SSCP Practice Test 26 — 15 Questions

Question 1

A healthcare organization stores patient records in a database that is encrypted at rest using AES-256-CBC. The encryption key is stored in a plaintext configuration file on the database server, with file permissions set to read-only for the database service account and administrators. During an internal audit, the security team flags this as a critical vulnerability because the key is co-located with the encrypted data. The system administrator argues that the file permissions are sufficient to prevent unauthorized access. Separately, the organization must comply with HIPAA requirements for encryption key management. Which remediation most effectively addresses the vulnerability and meets compliance requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Move the encryption key to a hardware security module (HSM) accessible only via authenticated API calls.. Moving the encryption key to a hardware security module (HSM) physically separates the key from the encrypted data, eliminating the co-location vulnerability. HSMs provide tamper-resistant key storage and enforce access controls via authenticated API calls, which aligns with HIPAA requirements for proper key management and protection of electronic protected health information (ePHI).

Answer

Change the encryption algorithm from AES-256-CBC to AES-256-GCM.

Answer

Implement file integrity monitoring (FIM) on the configuration file to alert on unauthorized access.

Answer

Encrypt the configuration file containing the key with a second AES-256 key stored in the same directory.

Question 2

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Accepted Answer

Tabletop exercise. A tabletop exercise (A) is correct because it is a discussion-based test in which stakeholders talk through disaster recovery roles, procedures, and decision points without touching or reconfiguring any production systems, so it carries essentially no operational risk. A walkthrough (D) is also correct because participants verbally trace each step of the DR plan against documentation and expected actions, again without executing failover or activating alternate sites, keeping production untouched. By contrast, a simulation test (B) can involve activating recovery mechanisms or alternate processing in a controlled but still potentially disruptive manner, and a parallel test (C) runs the recovery site alongside production, which introduces cost, data-synchronization, and configuration risks. A full interruption test (E) is the riskiest option because it actually shuts down or takes production offline to fail over completely, which is unacceptable when minimal risk is required.

Answer

Simulation test

Answer

Parallel test

Answer

Full interruption test

Question 3

A security administrator is configuring a firewall to allow outbound web traffic from internal users. The firewall must inspect the application layer data to block malicious URLs. Which type of firewall should be used?

Accepted Answer

Application proxy firewall. An application proxy firewall is correct because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS traffic to block malicious URLs. It acts as an intermediary, terminating the client connection and initiating a new one to the server, allowing deep inspection of application data. This meets the requirement to inspect application layer data for outbound web traffic.

Answer

Stateless packet filter

Answer

Stateful firewall

Answer

Network Access Control (NAC) system

Question 4

Which access control model allows the owner of a resource to determine who can access it and what privileges they have?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) is defined by the resource owner having discretion over who can access the resource and what permissions they receive. In DAC systems, ownership is the basis for control — the owner can grant, revoke, or modify access rights at will, typically via ACLs. This owner-driven discretion is the defining characteristic that separates DAC from the other models.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 5

An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?

Accepted Answer

Just-in-time provisioning. Just-in-time (JIT) provisioning grants elevated privileges only for the duration they are needed, then automatically revokes them. This directly matches the requirement of temporary administrative rights granted on demand. It reduces standing privilege and the window of exposure if credentials are compromised.

Answer

Session recording

Answer

Password vaulting

Answer

Role mining

Question 6

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Accepted Answer

To detect errors through independent verification.. Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.

Answer

To reduce the workload on individual employees.

Answer

To simplify training requirements.

Answer

To comply with regulatory requirements.

Question 7

Which THREE of the following are considered cryptographic best practices for key management? (Select exactly 3.)

Accepted Answer

Separate keys used for encryption and digital signatures. Option A is correct because key separation ensures that a key used for encryption is not reused for digital signatures, limiting the blast radius if one key is compromised and preventing cross-protocol attacks that arise from using the same key for different cryptographic purposes. Option B is correct because periodic key rotation limits the amount of data protected by any single key, so if a key is eventually compromised, only the data encrypted during that key's lifetime is exposed, which is a core requirement of frameworks like NIST SP 800-57. Option C is correct because HSMs provide tamper-resistant hardware that generates, stores, and performs cryptographic operations with keys in a protected boundary, so private or symmetric keys never exist in plaintext in general-purpose memory or on disk. Option D is wrong because publishing symmetric keys destroys confidentiality entirely, since anyone could decrypt the data, and transparency is achieved through publishing algorithms or certificates, not secret keys. Option E is wrong because storing keys alongside the encrypted data means anyone who obtains the data also obtains the key, eliminating the protection that encryption is supposed to provide.

