SSCP Practice Test 28 — 15 Questions

Question 1

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Accepted Answer

User attempts to access a database at 2:00 AM, which is outside their normal pattern. User Behavior Analytics (UBA) establishes a baseline of normal user activity, including typical login times, locations, and access patterns. An attempt to access a database at 2:00 AM, which falls outside the user's established temporal baseline, represents a significant deviation that UBA algorithms flag as anomalous. This behavior is a classic indicator of a compromised account, as attackers often operate during off-hours to avoid detection.

Answer

User receives a large number of emails

Answer

User logs in from a recognized corporate device

Answer

User accesses the same files as usual during business hours

Question 2

Which of the following OWASP Top 10 vulnerabilities involves an attacker sending malicious data to an interpreter as part of a command or query?

Accepted Answer

Injection. Injection is the OWASP Top 10 category that directly involves an attacker sending malicious data to an interpreter as part of a command or query. This occurs when untrusted data is concatenated into a command or query without proper validation or parameterization, allowing the attacker to alter the intended execution. Examples include SQL injection, OS command injection, and LDAP injection, where the interpreter executes the attacker's injected commands. The core reasoning is that the vulnerability arises from the lack of separation between data and code, enabling the attacker to control the interpreter's behavior.

Answer

Security Misconfiguration

Answer

Broken Authentication

Answer

Cross-Site Scripting (XSS)

Question 3

During a full interruption test of the disaster recovery plan, which of the following is the PRIMARY risk?

Accepted Answer

Extended downtime or data loss if the plan fails. A full interruption test simulates a complete disaster by actually shutting down the primary site and failing over to the recovery site. The primary risk is that if the recovery plan fails, the organization may experience extended downtime or data loss because the production environment is already down and cannot be quickly restored. This directly impacts business continuity and is the most severe consequence.

Answer

Vendor unavailability during the test

Answer

Employee confusion about their roles

Answer

Cost overruns due to overtime pay

Question 4

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

Accepted Answer

Creating user accounts in the identity store. Option A is correct because provisioning begins with creating the user account (identity) in the identity store, such as an LDAP directory or IdP, so the user has a unique identity to authenticate with. Option D is correct because provisioning also includes granting the initial entitlements — assigning the baseline role memberships and permissions the user needs on day one. Option B is not part of provisioning; modifying roles after a job change is a re-provisioning/change (mover) activity in the lifecycle. Option C is not part of provisioning; archiving user data for compliance belongs to the deprovisioning/retention phase. Option E is not part of provisioning; disabling accounts on termination is a deprovisioning (leaver) activity.

Answer

Modifying user roles due to job change

Answer

Archiving user data for compliance

Answer

Disabling accounts upon termination

Question 5

What is the minimum recommended RSA key size for secure use as of current best practices?

Accepted Answer

2048 bits. (2048 bits) is correct because current best practices, as recommended by NIST SP 800-57 and other cryptographic standards, consider 2048-bit RSA keys as the minimum secure size for protecting data through 2030. This key length provides a sufficient security margin against known factoring attacks, balancing computational efficiency with cryptographic strength.

Answer

1024 bits

Answer

4096 bits

Answer

3072 bits

Question 6

A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?

Accepted Answer

Edit the /etc/sudoers file to restrict sudo access. The /etc/sudoers file defines which users and groups may run which commands with elevated privileges via sudo. Restricting sudo access by editing this file (preferably with visudo) ensures that only authorized users can execute commands as root or another privileged account. This directly satisfies the requirement to control who can execute commands with elevated privileges.

Answer

Enable auditd to log all commands

Answer

Configure PAM to enforce password complexity

Answer

Set the setuid bit on critical binaries

Question 7

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Accepted Answer

TCP port 443. HTTPS (HTTP over TLS) uses TCP as its transport protocol because it requires reliable, connection-oriented delivery for secure web traffic. The default port for HTTPS is 443, as defined in RFC 2818. Therefore, allowing TCP port 443 is the correct firewall rule.

Answer

UDP port 80

Answer

UDP port 443

Answer

TCP port 80

Question 8

An organization has implemented a SIEM solution and wants to reduce false positives. Which of the following is the most effective approach?

