SSCP Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. A firewall log shows repeated outbound connection attempts from an internal workstation (192.168.1.50) to an external IP (203.0.113.50) on TCP port 445. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A worm or malware exploiting SMB. Port 445 is SMB. Outbound SMB attempts often indicate a worm or malware trying to propagate. Web browsing uses 80/443. File sharing is typically internal. DNS uses 53.

Answer

A misconfigured DNS client

Answer

A user browsing the web

Answer

A legitimate file share connection

Question 2

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

Accepted Answer

Classify the incident and determine if escalation is needed.. During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Answer

Immediately disconnect the user's workstation from the network.

Answer

Rebuild the user's workstation from a known-good image.

Answer

Ignore the event as it may be a false positive.

Question 3

A medium-sized e-commerce company uses a SIEM with correlation rules. During peak sales hours, the SIEM generates an alert: multiple failed login attempts from internal IP 172.16.10.50 followed by a successful login to a critical database server. The account used is 'dbadmin', which normally only authenticates from the IT department subnet. The user 'dbadmin' reports that they had to try several passwords because they forgot theirs earlier. The incident responder is under pressure to quickly restore normal operations. Which course of action should the responder take?

Accepted Answer

Investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP.. While the user's explanation seems plausible, the alert indicates a deviation from normal behavior (logins from an unexpected subnet). The responder should investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP to rule out a potential compromise. Option A (blocking the user's account immediately) could be disruptive if it's a false positive and may prevent legitimate access. Option B (resetting password and enabling MFA) is a good security measure but does not address the need to verify whether the account was actually compromised or if there is ongoing malicious activity. Option C (dismissing the alert as a false positive) is premature and ignores the possibility of credential stuffing or account takeover. Therefore, investigating further is the most appropriate course of action.

Answer

Block the user's account immediately to prevent any further access.

Answer

Reset the user's password and enable multi-factor authentication (MFA).

Answer

Dismiss the alert as a false positive since the user explained the failed attempts.

Question 4

Based on the exhibit, which conclusion is most likely?

Accepted Answer

Two hosts are consistently downloading malware.. Two internal hosts (192.168.1.10 and .20) repeatedly download an executable from a known malware domain. The HTTP status 200 indicates successful downloads. Option B is incorrect because 'TCP_MISS' and 'DIRECT' show the proxy allowed the request. Option C is unlikely given the repeated connections to a malware domain. Option D is incorrect because the activity is ongoing.

Answer

The downloads are false positives.

Answer

The threat has been contained.

Answer

The proxy is blocking the downloads.

Question 5

Which TWO of the following are key components of a security awareness program?

Accepted Answer

User training on password policies. A security awareness program focuses on educating users about security policies and threats. Phishing simulations test user vigilance, and password policy training reinforces good practices. Vulnerability scans and penetration tests are technical controls, not awareness components. Incident response drills involve technical teams, not general user awareness.

Answer

Incident response drills

Answer

Quarterly vulnerability scans

Answer

Annual penetration testing

Question 6

Which TWO of the following are effective measures to prevent buffer overflow attacks in a custom-developed application?

Accepted Answer

Input validation. Input validation helps ensure data fits within buffer limits, and stack canaries detect and prevent stack-based buffer overflows. Using unpatched libraries increases vulnerability; disabling ASLR makes exploitation easier; running with least privilege limits damage but does not prevent the overflow itself.

Answer

Using unpatched third-party libraries

Answer

Running the application with least privilege

Answer

Disabling ASLR

Question 7

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

Accepted Answer

To maintain log integrity. WORM storage ensures that logs cannot be altered after creation, preserving their integrity for forensic purposes.

Answer

To ensure log availability

Answer

To improve log review speed

Answer

To reduce storage costs

Question 8

An incident responder needs to create a forensic image of a suspect hard drive. Which of the following steps is ESSENTIAL to ensure the integrity of the evidence?

Accepted Answer

Use a write blocker to prevent modification of the original drive. Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.

Answer

Run an antivirus scan on the drive before imaging

Answer

Boot the suspect system to verify it is functional

Answer

Perform the imaging over the network to save time

Question 9

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

Accepted Answer

Capture a memory dump using a tool like Magnet RAM Capture. When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Answer

Disconnect the system from the network

Answer

Create a forensic image of the hard drive

Answer

Run an antivirus scan to remove malware

Question 10

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Accepted Answer

Large outbound data transfers to an external IP. Large outbound data transfers to an external IP are a classic indicator of data exfiltration, where an attacker moves stolen data outside the network. SIEM tools can detect this by monitoring traffic volume anomalies, such as a sudden spike in outbound bytes to a single external destination, which deviates from baseline behavior. This directly aligns with the risk of unauthorized data leakage.

Answer

Successful logins during business hours

Answer

Multiple failed login attempts

Answer

Elevated CPU usage on a database server

Question 11

A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?

Accepted Answer

Rule-based detection. The alert is triggered by a static threshold (10 failed attempts in 5 minutes) with no baseline learning. This is characteristic of rule-based detection, which uses predefined conditions (e.g., 'if count > 10 then alert'). Anomaly-based detection would require establishing a baseline of normal behavior and detecting deviations from that baseline. Therefore, rule-based detection is the most likely type used.

Answer

Anomaly-based detection

Answer

Signature-based detection

Answer

Behavior-based detection

Question 12

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. CCTV (Closed-Circuit Television) is a physical security control because it involves cameras and recording equipment that monitor and deter physical access to facilities. It is a detective and deterrent control that operates in the physical domain, not the logical or network domain.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption

Question 13

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?

Accepted Answer

Exposure of bucket contents to the public. The S3 bucket policy grants public access via a Principal of '*' and an Effect of 'Allow' for the 's3:GetObject' and 's3:ListBucket' actions. This means any unauthenticated user on the internet can list the objects in the bucket and read their contents, directly exposing the bucket contents to the public, making option D correct.

Answer

Unauthorized deletion of objects

Answer

Lack of encryption at rest

Answer

Inability to audit access

Question 14

Which three statements are true regarding mandatory access control (MAC) systems? (Select THREE)

Accepted Answer

Multilevel security is enforced. Mandatory Access Control (MAC) enforces system-wide policy based on security labels assigned to subjects and objects. Multilevel security (MLS) is a core MAC property where data at different classification levels (e.g., Secret, Top Secret) is isolated and access is governed by the system, not users. Subjects (users/processes) are assigned clearance levels, and objects have security labels; access decisions compare these labels using rules like the Bell-LaPadula model (no read up, no write down).

Answer

The owner of an object can change its security label

Answer

Users can grant permissions to other users

Question 15

A company is deploying a VPN using IPsec. They want to ensure that even if the private key of the server is compromised, past session keys cannot be derived. Which key exchange method should they use?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE). Ephemeral Diffie-Hellman (DHE or ECDHE) provides perfect forward secrecy (PFS) because it generates a unique, temporary session key for each session using ephemeral key pairs. Even if the server's long-term private key is compromised, past session keys cannot be derived because they were created from ephemeral keys that are discarded after each session. This ensures that historical encrypted traffic remains secure.

Answer

Pre-shared key (PSK)

Answer

RSA key exchange

Answer

Diffie-Hellman with static keys