SSCP Practice Test 27 — 15 Questions

Question 1

A security team is implementing a risk treatment plan for a high-risk vulnerability. The cost to fix the vulnerability is $100,000, but the expected loss if exploited is $1,000,000. The annual likelihood of exploitation is 2%. Which risk treatment strategy is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accept the risk and monitor for changes. The annualized loss expectancy (ALE) is $20,000 (2% × $1,000,000), which is less than the $100,000 remediation cost. Since the cost to fix exceeds the expected loss, accepting the risk and monitoring for changes is the most cost-effective strategy. This aligns with the risk management principle that treatment should be proportional to the risk exposure.

Answer

Avoid the risk by decommissioning the asset

Answer

Remediate the vulnerability immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 2

A company is deploying virtual machines (VMs) in a private cloud environment. To prevent VM escape attacks, which of the following is the most critical security control?

Accepted Answer

Regularly patching the hypervisor software. Regularly patching the hypervisor software is the most critical control to prevent VM escape attacks because these attacks typically exploit vulnerabilities in the hypervisor itself. Keeping the hypervisor up to date ensures that known security flaws are remediated, reducing the attack surface. While other controls add defense in depth, patching directly addresses the root cause of most escape vulnerabilities.

Answer

Using a separate management network for the hypervisor

Answer

Disabling unnecessary VM guest tools

Answer

Implementing a host-based firewall on each VM

Question 3

Which THREE of the following are common methods for implementing multifactor authentication (MFA)?

Accepted Answer

Password and SMS code. Option B (Password and SMS code) is correct because it combines something you know (a password) with something you have (a one-time code delivered to your registered phone), which are two distinct authentication factors. Option C (Smart card and PIN) is correct because it pairs something you have (the smart card) with something you know (the PIN), satisfying MFA's requirement for different factor types. Option E (Fingerprint and smart card) is correct because it combines something you are (a biometric fingerprint) with something you have (the smart card), again using two separate factor categories. Option A is not correct because a retina scan and facial recognition are both inherence (biometric) factors, so they represent the same factor type rather than multifactor authentication. Option D is not correct because a password and a security question are both knowledge-based factors, so they do not constitute true MFA.

Answer

Retina scan and facial recognition

Answer

Password and security question

Question 4

An analyst detects outbound traffic from a workstation to a known malicious IP address. The workstation is a developer machine with local admin rights. Which containment action should be taken first?

Accepted Answer

Isolate the workstation from the network. Isolating the workstation from the network is the correct first containment step because it stops any further command-and-control communication, lateral movement, or data exfiltration while preserving volatile memory and forensic artifacts for investigation. A developer machine with local admin rights is especially dangerous — the attacker could pivot, install persistence, or harvest credentials — so cutting network connectivity immediately limits blast radius without destroying evidence.

Answer

Block the malicious IP on the firewall

Answer

Shut down the workstation immediately

Answer

Disable the user's domain account

Question 5

Which of the following network protocols operates on TCP port 22 and provides secure remote administration of network devices?

Accepted Answer

SSH. SSH (Secure Shell) operates on TCP port 22 and provides encrypted remote administration of network devices, replacing insecure protocols like Telnet. It uses strong cryptography for authentication and session confidentiality, making it the standard for secure CLI management of routers, switches, and servers.

Answer

Telnet

Answer

RDP

Answer

FTP

Question 6

A security team is implementing a PKI for a large enterprise. Which TWO of the following are commonly used methods for certificate revocation checking? (Select TWO.)

Accepted Answer

Online Certificate Status Protocol (OCSP). Option B, Online Certificate Status Protocol (OCSP), is correct because it is a standard protocol defined in RFC 6960 that allows a client to query a dedicated OCSP responder in real time to determine whether a specific certificate has been revoked, returning a status of good, revoked, or unknown. Option C, Certificate Revocation List (CRL), is correct because it is a signed list published by the Certificate Authority (typically distributed via HTTP, LDAP, or FTP at the CDP extension URL) that enumerates the serial numbers of certificates that have been revoked before their expiration date. The remaining options are not revocation-checking methods: a Certificate Signing Request (A) is a message sent to a CA to request issuance of a certificate, Key Escrow (D) is the practice of storing private keys with a third party for recovery purposes, and the Digital Signature Algorithm (E) is a signing algorithm used to create and verify digital signatures, not to check revocation status.

Answer

Certificate Signing Request (CSR)

Answer

Key Escrow

Answer

Digital Signature Algorithm (DSA)

Question 7

Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP (Online Certificate Status Protocol) lets a client query a responder in real time for the revocation status of a specific certificate, returning 'good,' 'revoked,' or 'unknown' without downloading the entire CRL. It is defined in RFC 6960 and is the standard real-time alternative to CRLs. This matches the requirement exactly.

