SSCP Practice Test 3 — 10 Questions

Question 1

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 2

Which TWO components are essential for an effective disaster recovery plan (DRP)?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, which directly determines the required backup frequency and data replication strategy. Without an RPO, the DRP cannot specify how much data can be lost, making it impossible to design appropriate backup and recovery mechanisms. This metric is essential because it drives the technical implementation of data protection, such as snapshot intervals or synchronous replication.

Answer

Automated failover system

Answer

Business Impact Analysis (BIA)

Answer

Redundant array of independent disks (RAID)

Question 3

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

Accepted Answer

To force the switch to act like a hub and allow packet sniffing. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of fake source MAC addresses, the attacker fills the CAM table, causing the switch to fail open and flood all incoming frames out all ports, effectively behaving like a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

To change the MAC address of the switch

Answer

To cause a denial of service on the network

Answer

To bypass 802.1X authentication

Question 4

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

Accepted Answer

MFA fatigue attack. MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Answer

Session hijacking

Answer

Man-in-the-middle (MITM) attack

Answer

Token theft from the endpoint

Question 5

Which THREE of the following are common types of network attacks?

Accepted Answer

ARP spoofing. ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Answer

Pharming

Answer

SQL injection

Question 6

Which TWO of the following are symmetric encryption algorithms? (Select exactly two.)

Accepted Answer

DES. DES (Data Encryption Standard) is a symmetric encryption algorithm that uses a single key for both encryption and decryption. It operates on 64-bit blocks with a 56-bit key, and while now considered insecure due to its small key size, it remains a foundational symmetric cipher. AES (Advanced Encryption Standard) is also symmetric, using block sizes of 128 bits and key sizes of 128, 192, or 256 bits, and is the current standard for symmetric encryption.

Answer

RSA

Answer

ECC

Answer

SHA-256

Question 7

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 8

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Accepted Answer

TCP port 443. HTTPS (HTTP over TLS) uses TCP as its transport protocol because it requires reliable, connection-oriented delivery for secure web traffic. The default port for HTTPS is 443, as defined in RFC 2818. Therefore, allowing TCP port 443 is the correct firewall rule.

Answer

UDP port 80

Answer

UDP port 443

Answer

TCP port 80

Question 9

Refer to the exhibit. A security analyst reviews this AWS IAM policy and notices that delete operations on objects in the corporate-bucket are being denied unexpectedly. What is the most likely issue?

Accepted Answer

The Deny statement requires objects to be encrypted with AES256 for delete operations. Option A is correct because the Deny statement includes a condition that requires objects to be encrypted with AES256 for all operations, including delete. Since the condition is not limited to specific actions, any delete request on an object that is not encrypted with AES256 will be denied, even if the Allow statement grants s3:DeleteObject permissions. This is a common misconfiguration where encryption requirements inadvertently block operations that do not involve encryption checks.

Answer

The Allow statement is being overridden by the Deny, but the cause is the encryption requirement

Answer

The condition on the Deny statement is not matching any objects

Answer

The policy has a syntax error in the Condition element

Question 10

A security engineer is designing a system to store passwords securely. Which of the following is the most robust approach for password storage?

Accepted Answer

Use bcrypt with a high cost factor. Bcrypt is the most robust option because it incorporates a salt to defend against rainbow table attacks and uses a configurable cost factor to deliberately slow down the hashing process, making brute-force attacks computationally expensive. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password storage and resists GPU-accelerated attacks by requiring significant memory and time per attempt.

Answer

Hash passwords with SHA-256

Answer

Encode passwords with Base64

Answer

Encrypt passwords using AES-256 and store the key separately

SSCP Practice Test 3 — 10 Questions

Exhibit

SSCP Practice Test 3 — 10 Questions

Exhibit