SSCP Practice Test 30 — 15 Questions

Question 1

An organization's backup policy states: 'Maintain three copies of data on two different media types, with one copy stored offsite.' This is known as:

Accepted Answer

3-2-1 rule. The 3-2-1 rule is a foundational data backup strategy that mandates maintaining three total copies of data, stored on two different types of media (e.g., disk and tape), with one copy located offsite to protect against site-level disasters. This directly matches the policy described, making option C correct.

Answer

Incremental backup strategy

Answer

Grandfather-father-son rotation

Answer

Disaster recovery plan

Question 2

An alert shows a successful login from an unusual geographic location. Which of the following is the BEST initial response?

Accepted Answer

Disable the user account. Disabling the account immediately prevents further unauthorized access while the incident is investigated. Option B is premature without confirmation of compromise. Option C may be done after disabling. Option D is too slow as the first step.

Answer

Contact the user to verify the login

Answer

Block the source IP address

Answer

Reset the user's password

Question 3

Which THREE steps are essential during the identification phase of incident response?

Accepted Answer

Monitor logs and alerts. During the identification phase of incident response, the essential steps are monitoring logs and alerts (C) to detect potential incidents, determining the scope of the incident (D) to understand its impact, and classifying incident severity (E) to prioritize response. Options A and B are not part of identification; eradication occurs later in the response phase, and stakeholder notification typically happens after identification and analysis.

Answer

Eradicate the threat

Answer

Notify stakeholders

Question 4

A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?

Accepted Answer

An earlier deny rule matches the traffic before the permit rule. The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.

Answer

The firewall rule is disabled

Answer

The database server is down

Answer

The internal IP is on a blacklist

Question 5

Refer to the exhibit. Which component of the cipher suite provides perfect forward secrecy?

Accepted Answer

ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides perfect forward secrecy (PFS) because it generates a unique, ephemeral session key for each TLS session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This is defined in RFC 4492 and is a core property of ephemeral Diffie-Hellman key exchange.

Answer

TLS 1.2

Answer

AES256-GCM

Answer

SHA384

Question 6

Which wireless encryption protocol is currently considered the most secure for home use?

Accepted Answer

WPA3-Personal. WPA3-Personal is currently the most secure wireless encryption protocol for home use because it replaces the Pre-Shared Key (PSK) model with Simultaneous Authentication of Equals (SAE), which provides forward secrecy and protects against offline dictionary attacks. Unlike WPA2, WPA3 mandates the use of GCMP-256 encryption and disables legacy TKIP, ensuring robust confidentiality and integrity for home networks.

Answer

WPA2-Enterprise

Answer

WEP (Wired Equivalent Privacy)

Answer

WPA2-PSK

Question 7

A company is implementing a risk monitoring program. Which of the following is the best key performance indicator (KPI) to measure the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) critical vulnerabilities. Mean time to remediate (MTTR) critical vulnerabilities directly measures how quickly the organization closes the window of exposure for the highest-risk flaws. This KPI reflects the efficiency of the remediation workflow—from detection through patching or compensating control deployment—and is a standard metric in frameworks like NIST SP 800-40 and the CVSS scoring system. A lower MTTR indicates a more effective vulnerability management process because it reduces the time attackers have to exploit known weaknesses.

Answer

Percentage of systems with up-to-date patches

Answer

Number of vulnerability scans performed per month

Answer

Number of vulnerabilities discovered per scan

Question 8

Refer to the exhibit. During a security review, an analyst finds these firewall rules. Which recommendation should be made to reduce risk?

Accepted Answer

Restrict the source for rule 10 to specific administrative IPs. Rule 10 allows SSH (TCP/22) from any source (0.0.0.0/0) to the internal server, which exposes the management interface to the entire internet. Restricting the source to specific administrative IPs reduces the attack surface by limiting who can initiate SSH connections, mitigating brute-force and unauthorized access risks. This aligns with the principle of least privilege and is a fundamental access control recommendation.

