SSCP Practice Test 29 — 15 Questions

Question 1

Which protocol and port combination is commonly used for secure remote administration of a server?

Accepted Answer

SSH on TCP 22. SSH on TCP port 22 is the standard protocol for secure remote administration of Linux/Unix servers, providing encrypted authentication and session traffic. It replaces insecure protocols like Telnet and rlogin by encrypting the entire session, including credentials, using strong ciphers and key exchange.

Answer

HTTPS on TCP 443

Answer

Telnet on TCP 23

Answer

RDP on TCP 3389

Question 2

Which TWO actions are part of the containment phase of incident response?

Accepted Answer

Applying temporary patches. During the containment phase of incident response, the immediate priority is to stop the incident from spreading or causing further damage. Applying temporary patches (C) can quickly close a vulnerability that is being exploited, while isolating affected systems (D) prevents lateral movement and further compromise. Both actions are short-term measures to contain the threat before eradication and recovery begin.

Answer

Restoring from backups

Answer

Analyzing root cause

Answer

Preserving evidence

Question 3

Which TWO of the following are examples of biometric authentication? (Choose two.)

Accepted Answer

Retina scan. Retina scan is a biometric authentication method because it uses unique physiological characteristics of the eye's retinal blood vessel pattern to verify identity. Biometric authentication relies on measurable biological traits, and the retina's pattern is highly distinctive and difficult to replicate, making it a strong form of authentication.

Answer

Smart card

Answer

Answer

Password

Question 4

A small company with 50 employees uses a local file server for sharing documents. Each employee has a username and password for authentication. The company wants to implement an additional layer of security to protect sensitive data without incurring high costs. They are considering using smart cards or biometric scanners. However, the budget is limited, and employees often work remotely. Which of the following is the most cost-effective and practical approach to strengthen authentication?

Accepted Answer

Implement a one-time password (OTP) system via a mobile app.. A one-time password (OTP) system via a mobile app is the most cost-effective and practical approach because it adds a second factor (something the user has) without requiring additional hardware. It works remotely since employees can use their smartphones, and it is low-cost compared to smart cards or biometric scanners. It is also more secure than just increasing password complexity.

Answer

Increase password complexity requirements and enforce periodic changes.

Answer

Issue USB tokens to all employees.

Answer

Use Windows Hello facial recognition on company laptops.

Question 5

A company needs to encrypt large volumes of data at rest on a file server. Which type of cryptography is most appropriate for this task?

Accepted Answer

Symmetric encryption. Symmetric encryption uses a single shared key for both encryption and decryption, making it significantly faster and more efficient than asymmetric encryption for bulk data encryption. For large volumes of data at rest on a file server, symmetric algorithms like AES-256 provide the necessary performance and security, as they are designed to handle high-throughput encryption with minimal computational overhead.

Answer

Asymmetric encryption

Answer

Public Key Infrastructure (PKI)

Answer

Hash function

Question 6

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

Accepted Answer

MFA fatigue attack. MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Answer

Session hijacking

Answer

Man-in-the-middle (MITM) attack

Answer

Token theft from the endpoint

Question 7

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Accepted Answer

Check the server's running processes and established connections.. The first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Answer

Disconnect the server from the network.

Answer

Reboot the server to clear any malware.

Answer

Block the outbound traffic at the firewall.

Question 8

A company's policy requires that all data at rest be encrypted. Which of the following is the most effective method to encrypt files on a laptop?

Accepted Answer

Implement full disk encryption (FDE).. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, swap files, temporary files, and all user data. This ensures that if the laptop is lost or stolen, all data at rest is protected without relying on the user to selectively encrypt files or folders, which can leave sensitive data exposed in unencrypted system areas.

Answer

Encrypt only the user's home folder.

Answer

Encrypt individual files using a symmetric key.

Answer

Use a self-extracting encrypted archive.

Question 9

A security analyst receives an alert indicating a large number of failed login attempts from a single IP. The analyst blocks the IP. What should be done next?

Accepted Answer

Conduct a thorough investigation. Blocking an IP address is an immediate containment action, but it does not confirm the root cause or scope of the incident. A thorough investigation is required to determine whether the failed logins were part of a brute-force attack, credential stuffing, or a misconfigured service, and to check for indicators of compromise (IoCs) such as successful logins from the same IP or lateral movement. Without investigation, the analyst risks missing a broader breach or violating incident response procedures like those outlined in NIST SP 800-61.

Answer

Report to management

Answer

Update the firewall rules

Answer

Monitor for recurrence

Question 10

A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?

Accepted Answer

Stateful firewall. A stateful firewall tracks the state of active connections using a state table, so it can allow return traffic for an established session without an explicit inbound rule. This context-aware decision-making — matching packets to existing flows — is exactly what the requirement describes.

Answer

Stateless packet filter

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 11

An organization wants to ensure that only corporate-managed devices can connect to the internal network. Non-compliant devices should be placed in a restricted VLAN with limited access. Which technology should be deployed?

Accepted Answer

Network Access Control (NAC). NAC (Network Access Control) is purpose-built to enforce endpoint compliance before granting network access. It authenticates devices via 802.1X, MAC authentication bypass, or agent-based posture checks, and can dynamically assign non-compliant devices to a quarantine/restricted VLAN with limited ACLs. This matches the requirement of allowing only corporate-managed devices on the internal network while isolating others.

Answer

Virtual Private Network (VPN)

Answer

Stateful firewall

Answer

Intrusion Prevention System (IPS)

Question 12

Which wireless security standard introduced the Simultaneous Authentication of Equals (SAE) handshake to replace the pre-shared key (PSK) method?

Accepted Answer

WPA3. WPA3 replaced WPA2's PSK with SAE, which provides forward secrecy and is resistant to offline dictionary attacks.

Answer

802.11i

Answer

WEP

Answer

WPA2

Question 13

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

Accepted Answer

If user.department == 'HR' AND doc.classification == 'Confidential' AND time.business_hours == true then permit read.. ABAC (Attribute-Based Access Control) evaluates policies built from multiple attributes — user, resource, action, and environment — combined with Boolean logic. The rule 'user.department == HR AND doc.classification == Confidential AND time.business_hours == true then permit read' explicitly combines a subject attribute (department), a resource attribute (classification), and an environmental attribute (time of day), which is the defining characteristic of an ABAC policy. NIST SP 800-162 defines ABAC as evaluating attributes of the subject, object, operation, and environment to make access decisions.

Answer

The owner of a document can grant read access to any other user.

Answer

Users in the 'HR' role can read documents classified as 'Confidential'.

Answer

All users with security clearance 'Secret' can read documents labeled 'Secret'.

Question 14

A certificate authority (CA) issues a certificate with the extended key usage (EKU) extension specifying 'serverAuth'. Which of the following is this certificate allowed to do?

Accepted Answer

Authenticate a TLS server. The Extended Key Usage (EKU) extension specifies the intended purpose of a certificate. The 'serverAuth' OID (1.3.6.1.5.5.7.3.1) explicitly permits the certificate to be used for authenticating a TLS server during the SSL/TLS handshake, such as in HTTPS. This is defined in RFC 5280 and is enforced by TLS clients to ensure the certificate is used only for its designated purpose.

Answer

Encrypt email

Answer

Sign code

Answer

Issue subordinate CA certificates

Question 15

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). A password combined with a one-time code generated by a mobile app is the textbook definition of Time-based One-Time Password (TOTP), where the code is derived from a shared secret and the current time (typically 30-second windows, per RFC 6238). This is a form of multi-factor authentication combining something you know (password) with something you have (the app/device).

Answer

Smart card

Answer

Hardware token

Answer

Biometrics