SSCP Practice Test 28 — 15 Questions

Question 1

Which TWO of the following are best practices for password management?

Accepted Answer

Implement account lockout after a few failed attempts. Password complexity and account lockout are standard best practices. Storing passwords in plaintext and reusing passwords are poor practices.

Answer

Allow reuse of the last 5 passwords

Answer

Store passwords in plaintext for quick recovery

Answer

Share passwords via email for convenience

Question 2

A security analyst notices that a user’s account has been used to access sensitive files at 3:00 AM from an IP address outside the company’s country. The analyst suspects a compromised account. Which action should be taken FIRST?

Accepted Answer

Disable the user account immediately. The first step in incident response is to isolate the threat. Disabling the account prevents further unauthorized access while the investigation proceeds.

Answer

Block the external IP address in the firewall

Answer

Reset the user’s password and force a logout

Answer

Contact the user to verify if they were working late

Question 3

An organization wants to ensure that a software update has not been tampered with during download. Which cryptographic technique should be used?

Accepted Answer

Sign the update with the developer's private key. Signing the update with the developer's private key provides both integrity and authenticity. When the user verifies the signature using the developer's public key, they can confirm that the update has not been tampered with and that it originated from the claimed developer. This is the standard approach for ensuring trust in software distribution, as used in code signing certificates (e.g., Authenticode, GPG).

Answer

Compute a SHA-256 hash of the update

Answer

Encrypt the update with AES

Answer

Append a MAC (Message Authentication Code)

Question 4

What is the analyst's BEST next step?

Accepted Answer

Decode the command to analyze. Decoding the encoded PowerShell command will reveal the payload. Option A is premature without understanding the threat. Option B is less helpful. Option D may break legitimate functionality.

Answer

Isolate the system

Answer

Block PowerShell execution

Answer

Run a full antivirus scan

Question 5

Which THREE activities are part of the post-incident phase?

Accepted Answer

Lessons learned meeting. Options A, B, and E are correct. Lessons learned meetings, conducting root cause analysis, and updating the incident response plan are key post-incident activities. Reimaging computers (D) is part of the eradication phase, and notifying affected customers (C) typically occurs during the containment and response phase, not post-incident.

Answer

Notify affected customers

Answer

Reimage infected computers

Question 6

A security administrator is configuring a firewall to allow HTTPS traffic from the internet to a web server. Which default port must be permitted?

Accepted Answer

443. HTTPS uses port 443 by default. Port 80 is HTTP, 8080 is common HTTP alternative, and 8443 is HTTPS alternative but not default.

Answer

8443

Answer

8080

Answer

80

Question 7

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Accepted Answer

Risk mitigation. Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 8

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Accepted Answer

Risk mitigation by blocking the IP address. Blocking the IP address is immediate risk mitigation that stops the ongoing attack. Option B is wrong because changing all passwords is a more disruptive and time-consuming remediation step, not the immediate first response. Option C is wrong because risk transfer (e.g., cyber insurance) does not stop the active threat. Option D is wrong because risk acceptance is not appropriate when an active threat is present.

Answer

Risk remediation by changing all user passwords

Answer

Risk transfer

Answer

Risk acceptance

Question 9

A company has a policy requiring segregation of duties (SoD) for financial transactions. Which scenario represents a violation of this principle?

Accepted Answer

The finance officer approves invoices and also reconciles the bank statements. It violates segregation of duties: the same person both approves invoices (authorization) and reconciles bank statements (review/monitoring), combining incompatible duties that could allow fraud or error to go undetected. Option A is not a violation because backup and audit log review are separate functions typically performed by different roles. Option C is not a violation; requiring two approvals for large expenditures is a control to enforce dual authorization, not a violation of SoD. Option D maintains separation because the purchasing manager creates orders (initiation) and the accounts payable clerk processes payments (execution), with oversight.

Answer

The system administrator performs backups, and the security officer reviews audit logs

Answer

Two managers must each approve any expenditure over $10,000

Answer

The purchasing manager creates purchase orders, and the accounts payable clerk processes payments

Question 10

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Recovery Time Objective (RTO). Options A and B are correct. Recovery Time Objective (RTO) defines the maximum acceptable downtime, and Recovery Point Objective (RPO) defines the maximum acceptable data loss. Option C (Business Continuity Plan) is related but broader and not specifically a DRP component. Option D (RACI matrix) is for responsibility assignment, not a core DRP component. Option E (penetration test results) is a security assessment, not a DRP component.

Answer

Business Continuity Plan (BCP)

Answer

A RACI matrix for incident response

Answer

Results of a penetration test

Question 11

A security administrator needs to set file permissions on a shared folder so that only members of the 'Finance' group can read and write to it. All existing permissions should be removed. Which command should the administrator use?

Accepted Answer

icacls shared_folder /grant Finance:(M) /inheritance:r. 'icacls shared_folder /grant Finance:(M) /inheritance:r' grants Modify (which includes read and write) and removes inheritance, effectively replacing all existing permissions. Option A is wrong because 'cacls' is deprecated and the syntax '/E /P' is incorrect for this requirement. Option B is wrong because Full Control (F) grants more than read and write. Option D is wrong because (RW) is not a valid icacls permission mask; the correct mask for read/write is (M) for Modify.

Answer

cacls shared_folder /E /P Finance:RW

Answer

icacls shared_folder /grant Finance:(F) /inheritance:r

Answer

icacls shared_folder /grant Finance:(RW)

Question 12

Which THREE of the following are types of application security testing that should be included in a secure SDLC?

Accepted Answer

Static application security testing (SAST). Options A, B, and D are correct. SAST analyzes source code for vulnerabilities, DAST tests running applications, and penetration testing simulates real attacks. Option C (UAT) is for functional validation, not security. Option E (load testing) is for performance, not security.

Answer

User acceptance testing (UAT)

Answer

Load testing

Question 13

An organization uses AWS IAM to manage access. Which best practice ensures least privilege?

Accepted Answer

Create individual users and assign only necessary permissions. Creating individual users with only necessary permissions enforces least privilege. Using root account is dangerous. Shared accounts violate accountability. Granting full S3 access is excessive.

Answer

Use a single shared admin account

Answer

Use root account for administrative tasks

Answer

Grant all users full access to S3 buckets

Question 14

Refer to the exhibit. A web server log shows two requests from the same IP. What type of attack is being attempted, and which mitigation is MOST effective?

Accepted Answer

SQL injection; use parameterized queries. The requests contain SQL injection patterns (OR 1=1 and DROP TABLE). Parameterized queries prevent SQL injection. Option B is wrong because XSS would involve script tags. Option C is wrong because CSRF would involve a different method and referrer. Option D is wrong because command injection would involve shell commands.

Answer

Cross-site scripting (XSS); encode all output

Answer

Cross-site request forgery (CSRF); use anti-CSRF tokens

Answer

Command injection; implement input validation

Question 15

A company wants to prevent unauthorized applications from running on employee workstations. Which of the following is the most effective control?

Accepted Answer

Application whitelisting. Application whitelisting allows only approved executables to run, effectively preventing unauthorized applications. Host-based intrusion detection can detect but not prevent. Antivirus relies on signatures and may miss unknown malware. User training is important but not a technical control.

Answer

User training

Answer

Regular antivirus updates

Answer

Host-based intrusion detection system