SSCP Practice Test 26 — 15 Questions

Question 1

A security analyst reviews a cryptographic implementation and notices that the same initialization vector (IV) is used repeatedly with the same key in CBC mode. What is the primary risk?

Accepted Answer

Loss of confidentiality. In CBC (Cipher Block Chaining) mode, the initialization vector (IV) is XORed with the first plaintext block before encryption. Reusing the same IV with the same key means that identical plaintext blocks will produce identical ciphertext blocks, revealing patterns in the data. This directly breaks confidentiality, as an attacker can detect repeated plaintext segments, infer message structure, or even recover plaintext through known-plaintext attacks.

Answer

Loss of authentication

Answer

Non-repudiation is compromised

Answer

Loss of integrity

Question 2

An administrator wants to ensure that users cannot share passwords. Which control is most effective at reducing the risk of password sharing?

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) is the most effective control because it requires users to present two or more distinct factors (e.g., something you know, something you have, something you are) to authenticate. Even if a user shares their password (something you know), an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or biometric). This directly reduces the risk of password sharing by making the shared credential insufficient for access.

Answer

Account lockout policies

Answer

Password complexity

Answer

Password history

Question 3

After a ransomware attack, the recovery team must restore encrypted files from backups. The backups are stored on a separate network segment and were last verified three days ago. What should the team do FIRST?

Accepted Answer

Verify the integrity and cleanliness of the backup.. Before restoring, ensure the backup system is not compromised. Option B is correct. Option A may restore malware; Option C is premature; Option D is not a first step.

Answer

Disconnect the infected systems from the network.

Answer

Contact law enforcement.

Answer

Restore all files from the most recent backup.

Question 4

Which TWO of the following are appropriate actions when preserving digital evidence at a crime/incident scene?

Accepted Answer

Document all actions taken. Documenting all actions taken (Option A) is a fundamental principle of digital forensics, as it creates a verifiable chain of custody and ensures the integrity of evidence. This documentation includes timestamps, tools used, and any changes made to the system, which is critical for admissibility in legal proceedings. Without proper documentation, the evidence may be challenged as tampered or unreliable.

Answer

Connect to the internet to check online resources

Answer

Use the system to check files

Answer

Power off the system immediately

Question 5

A user reports they can now access files in a shared drive that were previously denied. Upon investigation, the IT team discovers the user was added to a new group that has read/write permissions to the drive. This situation is best described as:

Accepted Answer

Privilege creep. Privilege creep occurs when users accumulate more permissions over time than they need for their current role, often through group memberships. In this scenario, the user was added to a new group that granted read/write access to a shared drive, resulting in unintended elevated access. This is a classic example of privilege creep because the user's access rights expanded beyond what was originally authorized, violating the principle of least privilege.

Answer

Separation of duties violation

Answer

Inconsistent access control list

Answer

Role explosion

Question 6

Which THREE of the following are valid methods for enforcing separation of duties in an IT environment? (Select the three best answers.)

Accepted Answer

Implementing a two-person rule for critical changes. The two-person rule requires two authorized individuals to perform a critical change, ensuring that no single person has both the authority and the ability to execute a high-risk action. This directly enforces separation of duties by dividing the task into two distinct roles, such as one person approving and another implementing the change, which prevents fraud or errors from a single compromised account.

Answer

Sharing administrative passwords among team members

Answer

Having the same person approve and implement a change

Question 7

An organization implements a policy that the same individual cannot both create a purchase order and approve it in the financial system. Which security principle does this control primarily enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from performing conflicting tasks, such as creating and approving a purchase order. By splitting these responsibilities, the organization reduces the risk of fraud, errors, and unauthorized transactions, ensuring that no single person has unchecked control over a critical financial process.

Answer

Job rotation

Answer

Least privilege

Answer

Need-to-know

Question 8

A company has 200 employees using a Windows Active Directory environment. The security administrator receives multiple alerts that user accounts are being locked out every 15 minutes. The help desk confirms that users who report the issue are able to log in successfully after unlocking their accounts, but they get locked out again shortly after. The administrator checks the domain controller security logs and sees many failed logon attempts with a specific service account name 'svc_backup' from multiple workstations. The svc_backup account is used for a backup application that runs scheduled tasks. What should the administrator do to resolve the issue?

