SSCP Practice Test 2 — 30 Questions

Question 1

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 2

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software

Question 3

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

Accepted Answer

Assess the exploitability and impact to determine remediation priority. The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Answer

Apply the patch immediately to reduce risk

Answer

Re-scan the server to confirm the vulnerability

Answer

Ignore the vulnerability because the patch is available

Question 4

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 5

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 6

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 7

A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.

Answer

SSH (Secure Shell)

Answer

SSL 3.0

Answer

IPsec in transport mode

Question 8

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 9

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 10

An organization is implementing a new remote access VPN for employees using IPsec. Which TWO of the following are best practices for securing the IPsec VPN?

Accepted Answer

Use AES encryption with a minimum key size of 128 bits. AES encryption with a minimum key size of 128 bits is a best practice for IPsec VPNs because it provides strong, symmetric encryption that is resistant to known cryptographic attacks. AES-128 is approved by NIST and widely considered secure for protecting sensitive data over untrusted networks like the internet.

Answer

Use pre-shared keys for authentication

Answer

Disable anti-replay protection to improve performance

Answer

Allow all IP protocols through the VPN tunnel

Question 11

A network administrator notices that wireless users are experiencing intermittent connectivity. The controller shows excessive deauthentication frames. What is the most likely cause?

Accepted Answer

Rogue access point performing a deauthentication attack. Excessive deauthentication frames are a hallmark of a deauthentication attack, where a rogue access point sends forged 802.11 management frames to disconnect clients. This causes intermittent connectivity as clients repeatedly lose association and attempt to reconnect. The controller logs these frames as a clear indicator of an active attack.

Answer

Channel interference

Answer

Power save mode

Answer

DHCP server exhaustion

Answer

Weak encryption

Question 12

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs

Question 13

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

Accepted Answer

Escalate the incident to the incident response manager and legal counsel. When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Answer

Notify the affected customers of the data breach

Answer

Create a forensic image of the compromised server

Answer

Begin containment by isolating affected systems

Question 14

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 15

Refer to the exhibit. An administrator applies this ACL to the external interface. What specific traffic is blocked?

Accepted Answer

All ping requests. The ACL is applied to the external interface and denies ICMP echo-request (type 8) packets while permitting ICMP echo-reply (type 0) packets. This blocks only ping requests (echo-requests) from entering the network, but allows ping replies (echo-replies) to return for outbound-initiated traffic. Therefore, option D is correct because the ACL specifically targets and blocks all ping requests.

Answer

Both ping requests and replies

Answer

Only ping replies

Answer

All ICMP traffic

Question 16

Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?

Accepted Answer

WPA2. WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption, as defined in 802.11i.

Answer

WEP

Answer

WPA

Answer

WPA3

Question 17

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. The number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Question 18

A security analyst reviews the TLS configuration of a web server and notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is enabled. The analyst recommends disabling RSA key exchange and enabling ECDHE. Which security property does ECDHE provide that RSA key exchange lacks?

Accepted Answer

ECDHE provides perfect forward secrecy.. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides Perfect Forward Secrecy (PFS), meaning that if the server's long-term private key is compromised, past session keys cannot be derived. RSA key exchange does not provide PFS because the session key is encrypted with the server's static RSA public key; if the private key is later exposed, all recorded sessions can be decrypted.

Answer

ECDHE is faster than RSA key exchange.

Answer

ECDHE is required by PCI DSS for all web transactions.

Answer

ECDHE uses smaller key sizes for equivalent security.

Question 19

Which THREE of the following are common methods for identifying risks? (Select three.)

Accepted Answer

Threat modeling. Threat modeling is a structured approach for identifying risks by analyzing potential threats, vulnerabilities, and attack vectors in a system. It involves creating diagrams, identifying assets, and applying frameworks like STRIDE or PASTA to systematically uncover risks before they are exploited. This makes it a core risk identification method in the SSCP domain.

Answer

SWOT analysis

Answer

Penetration testing

Question 20

An organization is redesigning its DMZ to host a public web server and an internal file server. Which architecture provides the strongest security?

Accepted Answer

Place the web server in the DMZ and the file server on the internal network; allow only HTTP/HTTPS from web server to file server.. It follows the principle of least privilege and defense in depth by placing the public-facing web server in the DMZ, where it can be accessed from the internet, while the internal file server remains on the internal network, isolated from direct external access. Only HTTP/HTTPS traffic is allowed from the web server to the file server, typically enforced by a stateful firewall or an application-layer gateway, which minimizes the attack surface and prevents lateral movement if the web server is compromised.

Answer

Place both servers in the DMZ with no firewall between them.

Answer

Place the web server on the internal network and the file server in the DMZ with a VPN.

Answer

Place both servers on the internal network with a stateful firewall inspecting traffic.