SSCP Practice Test 27 — 15 Questions

Question 1

Which of the following is a primary function of a firewall?

Accepted Answer

Filter traffic based on rules. A firewall's primary function is to filter network traffic based on a defined set of security rules, such as source/destination IP addresses, ports, and protocols. It operates at the network layer (or higher) to permit or deny packets, acting as a barrier between trusted and untrusted networks. This rule-based filtering is the core mechanism that enforces access control policies.

Answer

Assign IP addresses

Answer

Encrypt network traffic

Answer

Detect malware on endpoints

Question 2

Which TWO factors are most critical when selecting a cryptographic algorithm for a government application?

Accepted Answer

Key length. For government applications, regulatory compliance (e.g., FIPS 140-2) is critical because it mandates that cryptographic modules meet specific security standards for protecting sensitive data. Key length is equally critical because it directly determines the algorithm's resistance to brute-force attacks; insufficient key length can render encryption ineffective regardless of other factors.

Answer

Speed of encryption/decryption

Answer

Algorithm popularity

Answer

Ease of implementation

Question 3

A network administrator is implementing segmentation to limit the spread of malware. Which two technologies can achieve network segmentation? (Choose two.)

Accepted Answer

Firewalls. Firewalls are correct because they can enforce network segmentation by controlling traffic between network segments based on security policies. By placing firewalls at segment boundaries, administrators can filter traffic using rules that inspect source/destination IP addresses, ports, and application-layer data, thereby limiting the lateral spread of malware.

Answer

VPN

Answer

NAT

Answer

Subnetting

Question 4

An organization wants to protect endpoints from ransomware that encrypts files and demands payment. Which control should be implemented FIRST?

Accepted Answer

Implement application whitelisting. Application whitelisting blocks unauthorized executables, including ransomware, from running. Option A is wrong because email filtering can reduce but not block all ransomware delivery. Option C is wrong because user training is important but not a technical control that immediately prevents execution. Option D is wrong because backups help recovery but do not prevent infection.

Answer

Deploy email spam filtering

Answer

Conduct user security awareness training

Answer

Enable file-level backup to a separate location

Question 5

An organization wants to allow secure remote access for employees. Which protocol is most appropriate for a site-to-site VPN?

Accepted Answer

IPsec. IPsec is the correct choice for a site-to-site VPN because it operates at the network layer (Layer 3), providing encryption and authentication for all IP traffic between two entire networks. It supports both tunnel and transport modes, and uses protocols like ESP (Encapsulating Security Payload) and AH (Authentication Header) to ensure confidentiality, integrity, and origin authentication, making it the standard for permanent site-to-site connections.

Answer

PPTP

Answer

SSL/TLS

Answer

SSH

Answer

L2TP

Question 6

Which of the following is a key principle of the 3-2-1 backup rule?

Accepted Answer

Three copies on two different media types with one offsite. The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

Answer

Two copies on three different media types with one onsite

Answer

One copy on two different media types with three offsite

Answer

Three copies on three different media types with two offsite

Question 7

An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?

Accepted Answer

The user's new role inherits permissions from multiple roles that collectively grant access.. In RBAC, permissions are assigned to roles, not directly to users. When a user's role changes, the new role may have a different set of permissions. If the new role inherits permissions from multiple roles (e.g., through role hierarchy or composite roles), it can collectively grant access to resources that were previously denied under the old role. This is the most likely cause because the security administrator confirmed the role change, and RBAC systems typically enforce permissions based on the current role membership.

Answer

The user's previous role was not properly removed.

Answer

The RBAC implementation has a bug that grants excessive permissions.

Answer

The user was directly assigned permissions to the resource.

Question 8

A company wants to ensure that employees connecting from home use a secure tunnel to access internal resources. Which protocol should be implemented?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN creates an encrypted tunnel over HTTPS (port 443) between the remote user's browser or client and the corporate VPN gateway, securing all traffic to internal resources. This is the standard solution for remote access VPNs because it uses ubiquitous SSL/TLS protocols, avoids the need for IPsec client software, and can traverse firewalls and NAT devices easily.

