loss Expectancy (ALE) is the most commonly used quantitative metric for calculating risk because it combines the expected financial loss from a single event (Single Loss Expectancy) with the annual frequency of that event (Annualized Rate of Occurrence). This produces a dollar-value risk figure that organizations can directly compare against security control costs and budget decisions for a cloud application.

Answer

Control effectiveness.

Answer

Threat likelihood.

Answer

Residual risk.

Question 3

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. A communication plan with contact information for key stakeholders ensures that the right people can be reached quickly during an incident, which is critical for coordination and decision-making. Option E is correct because detailed recovery procedures for each critical system provide step-by-step instructions to restore operations, minimizing downtime and ensuring consistency in response efforts.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 4

During a security assessment, a penetration tester discovers that a web application allows users to upload files without proper validation. The tester successfully uploads a PHP web shell. Which control would have MOST effectively prevented this exploitation?

Accepted Answer

Validate file extension and content type on the server side.. Server-side validation of both file extension and content type (e.g., MIME type magic bytes) is the most effective control to prevent uploading executable files like a PHP web shell. Without this validation, an attacker can bypass client-side checks and upload a malicious script that the server will execute. Disabling PHP execution in the upload directory (Option A) is a compensating control but does not prevent the upload itself, and a WAF rule (Option B) can be evaded with obfuscation or encoding.

Answer

Disable PHP execution in the upload directory.

Answer

Implement a WAF rule to block common webshell patterns.

Answer

Enable audit logging for file uploads.

Question 5

A security administrator is tasked with managing user access. Which THREE of the following are principles of least privilege? (Choose three.)

Accepted Answer

Grant users the minimum rights needed to perform their job.. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. It is a foundational access control concept enforced through role-based access control (RBAC) or attribute-based access control (ABAC) policies.

Answer

Implement mandatory access control.

Answer

Require manager approval for privilege escalation.

Question 6

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers

Question 7

Which TWO of the following are characteristics of a Smurf attack? (Select TWO)

Accepted Answer

Uses ICMP echo requests. Smurf attacks send ICMP echo requests to a broadcast address with a spoofed source IP, causing all hosts to reply to the victim, leading to amplification.

Answer

Requires fragmented packets

Answer

Exploits TCP SYN handshake

Answer

Targets DNS resolvers

Question 8

Which THREE are appropriate controls to prevent unauthorized access to a data center? (Choose three.)

Accepted Answer

Biometric scanner. A biometric scanner is a physical access control that authenticates individuals based on unique physiological characteristics (e.g., fingerprints, iris patterns). It directly prevents unauthorized entry by verifying identity at the data center perimeter, making it an appropriate control for physical security.

Answer

Firewall

Answer

Encryption

Question 9

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 10

A company has deployed an intrusion detection system (IDS) that generates numerous false positives. Which approach would best reduce false positives while maintaining detection capability?

Accepted Answer

Tune the IDS signatures and rules. Tuning IDS signatures and rules (option D) directly addresses the root cause of false positives by refining detection patterns to match legitimate traffic more accurately. This approach preserves the IDS's ability to detect genuine threats while eliminating noise, unlike threshold adjustments which can miss low-and-slow attacks.

Answer

Increase the alert generation threshold

Answer

Replace the IDS with an intrusion prevention system (IPS)

Answer

Disable the IDS until a full review is completed

Question 11

What is the primary purpose of establishing a chain of custody for digital evidence?

Accepted Answer

To maintain evidence integrity and track handling. The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Answer

To reduce the size of evidence for storage

Answer

To encrypt evidence for secure transmission

Answer

To prioritize which evidence to analyze first

Question 12

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 13

Based on the exhibit, which of the following best describes the firewall configuration?

Accepted Answer

The firewall allows SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic.. The exhibit shows an access control list (ACL) that explicitly permits TCP traffic on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) from the internal subnet (e.g., 192.168.1.0/24) to any destination, followed by an implicit deny all rule. This configuration allows only SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic, matching option C.

Answer

The firewall allows only loopback traffic.

Answer

The firewall allows all traffic from the internal subnet.

Answer

The firewall allows all traffic from external sources.

Question 14

Which TWO of the following are key components of a Security Information and Event Management (SIEM) system? (Select two.)

Accepted Answer

Centralized log collection and storage. Centralized log collection and storage is a core SIEM component because it aggregates logs from diverse sources (servers, firewalls, applications) into a single repository, enabling unified analysis and forensic investigation. Without this centralized data lake, the correlation engine would have no data to process, making the SIEM ineffective.

Answer

Vulnerability scanning

Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Question 15

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Accepted Answer

Backup, Overwrite, Verify, Destroy, Document. The proper order for disposing of a hard drive with sensitive data is: first, backup any data that needs to be retained; second, overwrite the entire drive to sanitize it; third, verify that the overwrite was successful using a tool; fourth, physically destroy the drive (e.g., shredding or crushing); and finally, document the process for audit trails and compliance. This sequence ensures data confidentiality and availability of necessary data.

Answer

Overwrite, Verify, Backup, Destroy, Document

Answer

Destroy, Backup, Overwrite, Verify, Document

Answer

Backup, Verify, Overwrite, Destroy, Document

Question 16

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 17

Which TWO of the following are characteristics of a Mandatory Access Control (MAC) system?

Accepted Answer

Access decisions are based on security labels.. Mandatory Access Control (MAC) systems use security labels (e.g., classifications like Top Secret, Secret, Confidential) attached to subjects and objects. The operating system or reference monitor enforces access decisions based on these labels and a set of rules (e.g., the Bell-LaPadula model's simple security property and *-property), not at the discretion of users or owners. This ensures that access is determined by a central policy, typically implemented via labels in systems like SELinux or Trusted Solaris.

Answer

Access is determined by the owner of the object.

Answer

It uses roles to assign permissions.

Answer

Users can change permissions on their own objects.

Question 18

Which of the following is the correct order of steps in the change management process?

Accepted Answer

Change request, impact assessment, CAB approval, testing, implementation, post-implementation review. The standard change management process begins with submitting a change request, followed by impact assessment, CAB approval, testing, implementation, and finally post-implementation review.

Answer

Change request, CAB approval, impact assessment, testing, implementation, post-implementation review

Answer

Impact assessment, change request, CAB approval, testing, implementation, post-implementation review

Answer

Change request, testing, impact assessment, CAB approval, implementation, post-implementation review

Question 19

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

Accepted Answer

Key performance indicator (KPI). A key performance indicator (KPI) measures the performance of a process or activity. Patch compliance rates are common KPIs for patch management, indicating how well the organization is meeting patching objectives.

Answer

Service level agreement (SLA)

Answer

Control objective

Answer

Key risk indicator (KRI)

Question 20

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Accepted Answer

Use the intercom to contact security. The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.

Answer

Return through the first door

Answer

Force the second door open

Answer

Wait for someone to open from the other side