Answer

Publish symmetric keys on the company website for transparency

Answer

Store keys with the encrypted data for convenience

Question 8

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

Accepted Answer

At least two different media types. The 3-2-1 backup rule requires three copies of the data (option D), meaning the original plus two backups, which ensures redundancy if one copy is lost or corrupted. It also requires at least two different media types (option A), such as disk and tape or local disk and cloud storage, so a single media failure cannot destroy all backups. Finally, it requires at least one copy stored offsite (option C), protecting against site-wide disasters like fire, flood, or theft. Option B (daily full backups) is a scheduling/retention choice, not part of the 3-2-1 rule, and option E (encryption) is a security best practice but not one of the 3-2-1 characteristics.

Answer

Daily full backups

Answer

Encryption of all backups

Question 9

An organization is experiencing VM sprawl, with many unmanaged virtual machines running in the environment. Which of the following is the most significant security risk associated with VM sprawl?

Accepted Answer

Unpatched and misconfigured VMs. Unmanaged VMs often lack proper patching and configuration management, leading to unpatched vulnerabilities that can be exploited.

Answer

License compliance violations

Answer

Increased power consumption and cooling costs

Answer

VM escape attacks from older hypervisors

Question 10

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

Accepted Answer

Patch prioritization based on CVSS score and asset criticality. Option A is correct because a sound patch management policy must rank patches by risk, combining the CVSS base score (e.g., 9.8 Critical) with the business criticality of the affected asset so that the most dangerous exposures on the most important systems are remediated first. Option D is correct because you cannot patch what you have not found; regular authenticated vulnerability scanning (e.g., credentialed scans with Nessus or Qualys) is the mechanism that identifies missing patches and misconfigurations and feeds the remediation workflow. Option E is correct because patches should be validated in a staging or test environment that mirrors production before broad rollout, catching application compatibility and regression issues while still meeting the policy's remediation deadlines. Option B is not part of a policy because deploying every patch immediately with no testing risks outages and is the opposite of a controlled, risk-based process. Option C is not adequate because reviewing patch status only annually leaves systems exposed for months; effective policies require continuous or at least monthly monitoring and reporting of patch compliance.

Answer

Immediate deployment of all patches without testing

Answer

Annual review of patch status

Question 11

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

Accepted Answer

WPA2-PSK with AES (CCMP). WPA2-PSK with AES (CCMP) is correct because it provides the highest security level compatible with legacy devices that only support WPA2-PSK. AES-CCMP is the mandatory encryption protocol for WPA2, offering strong data confidentiality and integrity, whereas TKIP is deprecated due to known vulnerabilities. This configuration avoids the need for a RADIUS server (required by WPA2-Enterprise) and does not force an upgrade to WPA3, which legacy devices cannot support.

Answer

WPA2-Enterprise with RADIUS

Answer

WPA3-SAE only

Answer

WPA2-PSK with TKIP

Question 12

Which THREE of the following are appropriate techniques for securely disposing of magnetic hard disk drives that contain sensitive data? (Choose three.)

Accepted Answer

Shredding. Shredding (B) is correct because physically destroying the magnetic platters into small particles makes data recovery impossible, which is the strongest disposal method for magnetic HDDs. Overwriting with random patterns (D) is correct because repeatedly writing random data across the entire disk renders the original sensitive data unrecoverable, and it is a standard sanitization technique for magnetic media. Degaussing (E) is correct because exposing the drive to a strong magnetic field destroys the magnetic alignment of the platters, erasing the data and typically also rendering the drive unusable. Low-level format (A) is not appropriate because it only recreates the disk's physical structure and does not securely erase existing data. Quick format (C) is not appropriate because it merely removes file system references while leaving the underlying data intact and recoverable.

Answer

Low-level format

Answer

Quick format

Question 13

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Answer

Detection and Analysis

Question 14

Which of the following is a secure hash algorithm currently recommended by NIST?

Accepted Answer

SHA-256. SHA-256 is a member of the SHA-2 family of secure hash algorithms and is currently recommended by NIST for cryptographic use. It produces a 256-bit (32-byte) hash value and is widely deployed in protocols such as TLS, SSH, and IPsec, as well as in digital signatures and certificate validation.

Answer

SHA-1

Answer

RC4

Answer

MD5

Question 15

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)