SSCP Practice Test 3 — 10 Questions

Question 1

Which of the following best describes the purpose of a Hardware Security Module (HSM) in key management?

Accepted Answer

To store cryptographic keys in a secure, tamper-resistant environment. A Hardware Security Module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. By keeping keys within the HSM's physical and logical boundaries, it prevents unauthorized extraction even if the host system is compromised, which is the core purpose of an HSM in key management.

Answer

To replace public key infrastructure (PKI)

Answer

To accelerate network traffic encryption

Answer

To generate random numbers for non-cryptographic use

Question 2

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

Accepted Answer

Biometric reader. Biometric readers and mantraps provide strong authentication and access control.

Answer

Visitor log

Answer

Clean desk policy

Answer

Screen locks

Question 3

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

Accepted Answer

To prove that evidence has not been altered or tampered with from collection to presentation. The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Answer

To determine the priority of the incident

Answer

To ensure that evidence is stored in a secure location

Answer

To identify which forensic tools were used during analysis

Question 4

Drag and drop the steps for conducting a security incident response under the NIST framework into the correct order.

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, Reporting. NIST incident response follows: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity, and Reporting.

Answer

Detection & Analysis, Containment/Eradication/Recovery, Preparation, Post-Incident Activity, Reporting

Answer

Preparation, Containment/Eradication/Recovery, Detection & Analysis, Post-Incident Activity, Reporting

Answer

Preparation, Detection & Analysis, Post-Incident Activity, Containment/Eradication/Recovery, Reporting

Question 5

Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?

Accepted Answer

Only hosts in the 10.0.0.0/8 range. The firewall rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.

Answer

No hosts can connect to the database

Answer

Both internet hosts and internal hosts

Answer

Any host on the internet

Question 6

A critical vulnerability is discovered in an application currently in use. What should be done first?

Accepted Answer

Test the patch in a non-production environment. Testing the patch in a non-production environment ensures it does not break functionality before deployment. Immediate deployment risks downtime. Disabling the application or notifying users are reactive steps, not the first.

Answer

Notify users to stop using the application

Answer

Disable the application until patch is ready

Answer

Deploy the patch immediately to all systems

Question 7

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Accepted Answer

ClientHello, then ServerHello, then EncryptedExtensions, then Finished from server, then Finished from client. TLS 1.3 reduces round trips: ClientHello, ServerHello, EncryptedExtensions, Finished from server, Finished from client.

Answer

ClientHello, then ServerHello, then Finished from client, then EncryptedExtensions, then Finished from server

Answer

ClientHello, then EncryptedExtensions, then ServerHello, then Finished from server, then Finished from client

Answer

ServerHello, then ClientHello, then EncryptedExtensions, then Finished from server, then Finished from client

Question 8

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 9

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 10

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer