SSCP Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A web server log shows two requests from the same IP. What type of attack is being attempted, and which mitigation is MOST effective?

Accepted Answer

SQL injection; use parameterized queries. Option A is correct because the requests contain SQL injection patterns (OR 1=1 and DROP TABLE). Parameterized queries prevent SQL injection. Option B is wrong because XSS would involve script tags. Option C is wrong because command injection would involve shell commands. Option D is wrong because CSRF would involve a different method and referrer.

Answer

Cross-site scripting (XSS); encode all output

Answer

Cross-site request forgery (CSRF); use anti-CSRF tokens

Answer

Command injection; implement input validation

Question 2

During a code review, you discover that an application stores passwords in plaintext. What is the most secure remediation?

Accepted Answer

Use bcrypt with a unique salt per password. Bcrypt with a unique salt is designed for password storage; it is slow and resistant to brute force. MD5 is fast and weak. AES encryption is reversible if the key is compromised. Database access control does not protect if the database is breached.

Answer

Hash passwords with MD5

Answer

Use AES encryption of passwords

Answer

Store passwords in a database with restricted access

Question 3

A security engineer needs to select a hashing algorithm for storing user passwords in a database. Which of the following is the most secure choice?

Accepted Answer

bcrypt. Option D is correct because bcrypt is specifically designed for password hashing with a cost factor to resist brute-force. Option A (MD5) is broken; B (SHA-1) is weak; C (SHA-256) is fast and suitable for integrity, not passwords; E (PBKDF2) is also good, but bcrypt is often preferred due to built-in salt and adaptive cost.

Answer

SHA-256

Answer

MD5

Answer

SHA-1

Answer

PBKDF2

Question 4

An organization uses a cloud-based file synchronization service to share project files with external partners. The security team discovers that an unauthorized third party accessed sensitive documents by guessing weak passwords. Which additional control would most effectively mitigate this risk?

Accepted Answer

Enforcing multi-factor authentication for all external users.. Option B is correct because multi-factor authentication directly addresses credential guessing by requiring a second factor. Option A is incorrect because file-level encryption with on-premises keys does not prevent unauthorized access if the attacker already has valid credentials. Option C is incorrect because SFTP does not inherently provide stronger authentication than HTTPS. Option D is incorrect because a custom domain certificate does not affect authentication strength.

Answer

Requiring all file transfers to use SFTP instead of HTTPS.

Answer

Implementing file-level encryption with keys stored on-premises.

Answer

Configuring the service to use a custom domain certificate.

Question 5

A financial services organization deploys a new web application that allows customers to check account balances and transfer funds. The application uses a RESTful API with JSON payloads. Shortly after deployment, the security team notices unusual traffic patterns: many requests contain excessively long JSON strings in the 'amount' field, and some of these requests return 500 Internal Server Errors. The application logs show that these requests cause high CPU usage on the application server. The developers confirm that the input validation only checks for negative numbers and characters. Which type of attack is most likely occurring, and what is the best immediate mitigation?

Accepted Answer

The attack is a Denial of Service using large payloads; implement input size limits and validation.. Option B is correct because the symptoms indicate a Denial of Service attack via large payloads that consume server resources. Input validation should reject oversized inputs. Option A is incorrect because brute force would not cause high CPU from large payloads. Option C is incorrect because SQL injection would likely return specific error messages rather than 500s from CPU exhaustion. Option D is incorrect because XSS targets browser execution, not server CPU.

Answer

The attack is a brute-force attempt on the amount field; implement rate limiting.

Answer

The attack is cross-site scripting; sanitize output.

Answer

The attack is SQL injection; use parameterized queries.

Question 6

Refer to the exhibit. An AWS S3 bucket policy is defined as shown. Which statement about this policy is TRUE?

Accepted Answer

Any user can read objects in the company-public bucket. Option B is correct because the first statement allows anyone to read objects in the company-public bucket. Option A is wrong because the policy does not affect other buckets. Option C is wrong because the company-public bucket is explicitly allowed for GetObject. Option D is wrong because the Deny statement is effective, but it only denies access to company-private bucket, not company-public.

Answer

The company-public bucket objects are completely private

Answer

The Deny statement prevents all access to both buckets

Answer

The policy applies to all buckets in the account

Question 7

Refer to the exhibit. A security analyst reviews a Windows Security event log entry showing multiple logon failures for user 'admin' from IP 10.0.0.100 within 5 minutes. What type of attack is most likely occurring?

Accepted Answer

Brute force attack. Multiple logon failures from a single IP indicate a brute force attack. Pass-the-hash uses captured hashes, not repeated failures. Kerberos ticket replay is different. Privilege escalation is not indicated.

Answer

Kerberos ticket replay

Answer

Pass-the-hash attack

Answer

Privilege escalation

Question 8

A company deploys a new web application and wants to ensure that session tokens are not vulnerable to session hijacking. Which of the following controls is most effective?

