SSCP Practice Test 3 — 10 Questions

Question 1

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. B (CCTV) is correct because closed-circuit television cameras are a physical security control that monitors and records activity in a facility to deter and detect intrusions. D (Biometric reader) is correct because it is a physical access control device that authenticates individuals via fingerprints, iris, or facial recognition to restrict entry to a protected area. A (Firewall) is incorrect because it is a logical/network security control that filters traffic based on rules, not a physical barrier. C (Intrusion detection system) is incorrect because an IDS is a logical monitoring control that analyzes network or host activity for malicious behavior. E (Encryption) is incorrect because it is a cryptographic/logical control that protects data confidentiality, not a physical control.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption

Question 2

Which THREE of the following are data loss prevention (DLP) controls that can be implemented to protect sensitive data?

Accepted Answer

Encrypt sensitive data both at rest and in transit. Option B is correct because encryption of sensitive data at rest (e.g., AES-256 on disks/databases) and in transit (e.g., TLS 1.2+) is a core DLP control that renders intercepted or exfiltrated data unreadable, directly preventing unauthorized disclosure. Option C is correct because endpoint DLP agents enforce policies at the source by inspecting and blocking unauthorized transfers via channels such as USB, email, clipboard, and cloud uploads, which is a primary DLP enforcement mechanism. Option D is correct because data classification with sensitivity labels (e.g., Public, Internal, Confidential, Restricted) is the foundational DLP step that identifies what needs protection and drives which handling, encryption, and blocking policies apply. Option A does not belong because strong passwords are an access-control/authentication measure (identity protection), not a control that detects or prevents sensitive data from leaving the organization. Option E does not belong because blocking all outbound traffic via firewalls is a blunt network availability control, not a data-aware DLP control, and it would break legitimate business communications rather than selectively protect sensitive data.

Answer

Require strong passwords for all user accounts

Answer

Implement network firewalls to block all outbound traffic

Question 3

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 4

An attacker sends a large number of DHCP request messages with spoofed MAC addresses to a network's DHCP server, causing the server to exhaust its IP address pool and deny service to legitimate clients. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation is an attack in which the attacker floods the DHCP server with DISCOVER/REQUEST messages using spoofed MAC addresses, exhausting the available IP address pool so legitimate clients cannot obtain a lease. The scenario described — pool exhaustion and denial of service to legitimate clients — is the textbook definition of DHCP starvation.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

DHCP spoofing

Question 5

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Accepted Answer

Step 1: Install the Active Directory Certificate Services role. Step 2: Configure the CA type (e.g., Enterprise Root CA). Step 3: Set the storage locations for certificate database and log. Step 4: Install the CA services. Step 5: Test the CA by requesting a certificate.. Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Answer

Step 1: Install the AD CS role. Step 2: Configure the CA type. Step 3: Install the CA services. Step 4: Set the storage locations. Step 5: Test the CA.

Answer

Step 1: Configure the CA type. Step 2: Install the AD CS role. Step 3: Set storage locations. Step 4: Install the CA services. Step 5: Test.

Answer

Step 1: Install the AD CS role. Step 2: Set storage locations. Step 3: Configure the CA type. Step 4: Install the CA services. Step 5: Test.

Question 6

A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the primary configuration file for the sudo command, defining which users or groups can run which commands on which hosts, and whether a password is required. A user with NOPASSWD: ALL in this file can execute any command as root without a password. Therefore, reviewing /etc/sudoers is the correct action to verify the auditor's finding.

Answer

/etc/shadow

Answer

/etc/group

Answer

/etc/passwd

Question 7

Which TWO of the following are examples of administrative controls? (Choose two.)

Accepted Answer

Access control policies. Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Answer

Firewall rules

Answer

Security guards

Answer

Encryption of data at rest

Question 8

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

Accepted Answer

Business unit leaders. Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Answer

External legal counsel

Answer

Internal audit

Answer

Only IT staff

Question 9

An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with the IP address of a legitimate host, causing traffic intended for that host to be sent to the attacker. This enables man-in-the-middle attacks at Layer 2. The scenario described exactly matches ARP spoofing.

Answer

DNS poisoning

Answer

DHCP spoofing

Answer

MAC flooding

Question 10

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. Option E (Change request submission) is correct because the change management process formally begins when a Request for Change (RFC) is submitted and logged, often via a ticketing or ITSM system, so the change can be reviewed and authorized. Option D (Impact assessment) is correct because after the RFC is raised, the change advisory board or reviewers evaluate risk, scope, affected systems, and potential downtime to decide whether the change should be approved. Option A (Post-implementation review) is correct because after the change is deployed, the process includes verifying that it achieved its objective, did not cause unintended issues, and capturing lessons learned for future changes. Option B (Vulnerability scanning) is not a change management step; it is a security assessment activity typically performed under vulnerability management, even though its findings may trigger an RFC. Option C (Baseline configuration update) is not a step in the change management process itself; updating the configuration baseline is a configuration management activity that occurs after an approved change is implemented.

Answer

Vulnerability scanning

Answer

Baseline configuration update