Accepted Answer

Tune correlation rules to exclude known benign activities. The most effective way to reduce false positives in a SIEM is to tune correlation rules so they exclude known benign activities. False positives occur when rules trigger on legitimate behavior; by refining rule logic (whitelisting trusted IPs, excluding scheduled tasks, adjusting thresholds based on baselines), analysts reduce noise without losing detection of real threats. This is the standard SIEM tuning approach.

Answer

Increase the number of log sources feeding the SIEM

Answer

Raise the threshold for each correlation rule to reduce alerts

Answer

Assign more analysts to manually review all alerts

Question 9

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

Accepted Answer

Application whitelisting. Application whitelisting is the correct control because it explicitly defines a list of approved software that is allowed to execute on workstations. This prevents unauthorized or malicious software from running, even if it bypasses other defenses, by enforcing a default-deny policy at the operating system level (e.g., via Windows AppLocker or Software Restriction Policies). Unlike antivirus, which relies on signatures to detect known threats, whitelisting blocks unknown or unapproved executables by default.

Answer

Antivirus software

Answer

Patch management

Answer

Host-based firewall

Question 10

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

Accepted Answer

Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.. Forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Answer

Boot the suspect system and use imaging software to copy data.

Answer

Remove the drive and place it in anti-static bag, then ship to lab.

Answer

Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.

Question 11

A company detects ransomware on a file server. The ransomware is currently encrypting files. Which containment strategy should be implemented FIRST?

Accepted Answer

Disconnect the server from the network. The immediate priority in ransomware containment is to isolate the compromised server from the network to prevent the encryption process from spreading to other systems. Disconnecting the network cable or disabling the network interface stops the ransomware from communicating with command-and-control servers and blocks lateral movement via SMB or other protocols. This containment step must occur before any remediation like antivirus scans or file restoration.

Answer

Run antivirus to remove the ransomware

Answer

Notify all users to change passwords

Answer

Restore files from backup

Question 12

In which access control model does the owner of a resource have full discretion over who can access it and with what permissions?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the model where the resource owner has full authority to grant or deny access to other subjects and to set the permissions (e.g., read, write, execute) on the object. This is typically implemented through Access Control Lists (ACLs) on files or objects, as seen in Windows NTFS or Linux file permissions, where the owner can change permissions using commands like `chmod` or through GUI properties.

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Question 13

A security professional is implementing a solution to verify the authenticity of a digital certificate. Which component of a PKI is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority (CA). The Certificate Authority (CA) is the core component of a Public Key Infrastructure (PKI) responsible for issuing digital certificates and, crucially, for revoking them when they are no longer trusted. While other components support certificate status checking or verification, only the CA has the authority to sign and publish certificates or revocation information.

Answer

Online Certificate Status Protocol (OCSP) responder

Answer

Certificate Revocation List (CRL)

Answer

Registration Authority (RA)

Question 14

What is the analyst's BEST next step?

Accepted Answer

Decode the command to analyze. When an analyst encounters a suspicious PowerShell command — typically from a script block log (Event ID 4104), a command-line audit event, or an EDR alert — the encoded payload is usually Base64-encoded and unreadable at a glance. Decoding it (e.g., via CyberChef, PowerShell's [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(...)), or tools like PowerDecode) reveals the actual commands, URLs, and IOCs, which is essential before deciding on containment. You cannot make an informed containment or eradication decision without first understanding what the command does.

Answer

Isolate the system

Answer

Block PowerShell execution

Answer

Run a full antivirus scan

Question 15

A company wants to deploy a network IDS that can analyze traffic patterns and detect anomalies. Where should the IDS sensor be placed to monitor all traffic on a network segment without introducing latency?

Accepted Answer

Connected to a switch SPAN port. A SPAN (Switched Port Analyzer) port mirrors traffic from one or more switch ports or VLANs to a dedicated monitoring port, allowing the IDS sensor to receive a copy of the traffic passively. Because the sensor is not in the forwarding path, it introduces zero latency to production traffic while still seeing all frames on the monitored segment. This is the canonical out-of-band IDS deployment.

Answer

Inline between the router and the switch

Answer

At the core switch as a transparent bridge

Answer

On the same segment as the router