SSCP Practice Test 3 — 30 Questions

Question 1

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the only model where access decisions are based on comparing the subject's security clearance with the object's classification label, as defined by a central authority. In MAC, the system enforces these labels and users cannot alter them, making it mandatory rather than discretionary. This matches the scenario of assigning permissions based on clearance and classification, which are core components of MAC (e.g., Bell-LaPadula or Biba models).

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

What is the primary purpose of establishing a chain of custody for digital evidence?

Accepted Answer

To maintain evidence integrity and track handling. The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Answer

To reduce the size of evidence for storage

Answer

To encrypt evidence for secure transmission

Answer

To prioritize which evidence to analyze first

Question 3

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.

Answer

Threat

Answer

Risk

Answer

Exploit

Question 4

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

Accepted Answer

The web application firewall is blocking legitimate traffic.. A 403 Forbidden error indicates that the server understood the request but is refusing to authorize it. The most likely cause is the web application firewall (WAF) blocking legitimate traffic due to false positives or overly strict rules. Option B (expired SSL certificate) would cause SSL handshake errors, not 403. Option C (database connection pool exhausted) would result in 500-type errors. Option D (IP address change) would cause connection timeouts or DNS errors, not 403.

Answer

The SSL certificate has expired.

Answer

The application's database connection pool is exhausted.

Answer

The web server's IP address has changed.

Question 5

A security team is implementing Network Access Control (NAC) to enforce endpoint compliance before granting network access. Which technology allows port-based authentication on wired networks?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control that provides authentication to devices trying to connect to a wired or wireless network. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPOL) to encapsulate authentication messages between the supplicant (client) and the authenticator (switch or access point), which then relays them to an authentication server (typically RADIUS). This ensures that no traffic can pass through the port until the device is authenticated and authorized.

Answer

RADIUS

Answer

WPA2-Enterprise

Answer

MAC filtering

Question 6

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Accepted Answer

The ACCEPT rule matches before the DROP rule.. C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Answer

The DROP rule does not apply to SSH.

Answer

The DROP rule is misconfigured with wrong source.

Answer

The default policy allows traffic, overriding the DROP rule.

Question 7

A software developer wants to ensure the authenticity and integrity of an API request but does not require non-repudiation. Which cryptographic method should be used?

Accepted Answer

Hash-based message authentication code (HMAC). HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. This ensures both authenticity (the request came from a party knowing the key) and integrity (the data has not been altered) without providing non-repudiation, because the same key is shared between sender and receiver, so the receiver could also have generated the tag.

Answer

Digital signature using RSA

Answer

Symmetric encryption with CBC mode

Answer

Elliptic curve Diffie-Hellman (ECDH)

Question 8

What is the primary purpose of account deprovisioning in the account lifecycle?

Accepted Answer

To immediately disable accounts and preserve evidence. Deprovisioning is the formal process of removing a user's access when they leave or change roles. Its primary purpose is to immediately disable accounts to prevent unauthorized access while preserving the account and associated data as evidence for audits, investigations, or legal holds.

Answer

To modify user roles and permissions

Answer

To enforce password policies

Answer

To create new user accounts

Question 9

A user reports that their computer is displaying a fake antivirus warning that demands payment. This is an example of which type of attack?

Accepted Answer

Scareware. Scareware is a type of malware that uses social engineering to trick users into believing their system is infected, then demands payment for a fake removal tool. The fake antivirus warning is a classic scareware tactic, as it creates urgency and fear to coerce payment, unlike ransomware which encrypts files and demands a ransom for decryption.

Answer

Social engineering

Answer

Ransomware

Answer

Phishing

Question 10

A DevOps team implements a CI/CD pipeline for a web application. Which security control is BEST to ensure that only properly reviewed code reaches production?

Accepted Answer

Require a manual approval gate before deployment. Requiring a manual approval gate ensures a human has reviewed the code before deployment, which is the best way to ensure only properly reviewed code reaches production. Option A is wrong because SAST (static application security testing) is automated and may miss logic flaws or business logic issues that require human review. Option C is wrong because automated unit and integration tests verify functionality but do not constitute a code review; they can pass even if the code has logic errors or security issues not covered by tests. Option D is wrong because code signing ensures the integrity and authenticity of artifacts but does not involve reviewing the code content for correctness or security.

Answer

Run static application security testing (SAST) in the pipeline

Answer

Run automated unit tests and integration tests

Answer

Implement code signing for all artifacts

Question 11

A security engineer is reviewing the configuration of a web application that uses JSON Web Tokens (JWT) for session management. The engineer notices that the application accepts tokens signed with the 'none' algorithm. Which of the following is the most critical security risk associated with this configuration?

Accepted Answer

Attackers can forge tokens with arbitrary claims, leading to privilege escalation.. Accepting the 'none' algorithm means the application does not verify the token's signature. An attacker can craft a token with any claims and set the algorithm to 'none', bypassing authentication and authorization. This is a critical vulnerability that can lead to full account takeover and privilege escalation.

Answer

Tokens will be transmitted in plaintext, exposing sensitive information.

