SSCP Practice Test 30 — 15 Questions

Question 1

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

Controlling and monitoring access to privileged accounts. A Privileged Access Management (PAM) solution is specifically designed to secure, control, and monitor the use of privileged accounts (e.g., root, administrator, service accounts) that have elevated permissions. It provides features like credential vaulting, session recording, just-in-time access, and approval workflows to prevent misuse and detect malicious activity. Unlike general identity management, PAM focuses on the high-risk accounts that can alter system configurations, access sensitive data, or disrupt operations. Thus, controlling and monitoring access to privileged accounts is its primary purpose.

Answer

Managing user password resets

Answer

Implementing single sign-on for all applications

Answer

Enforcing password complexity policies

Question 2

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Accepted Answer

Large outbound data transfers to an external IP. Option B is correct because large outbound data transfers to an external IP are a classic exfiltration indicator: data leaving the network in abnormal volume or to an unfamiliar destination suggests staging and transfer of stolen data, and SIEM correlation on bytes sent, destination reputation, and baseline deviation is the standard detection method. Option C is correct because a user or host connecting to a known command-and-control (C2) server indicates active adversary communication, which typically precedes or accompanies exfiltration and is detected via threat-intelligence feeds, DNS/HTTP beaconing patterns, and IOC matching. Option A does not belong because successful logins during business hours are normal expected activity and lack exfiltration context. Option D does not belong because multiple failed login attempts indicate brute-force or credential-stuffing attempts (an access/integrity threat), not outbound data theft. Option E does not belong because elevated CPU usage on a database server is a performance or resource symptom that may have many benign causes and is not a direct exfiltration indicator.

Answer

Successful logins during business hours

Answer

Multiple failed login attempts

Answer

Elevated CPU usage on a database server

Question 3

An organization is configuring a VPN using IPsec. To ensure forward secrecy, which key exchange method should be used?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE). Ephemeral Diffie-Hellman (DHE or ECDHE) provides forward secrecy because it generates a temporary, one-time key pair for each session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This ensures that even if an attacker records encrypted traffic and later obtains the private key, they cannot decrypt past sessions.

Answer

RSA key exchange

Answer

Pre-shared key (PSK)

Answer

Static Diffie-Hellman

Question 4

A company is deploying a VPN using IPsec. They want to ensure that even if the private key of the server is compromised, past session keys cannot be derived. Which key exchange method should they use?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE). Ephemeral Diffie-Hellman (DHE or ECDHE) provides perfect forward secrecy (PFS) because it generates a unique, temporary session key for each session using ephemeral key pairs. Even if the server's long-term private key is compromised, past session keys cannot be derived because they were created from ephemeral keys that are discarded after each session. This ensures that historical encrypted traffic remains secure.

Answer

Pre-shared key (PSK)

Answer

RSA key exchange

Answer

Diffie-Hellman with static keys

Question 5

An organization's backup policy states: 'Maintain three copies of data on two different media types, with one copy stored offsite.' This is known as:

Accepted Answer

3-2-1 rule. The 3-2-1 rule is a foundational data backup strategy that mandates maintaining three total copies of data, stored on two different types of media (e.g., disk and tape), with one copy located offsite to protect against site-level disasters. This directly matches the policy described, making option C correct.

Answer

Incremental backup strategy

Answer

Grandfather-father-son rotation

Answer

Disaster recovery plan

Question 6

Match each network security device to its function.

Accepted Answer

Firewall: Filters network traffic based on security rules.. Correct matches: Firewall filters traffic, IDS monitors and alerts, IPS monitors and blocks, VPN concentrator handles encryption. Common confusions: swapping firewall and IDS functions.

Answer

Firewall: Monitors traffic for suspicious activity and sends alerts.

Answer

IDS: Filters network traffic based on security rules.

Question 7

Match each cryptography term to its definition.

Accepted Answer

Symmetric Encryption: Uses the same key for encryption and decryption. Correct matches: Symmetric encryption uses one key; asymmetric uses a key pair; hashing produces fixed-size digests; digital signatures ensure non-repudiation. Common confusions include swapping symmetric/asymmetric definitions or treating hashing as encryption.

Answer

Symmetric Encryption: Uses a pair of keys (public and private)

Answer

Hashing: Used to encrypt data for confidentiality

Question 8

An organization is migrating from 3DES to AES-256 for encrypting data at rest. Which mode of AES is recommended for authenticated encryption?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides both confidentiality and authenticity in a single, efficient mode. For data at rest, authenticated encryption ensures that encrypted data cannot be tampered with undetected, which is critical for integrity. AES-256-GCM is widely recommended and standardized (NIST SP 800-38D) for this purpose.