Answer

Enable logging on rule 15 as well

Answer

Require VPN access for all internal traffic

Answer

Remove rule 15 entirely

Question 9

Which TWO roles are typically part of an incident response team?

Accepted Answer

Incident Manager. The Incident Manager (C) is the central coordinator who manages the incident response process, ensures communication among stakeholders, and makes strategic decisions during an incident. The Forensic Analyst (D) is responsible for collecting, preserving, and analyzing digital evidence in a forensically sound manner, often using tools like FTK Imager or EnCase to maintain chain of custody. Both roles are essential for a structured and legally defensible incident response.

Answer

Chief Financial Officer

Answer

Network Administrator

Answer

Legal Counsel

Question 10

A network security team is implementing a defense-in-depth strategy. Which three layers should be included? (Choose three.)

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is a key layer in defense-in-depth because it monitors network traffic for suspicious activity and known attack signatures, providing visibility and alerting when perimeter defenses like firewalls are bypassed. It operates by analyzing packets against a rule set (e.g., Snort rules) and generating alerts, enabling a response before damage escalates. This adds a detection layer that complements preventive controls, ensuring that even if an attacker penetrates the outer defenses, the breach is identified.

Answer

Single sign-on (SSO)

Answer

Physical security controls

Question 11

A security analyst reviews log files and sees multiple failed SSH attempts from various IP addresses. The analyst implements a rate-limiting rule on the firewall to block IPs after 5 failed attempts in 10 minutes. This is an example of which type of security control?

Accepted Answer

Preventive. Rate-limiting SSH attempts by blocking IPs after 5 failed attempts in 10 minutes is a preventive control because it actively stops unauthorized access before it can occur. By enforcing a threshold on the firewall, the control reduces the attack surface against brute-force attacks, directly preventing further authentication attempts from suspicious sources.

Answer

Compensating

Answer

Detective

Answer

Deterrent

Answer

Corrective

Question 12

A security analyst detects unusual outbound traffic from a server that normally communicates only with internal systems. The firewall logs show connections to an external IP address on port 443/tcp. Which incident response step should the analyst perform FIRST?

Accepted Answer

Isolate the server from the network.. The unusual outbound traffic to an external IP on port 443/tcp from a server that normally only communicates internally indicates a potential compromise, such as a command-and-control (C2) channel. The first priority in incident response is containment to prevent further data exfiltration or lateral movement, and isolating the server from the network achieves this without destroying volatile evidence. Shutting down the server or running an antivirus scan could destroy memory-resident malware or forensic artifacts, violating the order of volatility.

Answer

Run a full antivirus scan on the server.

Answer

Immediately shut down the server.

Answer

Disconnect the entire network segment.

Question 13

An organization is implementing Windows Defender Application Control (WDAC) to prevent unauthorized applications from running on company workstations. Which of the following best describes the primary security benefit of this approach?

Accepted Answer

It prevents execution of any application not explicitly allowed. WDAC is a whitelisting technology that only allows approved applications to execute, effectively blocking malware and unauthorized software by default.

Answer

It encrypts application binaries at rest

Answer

It automatically updates applications from a trusted source

Answer

It ensures that all applications are digitally signed

Question 14

Refer to the exhibit. What security issue is present in this firewall policy?

Accepted Answer

The default deny rule is missing. The exhibit shows a firewall policy with explicit permit rules but no explicit deny all rule at the bottom. Without a default deny rule, any traffic not matching an explicit permit may be implicitly allowed or handled unpredictably depending on the firewall platform, violating the security principle of least privilege. A proper firewall policy must end with an explicit deny all to block all unauthorized traffic.

Answer

Web traffic is allowed from any source

Answer

The firewall is allowing all traffic on port 443

Answer

The destination network is too broad

Answer

SSH is blocked for a specific subnet

Question 15

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

Accepted Answer

To prove that the evidence has not been tampered with and is admissible in legal proceedings. The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Answer

To determine the cost of the forensic investigation

Answer

To ensure the hard drive is stored in a secure location

Answer

To track the productivity of forensic analysts