Answer

Certificate Revocation List (CRL)

Answer

Self-signed certificate validation

Answer

Certificate Transparency (CT)

Question 8

Which THREE of the following are security features of WPA3 compared to WPA2? (Select THREE)

Accepted Answer

Protected Management Frames (PMF) mandatory. Option B is correct because WPA3 mandates Protected Management Frames (PMF, defined in 802.11w), which cryptographically protect management frames such as deauthentication and disassociation, preventing forgery and denial-of-service attacks that were possible under WPA2 where PMF was optional. Option C is correct because WPA3-Enterprise offers an optional 192-bit security suite aligned with CNSA guidance, using stronger cryptographic algorithms (GCMP-256, HMAC-SHA-384, ECDHE with a 384-bit curve) that WPA2-Enterprise did not provide. Option D is correct because WPA3 replaces the WPA2 Pre-Shared Key handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that provides forward secrecy and resists offline dictionary attacks against captured handshakes. Option A is incorrect because WPA3 does not support backward compatibility with WEP, a deprecated and broken encryption protocol; WPA3 requires modern ciphers such as CCMP-128 or GCMP-256. Option E is incorrect because TKIP is a legacy, deprecated encryption protocol from WPA/WPA2 and is not used by WPA3, which relies on AES-based CCMP and GCMP instead.

Answer

Backward compatibility with WEP

Answer

Use of TKIP encryption

Question 9

A company wants to ensure that employees connecting from home use a secure tunnel to access internal resources. Which protocol should be implemented?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN creates an encrypted tunnel over HTTPS (port 443) between the remote user's browser or client and the corporate VPN gateway, securing all traffic to internal resources. This is the standard solution for remote access VPNs because it uses ubiquitous SSL/TLS protocols, avoids the need for IPsec client software, and can traverse firewalls and NAT devices easily.

Answer

SFTP

Answer

Telnet

Answer

SSH

Question 10

Which THREE of the following are key objectives of data classification?

Accepted Answer

Identify and protect sensitive information. Data classification is the process of assigning data to categories (e.g., public, internal, confidential, restricted) based on sensitivity and value, so option A is correct because its primary purpose is to identify sensitive information and apply proportionate protection controls. Option C is correct because classification results feed directly into risk management: you cannot assess likelihood and impact, or select appropriate safeguards, without knowing which data is sensitive and how it must be handled. Option E is correct because many legal and regulatory frameworks (e.g., GDPR, HIPAA, PCI DSS) require organizations to know where regulated data resides and to protect it accordingly, making compliance a key driver of classification. Option B is not a classification objective — deduplication and storage optimization are data management/storage efficiency techniques, not sensitivity-based categorization. Option D is not a classification objective either; selecting a specific encryption algorithm is a technical control decision made after classification, not the goal of classifying data.

Answer

Reduce storage costs by identifying duplicate data

Answer

Determine the encryption algorithm to use

Question 11

A network administrator notices that wireless users are experiencing intermittent connectivity. The controller shows excessive deauthentication frames. What is the most likely cause?

Accepted Answer

Rogue access point performing a deauthentication attack. Excessive deauthentication frames are a hallmark of a deauthentication attack, where a rogue access point sends forged 802.11 management frames to disconnect clients. This causes intermittent connectivity as clients repeatedly lose association and attempt to reconnect. The controller logs these frames as a clear indicator of an active attack.

Answer

Channel interference

Answer

Power save mode

Answer

DHCP server exhaustion

Answer

Weak encryption

Question 12

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 13

An organization is implementing 802.1X authentication for wired network access. Which server is required to authenticate users?

Accepted Answer

RADIUS server. 802.1X is a port-based network access control protocol that uses the Extensible Authentication Protocol (EAP) to authenticate devices before granting network access. The authentication server in an 802.1X deployment must be a RADIUS server, as defined in IEEE 802.1X-2020, because it acts as the backend that validates credentials and communicates with the authenticator (switch) via RADIUS (RFC 2865).

Answer

DHCP server

Answer

TACACS+ server

Answer

Kerberos server

Question 14

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Accepted Answer

Implement DNSSEC to validate DNS responses. Option A (Implement DNSSEC to validate DNS responses) is correct because DNSSEC adds cryptographic signatures (RRSIG) to DNS records so a resolver can verify authenticity and integrity, preventing forged or spoofed records from being accepted during a poisoning attack. Option D (Use secure DNS resolvers that enforce DNSSEC validation) is correct because even with DNSSEC deployed, the resolver must actually perform validation of the chain of trust (via DS/DNSKEY records) to reject bogus answers; resolvers that enforce validation stop poisoned data from reaching clients. Option B is wrong because blocking UDP port 53 would break legitimate DNS resolution entirely rather than prevent poisoning. Option C is wrong because disabling recursion on authoritative servers is a general hardening practice but does not by itself prevent cache poisoning of recursive resolvers. Option E is wrong because DHCP snooping protects against rogue DHCP servers and Layer 2 attacks, not DNS cache poisoning.

Answer

Configure firewall rules to block UDP port 53

Answer

Disable DNS recursion on authoritative servers

Answer

Enable DHCP snooping on switches

Question 15

A security analyst is investigating a potential data exfiltration incident. The logs show a large number of outbound DNS queries to a domain that resolves to an IP address in a foreign country. The queries contain encoded strings in the subdomain. Which type of attack is MOST likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses to bypass network security controls. The large volume of outbound queries to a foreign IP, combined with encoded subdomain strings, is the classic signature of data exfiltration via DNS tunneling, as the protocol is often allowed through firewalls.

Answer

DNS poisoning

Answer

DNS amplification attack

Answer

DNS rebinding