Answer

Tokens will expire prematurely, causing denial of service for legitimate users.

Answer

The application will experience performance degradation due to lack of signature verification.

Question 12

A security administrator is evaluating encryption protocols for email communication. Which of the following protocols can secure email in transit? (Select TWO)

Accepted Answer

IMAPS. IMAPS (Option A) is correct because it wraps the IMAP mail-retrieval protocol inside TLS (typically on TCP port 993), encrypting the client-to-server session so credentials and message contents are protected in transit. SMTPS (Option D) is correct because it applies TLS to SMTP (commonly on TCP port 465, or via STARTTLS on 587/25), securing the transport of outgoing email between mail clients and servers or between mail relays. HTTPS (Option B) secures web traffic via TLS but is not an email transport protocol, so it does not directly secure email in transit. SSH (Option C) provides an encrypted remote-shell/tunneling channel and is not an email protocol, and SFTP (Option E) is a file-transfer protocol over SSH, unrelated to securing email delivery.

Answer

HTTPS

Answer

SSH

Answer

SFTP

Question 13

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Accepted Answer

JavaScript execution in the browser's developer console that was not initiated by the user. XSS attacks often inject malicious JavaScript that executes in the victim's browser without user initiation. Observing unexpected script execution in the developer console indicates that an attacker's payload has run, which is a direct sign of a successful XSS exploit.

Answer

Unusual cookie values or multiple cookies

Answer

Unusual network traffic to external IP addresses

Question 14

A security analyst is reviewing firewall logs and notices a high rate of TCP SYN packets to multiple ports on a server, but no corresponding ACK or RST packets. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed source addresses, so the server allocates half-open connection state and replies with SYN-ACK but never receives the final ACK. The absence of ACK or RST responses in the logs is the signature of this half-open connection exhaustion attack.

Answer

UDP flood

Answer

Smurf attack

Answer

Ping of death

Question 15

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Accepted Answer

Write-once storage to prevent modification. Option A (write-once storage to prevent modification) is correct because WORM (Write Once Read Many) media or immutable storage ensures that once log data is written it cannot be altered or deleted, preserving evidentiary integrity for forensics. Option B (digital signing of logs to verify authenticity) is correct because cryptographic signatures or hashes let investigators prove logs were not tampered with and confirm their origin, supporting non-repudiation and chain-of-custody requirements. Option D (ensuring logs are retained for a period consistent with legal and regulatory requirements) is correct because forensic usefulness depends on having the relevant logs still available when an investigation occurs, and retention periods are often mandated by laws such as HIPAA, PCI DSS, or GDPR. Option C is not correct because minimizing retention to cut storage costs directly undermines forensic and compliance needs by destroying potentially critical evidence prematurely. Option E is not correct because centralizing logs improves correlation and management but does not by itself guarantee integrity or forensic usefulness, and it can even concentrate risk if the repository is not protected.

Answer

Minimizing log retention to reduce storage costs

Answer

Aggregating logs from all sources into one centralized repository

Question 16

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 17

An analyst runs the netstat command on a web server. Based on the output, which connection is the MOST suspicious?

Accepted Answer

The connection from 203.0.113.5:8080. 203.0.113.5 is from the documentation IP range (RFC 5737), which should not appear in real network traffic. This indicates potential spoofing or malicious activity. Options B and C are internal private IPs, which are expected. Option D is the normal HTTP listening service.

Answer

The connection from 192.168.1.10:54321

Answer

The connection from 10.0.2.50:44350

Answer

The listening on 0.0.0.0:80

Question 18

A security analyst is hardening a new Windows server. Which configuration would MOST effectively reduce the attack surface by limiting the software that can execute?

Accepted Answer

Configure AppLocker rules. AppLocker is a Windows application control feature that lets administrators define allow/deny rules based on publisher, path, or file hash, thereby restricting which executables, scripts, and installers can run. This directly limits the software that can execute, which is the most effective way to reduce attack surface against unauthorized or malicious code. Antivirus, AutoPlay, and UAC address other threats but do not control what software is permitted to run.

Answer

Enable Windows Defender Antivirus

Answer

Disable AutoPlay

Answer

Enable User Account Control (UAC)

Question 19

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. Patching the guest operating system and web server software is correct because in the IaaS shared responsibility model, the customer controls and is responsible for everything from the guest OS upward — including OS patches, middleware, runtime, and application code. The provider secures the physical hosts, hypervisor, and network fabric beneath the virtualization layer.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 20

A security analyst discovers that an internal DNS server is returning incorrect IP addresses for legitimate domains. The analyst suspects that an attacker has compromised the DNS resolver's cache. Which type of attack has likely occurred?

Accepted Answer

DNS poisoning. DNS poisoning (also called DNS cache poisoning or spoofing) occurs when an attacker injects forged DNS records into a resolver's cache, causing it to return incorrect IP addresses for legitimate domain names. The symptom described — a compromised resolver cache returning wrong IPs — is the textbook definition of this attack.

Answer

DNS amplification attack

Answer

SYN flood

Answer

DNS tunneling