Answer

SFTP

Answer

Telnet

Answer

SSH

Question 9

A critical vulnerability with a CVSS score of 9.8 is discovered in a web server that cannot be patched due to vendor dependency. What is the best compensating control?

Accepted Answer

Apply a virtual patch via a WAF. A WAF can apply a virtual patch by inspecting HTTP/HTTPS traffic and blocking exploit attempts against the unpatched vulnerability. This provides a compensating control at the application layer without modifying the vulnerable server, allowing the server to remain operational while mitigating the risk.

Answer

Increase the frequency of vulnerability scans

Answer

Decommission the server immediately

Answer

Disable the server's network connectivity

Question 10

A company implements a policy that requires all employees to change their passwords every 60 days. Which of the following is the PRIMARY security benefit of this requirement?

Accepted Answer

Limiting the window of opportunity for a compromised password.. Password expiration policies limit the exposure window for compromised credentials. If an attacker obtains a password, the 60-day rotation ensures that the stolen credential becomes invalid after that period, reducing the time an attacker can maintain unauthorized access. This is a fundamental security control to mitigate the risk of undetected credential theft.

Answer

Ensuring compliance with data privacy laws.

Answer

Reducing the risk of password reuse across multiple sites.

Answer

Simplifying the account lockout process.

Question 11

A network engineer configures a VLAN hopping attack prevention by setting all unused switch ports to an unused VLAN and disabling trunking. What vulnerability is being mitigated?

Accepted Answer

DTP spoofing. DTP spoofing is the correct answer because VLAN hopping attacks often exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between a switch and an attacker's device, allowing the attacker to send and receive traffic on multiple VLANs. By disabling trunking on all unused ports and assigning them to an unused VLAN, the switch will not respond to DTP negotiation requests, preventing unauthorized trunk establishment.

Answer

STP manipulation

Answer

ARP spoofing

Answer

MAC flooding

Answer

DHCP starvation

Question 12

During a penetration test, the tester captures traffic on a switch port that is part of a VLAN other than the native VLAN. The tester is able to receive traffic destined for the management VLAN. What configuration flaw is exploited?

Accepted Answer

Trunk port misconfiguration with native VLAN mismatch. The scenario describes a native VLAN mismatch on a trunk port. When two switches have different native VLANs configured on a trunk, they will not tag frames for their respective native VLANs. This allows an attacker on a non-native VLAN to receive traffic destined for the management VLAN (typically VLAN 1) by sending frames with no 802.1Q tag, which the receiving switch treats as belonging to its own native VLAN, effectively bypassing VLAN segmentation.

Answer

Spanning tree protocol is enabled

Answer

Port security is not enabled

Answer

DHCP snooping is disabled

Answer

VLAN trunking protocol (VTP) is set to transparent mode

Question 13

An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?

Accepted Answer

Network Access Control (NAC) with 802.1X. Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Firewall rules

Question 14

A security team is collecting evidence from a compromised server. They need to create a forensic image. Which of the following is the CORRECT procedure to ensure data integrity?

Accepted Answer

Use a write blocker to create a bit-for-bit copy, then compute MD5 hash of the original and the copy to verify they match. Forensic imaging requires a write blocker to prevent any modification to the original evidence, and a bit-for-bit copy preserves all data, including slack space and deleted files. Computing an MD5 hash of both the original and the copy verifies integrity by ensuring the hashes match, confirming no data alteration occurred during acquisition.

Answer

Take a photo of the screen and document file timestamps manually

Answer

Create a compressed image file using software without a write blocker

Answer

Boot the system and run a backup utility to copy files to an external drive

Question 15

Which THREE of the following are common types of network attacks?

Accepted Answer

ARP spoofing. ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Answer

Pharming

Answer

SQL injection