Answer

ECB

Answer

CBC

Answer

CTR

Question 9

During a wireless site survey, a security engineer identifies several security weaknesses. Which TWO measures should be implemented to improve wireless security for a corporate network using WPA2-Enterprise?

Accepted Answer

Use 802.1X authentication with EAP-TLS and certificate-based authentication. Option A is correct because WPA2-Enterprise relies on 802.1X for port-based network access control, and EAP-TLS with certificate-based authentication provides strong mutual authentication using digital certificates rather than weaker credential-based methods like PEAP-MSCHAPv2. Option D is correct because the RADIUS server must present a certificate from a trusted CA so supplicants can validate it and prevent rogue-AP/evil-twin attacks, while validating client certificates ensures only authorized devices/users complete the EAP-TLS exchange. Option B is not appropriate because MAC address filtering is trivially bypassed via spoofing and adds no real cryptographic protection. Option C is not appropriate because hiding the SSID is security through obscurity and the SSID is still discoverable in management frames. Option E is not appropriate because WPS is vulnerable to brute-force PIN attacks and should be disabled on corporate WPA2-Enterprise networks.

Answer

Implement MAC address filtering to allow only known devices

Answer

Disable SSID broadcast to hide the network

Answer

Enable WPS for easy client configuration

Question 10

What is the primary purpose of account deprovisioning?

Accepted Answer

To revoke access and disable accounts when no longer needed. Account deprovisioning is the process of removing or disabling user accounts and revoking associated access rights when they are no longer required, such as when an employee leaves the organization or changes roles. The primary goal is to ensure that former users cannot access systems, data, or resources, thereby reducing the attack surface and preventing unauthorized access. This is a fundamental control in identity and access management (IAM) and is required by regulations like SOX, HIPAA, and PCI DSS.

Answer

To create new user accounts

Answer

To audit user activity

Answer

To modify user roles

Question 11

An organization uses a central syslog server to collect logs from firewalls, servers, and network devices. Recently, the security team noticed that some critical events from the firewall are missing from the syslog server. The firewall configuration sends syslog messages using UDP to the syslog server. The syslog server administrator reports that the server is receiving a high volume of logs and occasionally drops packets due to buffer overflow. The team needs to ensure reliable delivery of all syslog messages without losing any. Which solution should the team implement?

Accepted Answer

Switch to TCP-based syslog with TLS.. Syslog over UDP is fire-and-forget with no delivery guarantees, so packet loss from buffer overflow is expected. Switching to TCP-based syslog (ideally with TLS, i.e., RFC 5425) provides connection-oriented, reliable delivery with acknowledgments and retransmission, ensuring no messages are lost.

Answer

Increase the UDP buffer size on the syslog server.

Answer

Implement log aggregation at each network segment.

Answer

Use a load balancer for syslog receivers.

Question 12

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

Accepted Answer

Quarterly. PCI DSS Requirement 11.2.1 mandates that internal vulnerability scans must be performed at least quarterly and after any significant change in the network. This frequency ensures that new vulnerabilities introduced since the last scan are identified and remediated before they can be exploited. Quarterly scans are a minimum; more frequent scanning is recommended for high-risk environments.

Answer

Annually

Answer

Monthly

Answer

Weekly

Question 13

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

Accepted Answer

RTO = 2 hours, RPO = 1 hour. The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Answer

RTO = 1 hour, RPO = 1 hour

Answer

RTO = 1 hour, RPO = 2 hours

Answer

RTO = 2 hours, RPO = 2 hours

Question 14

A security architect is reviewing cloud security for a SaaS application used by the company. According to the shared responsibility model, which security controls are PRIMARILY the customer's responsibility?

Accepted Answer

Data classification and user access management. In SaaS, the customer is responsible for data classification and managing user access (IAM).

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Operating system patching

Question 15

A company is upgrading its legacy systems to use modern cryptographic standards. Which two of the following algorithms should be avoided due to known weaknesses or deprecation?

Accepted Answer

MD5 for hashing. MD5 (option B) must be avoided because it is cryptographically broken: practical collision attacks (e.g., chosen-prefix collisions) make it unsuitable for hashing, digital signatures, or integrity checks, and it has been deprecated by NIST for security use. 3DES (option E) should also be avoided because its 64-bit block size enables Sweet32-style birthday attacks, and its effective key strength is reduced (e.g., 2-key 3DES offers only about 80 bits), leading to its deprecation and removal from standards such as NIST SP 800-131A. SHA-256 (option A) is a current, secure SHA-2 hash and remains approved for hashing. AES-256 (option C) is a strong, modern symmetric cipher with no practical breaks and is widely recommended. ECDH (option D) is a sound modern elliptic-curve key-exchange method and is not deprecated.

Answer

SHA-256 for hashing

Answer

AES-256 for encryption

Answer

ECDH for key exchange