SSCP Practice Test 2 — 30 Questions

Question 1

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 2

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In IaaS, the customer is responsible for securing the operating system, including patch management, because the provider only manages the hypervisor and physical infrastructure. Operating system security and patching is therefore a customer responsibility. The other options are provider responsibilities in IaaS.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 3

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.

Answer

MAC flooding

Answer

DHCP starvation

Answer

DNS poisoning

Question 4

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the memory dump immediately after capture establishes a verifiable baseline for integrity. Any subsequent modification — accidental or intentional — will change the hash, allowing the analyst to prove the evidence was not tampered with. This chain-of-custody practice is fundamental to forensic admissibility.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 5

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 6

What is the PRIMARY purpose of a lessons learned meeting after an incident?

Accepted Answer

To identify improvements in the incident response process. The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Answer

To assign blame for the incident

Answer

To satisfy regulatory compliance requirements

Answer

To calculate the financial cost of the incident

Question 7

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker is a Windows built-in feature introduced in Windows 7 and Server 2008 R2 that allows administrators to create and enforce rules specifying which applications and files users can run. It uses a whitelisting model based on file attributes such as publisher, path, or hash, and can be configured via Group Policy or PowerShell cmdlets. By default, AppLocker blocks any executable not explicitly allowed, thus ensuring only approved executables run. This directly meets the requirement for application whitelisting on Windows servers.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 8

Which of the following is a key principle of the 3-2-1 backup rule?

Accepted Answer

Three copies on two different media types with one offsite. The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

Answer

Two copies on three different media types with one onsite

Answer

One copy on two different media types with three offsite

Answer

Three copies on three different media types with two offsite

Question 9

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 10

A medium-sized e-commerce company uses a SIEM with correlation rules. During peak sales hours, the SIEM generates an alert: multiple failed login attempts from internal IP 172.16.10.50 followed by a successful login to a critical database server. The account used is 'dbadmin', which normally only authenticates from the IT department subnet. The user 'dbadmin' reports that they had to try several passwords because they forgot theirs earlier. The incident responder is under pressure to quickly restore normal operations. Which course of action should the responder take?

Accepted Answer

Investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP.. While the user's explanation seems plausible, the alert indicates a deviation from normal behavior (logins from an unexpected subnet). The responder should investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP to rule out a potential compromise. Option A (blocking the user's account immediately) could be disruptive if it's a false positive and may prevent legitimate access. Option B (resetting password and enabling MFA) is a good security measure but does not address the need to verify whether the account was actually compromised or if there is ongoing malicious activity. Option C (dismissing the alert as a false positive) is premature and ignores the possibility of credential stuffing or account takeover. Therefore, investigating further is the most appropriate course of action.

Answer

Block the user's account immediately to prevent any further access.

Answer

Reset the user's password and enable multi-factor authentication (MFA).

Answer

Dismiss the alert as a false positive since the user explained the failed attempts.

Question 11

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers

Question 12

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. The Clean Desk Policy is violated because it requires employees to keep their workspaces free of sensitive information, including passwords, when not in use. Writing passwords on sticky notes and attaching them to monitors leaves credentials exposed, directly contravening this policy. The Clean Desk Policy aims to reduce the risk of unauthorized access to information.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 13

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 14

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password, RFC 6238) generates a one-time password derived from a shared secret and the current time step (typically 30 seconds), so the code is valid only within a short time window. This time-bound validity is exactly what the question describes.

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password

Question 15

A PKI administrator needs to check the revocation status of a digital certificate without requiring the client to download the entire CRL. Which method is designed for online, real-time certificate status checking?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) is designed for online, real-time certificate status checking. It allows a client to query an OCSP responder for the revocation status of a specific certificate without downloading the entire CRL.

Answer

OCSP stapling

Answer

CRL

Answer

Certificate transparency

Question 16

What is the primary purpose of a baseline configuration in configuration management?

Accepted Answer

To provide a consistent, secure starting point for systems. A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

Answer

To store configuration items in the CMDB

Answer

To detect malware infections

Answer

To track software licenses

Question 17

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 18

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Accepted Answer

Backup, Overwrite, Verify, Destroy, Document. The proper order for disposing of a hard drive with sensitive data is: first, backup any data that needs to be retained; second, overwrite the entire drive to sanitize it; third, verify that the overwrite was successful using a tool; fourth, physically destroy the drive (e.g., shredding or crushing); and finally, document the process for audit trails and compliance. This sequence ensures data confidentiality and availability of necessary data.

Answer

Overwrite, Verify, Backup, Destroy, Document

Answer

Destroy, Backup, Overwrite, Verify, Document

Answer

Backup, Verify, Overwrite, Destroy, Document

Question 19

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity

Question 20

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy is the correct answer because it is a centralized management feature in Windows Active Directory that allows administrators to define and enforce security policies—such as password complexity, account lockout thresholds, and audit settings—across multiple systems in a domain. Group Policy Objects (GPOs) are linked to sites, domains, or organizational units (OUs) and are applied to computers and users at logon or startup, ensuring consistent policy enforcement. This centralized approach is essential for enterprise environments where local settings would be impractical to manage individually.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)