Accepted Answer

Set the Secure and HttpOnly flags on session cookies.. Option C is correct because setting the Secure and HttpOnly flags ensures cookies are only sent over HTTPS and not accessible via JavaScript, preventing interception and XSS-based theft. Option A (encrypting cookies) is redundant if HTTPS is used; B (short expiration) helps but not primary; D (using IP binding) can cause issues; E (regenerating session ID) is good after login, but not the most effective overall.

Answer

Bind the session token to the user's IP address.

Answer

Set a short session timeout (e.g., 5 minutes).

Answer

Encrypt the session token using AES.

Answer

Regenerate the session ID after every request.

Question 9

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

Accepted Answer

The web application firewall is blocking legitimate traffic.. Option C is correct because a 403 Forbidden error typically indicates that the web application firewall (WAF) is blocking requests, often due to false positives. Option A is incorrect because an IP change would result in connection errors, not HTTP 403. Option B is incorrect because a database connection pool exhaustion would cause 500-type errors. Option D is incorrect because an expired SSL certificate would cause SSL handshake errors, not 403.

Answer

The SSL certificate has expired.

Answer

The application's database connection pool is exhausted.

Answer

The web server's IP address has changed.

Question 10

A university IT department manages a lab of 50 computers running Windows 10 that are used by students for coursework. The computers are joined to a domain and have Group Policy applied to restrict administrative access. Recently, several students were able to install unauthorized software by using the built-in Administrator account, which had the same password on all lab computers. The IT department wants to prevent this without affecting the students' ability to run required academic software. Which of the following is the most effective solution?

Accepted Answer

Use a tool to assign a unique, random password to the local Administrator account on each computer.. Option C is correct because changing the local Administrator password to a unique, complex value for each machine prevents lateral movement and unauthorized use. Option A is incorrect because disabling the account might break functionality if it's relied upon. Option B is incorrect because while SRP helps, it does not prevent use of the Administrator account. Option D is incorrect because standard user accounts do not have installation rights, but if students know the Admin password, they can still use it.

Answer

Configure the computers to only allow standard user accounts.

Answer

Disable the local Administrator account on all lab computers.

Answer

Implement Software Restriction Policies to block unauthorized executables.

Question 11

A company wants to prevent unauthorized applications from running on employee workstations. Which of the following is the most effective control?

Accepted Answer

Application whitelisting. Application whitelisting allows only approved executables to run, effectively preventing unauthorized applications. Host-based intrusion detection can detect but not prevent. Antivirus relies on signatures and may miss unknown malware. User training is important but not a technical control.

Answer

User training

Answer

Regular antivirus updates

Answer

Host-based intrusion detection system

Question 12

Refer to the exhibit. A firewall log shows repeated outbound connection attempts from an internal workstation (192.168.1.50) to an external IP (203.0.113.50) on TCP port 445. What is the most likely cause?

Accepted Answer

A worm or malware exploiting SMB. Port 445 is SMB. Outbound SMB attempts often indicate a worm or malware trying to propagate. Web browsing uses 80/443. File sharing is typically internal. DNS uses 53.

Answer

A misconfigured DNS client

Answer

A user browsing the web

Answer

A legitimate file share connection

Question 13

An organization is migrating its on-premises applications to a cloud provider. Which of the following security controls should be implemented to protect data at rest in the cloud?

Accepted Answer

Enable server-side encryption on storage services.. Option B is correct because enabling server-side encryption (SSE) ensures data is encrypted when stored by the cloud provider. Option A (network segmentation) protects in transit; C (access keys) are for authentication; D (MFA) is for user identity; E (audit logs) are detective.

Answer

Implement multi-factor authentication for all users.

Answer

Configure network segmentation using VPCs.

Answer

Use access keys for API authentication.

Answer

Enable CloudTrail or equivalent audit logging.

Question 14

A security analyst needs to ensure that a legacy application running on an unsupported operating system remains secure until it can be replaced. Which strategy provides the most effective risk reduction?

Accepted Answer

Move the application to a sandboxed virtual machine and isolate it from the network.. Option D is correct because isolating the application in a sandboxed virtual machine with network restrictions minimizes the attack surface. Option A is incorrect because application whitelisting does not protect against OS-level vulnerabilities. Option B is incorrect because upgrading the application is not feasible if it runs on an unsupported OS. Option C is incorrect because third-party patches may introduce instability or conflicts.

Answer

Apply all available security patches from third-party sources.

Answer

Upgrade the application to the latest version with vendor support.

Answer

Implement application whitelisting to allow only approved executables.

Question 15

Refer to the exhibit. An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': ['s3:ListBucket','s3:GetObject'], 'Resource': 'arn:aws:s3:::example-bucket/*'. What does this policy allow?

Accepted Answer

List objects and read objects in example-bucket. ListBucket allows listing objects, GetObject allows reading objects. It does not allow write or delete. The resource is specific to example-bucket.

Answer

Full access to all S3 buckets

Answer

Delete objects from example-bucket

Answer

Write objects to example-bucket

SSCP Practice Test 26 — 15 Questions

Exhibit

SSCP Practice Test 26 — 15 Questions

Exhibit