Accepted Answer

Change the password for svc_backup and update the backup application with the new password. The repeated lockouts are caused by a service account (svc_backup) being used with an incorrect or expired password. The most effective solution is to reset the password for that account and update it in the backup application. Disabling the account or increasing the lockout threshold does not fix the root cause. Creating a new account without addressing the password mismatch will not stop the current account from being used.

Answer

Disable the svc_backup account until the backup vendor releases a patch

Answer

Create a new service account with a different name and grant it the same permissions

Answer

Increase the account lockout threshold to prevent lockouts

Question 9

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database by monitoring DHCP traffic on untrusted ports. By enabling DHCP snooping on the switch, only DHCP servers connected to trusted ports can assign IP addresses, preventing rogue DHCP server attacks.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 10

Which TWO of the following are primary purposes of a risk register?

Accepted Answer

Track the status of risk treatment plans. A risk register is a living document used to track the status of risk treatment plans, including whether controls have been implemented, are in progress, or are overdue. This ensures that risk owners are accountable and that residual risk is managed over time. Option B is correct because the primary function of a risk register is to document identified risks along with their characteristics, such as probability, impact, risk score, and owner. These two functions are core to the risk management process as defined by frameworks like NIST SP 800-37 and ISO 31000.

Answer

Record network traffic logs

Answer

Store vulnerability scan results

Answer

Provide a checklist for compliance audits

Question 11

A system administrator receives a report that a critical server is running low on disk space. After investigation, it is determined that the log files are not being rotated properly. Which of the following is the BEST solution to prevent this issue in the future?

Accepted Answer

Configure log rotation based on size and age.. Implementing log rotation policies ensures logs are archived and space is managed. Option B only adjusts size limit but doesn't rotate. Option C is for applications, not system logs. Option D does not reduce space usage.

Answer

Increase the maximum log file size.

Answer

Redirect logs to a different partition.

Answer

Enable compression on the log folder.

Question 12

Which TWO of the following are examples of preventive controls for data leakage?

Accepted Answer

Encryption.. Encryption is a preventive control because it renders data unreadable to unauthorized parties, thereby preventing data leakage even if the data is intercepted or accessed without authorization. By transforming plaintext into ciphertext using algorithms like AES-256, encryption ensures that only entities with the correct decryption key can access the original data, effectively blocking data exfiltration at rest or in transit.

Answer

Log monitoring.

Answer

Security awareness training.

Answer

User access reviews.

Question 13

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 14

A multinational company has a headquarters (HQ) and several branch offices connected via site-to-site IPsec VPN tunnels. The branch offices use a single internet connection and a VPN concentrator at HQ. Recently, users in the Asia branch report intermittent connectivity to the HQ file server, with high latency and occasional packet loss. The network team runs a traceroute from Asia branch to the HQ server; it shows the path goes through multiple hops with high latency at the second hop, which is the ISP router. The VPN tunnel status shows 'up' but with increasing rekey failures. The team has verified that the local internet link is stable and there are no bandwidth saturation issues. Which action should the team take first?

Accepted Answer

Review and adjust the IPsec tunnel lifetime and rekeying thresholds.. The symptoms—intermittent connectivity, high latency at the ISP router, and increasing rekey failures with the tunnel status 'up'—point to IPsec tunnel rekeying issues. Adjusting the IPsec tunnel lifetime and rekeying thresholds (Option C) directly addresses the root cause: the tunnel is attempting to renegotiate security associations (SAs) but failing, likely due to mismatched lifetimes or network delays during rekey. This is the first logical step before escalating to the ISP or changing encryption algorithms.

Answer

Upgrade the internet bandwidth at the Asia branch.

Answer

Change the tunnel to use a different encryption algorithm like AES-256.

Answer

Contact the ISP to check for routing issues.

Question 15

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman key exchange, ensuring that session keys cannot be derived if the server's private key is compromised later.

Answer

Reduced cipher suite options including CBC mode

Answer

Use of RC4 cipher

Answer

Support for static RSA key exchange