SSCP Practice Test 3 — 30 Questions

Question 1

A company uses a cloud storage service that encrypts files with a key derived from the user's password (e.g., using PBKDF2). The security team recommends migrating to a separate key management service (KMS) that generates and manages encryption keys independently of user passwords. What is the most critical security advantage of using a KMS in this scenario?

Accepted Answer

Changing the user password does not require re-encrypting all files.. Option B is correct because when encryption keys are derived from a user's password (e.g., via PBKDF2), changing the password changes the derived key, requiring all files encrypted under the old key to be decrypted and re-encrypted with the new key. A separate KMS decouples key management from user credentials, allowing password changes without affecting the underlying encryption keys, thus avoiding costly and time-consuming re-encryption operations.

Answer

Password-derived keys are inherently weaker than KMS-generated keys.

Answer

A KMS is faster at encrypting and decrypting large files.

Answer

A KMS provides better audit logging of key usage.

Question 2

Which TWO factors are most critical when selecting a cryptographic algorithm for a government application?

Accepted Answer

Key length. For government applications, regulatory compliance (e.g., FIPS 140-2) is critical because it mandates that cryptographic modules meet specific security standards for protecting sensitive data. Key length is equally critical because it directly determines the algorithm's resistance to brute-force attacks; insufficient key length can render encryption ineffective regardless of other factors.

Answer

Speed of encryption/decryption

Answer

Algorithm popularity

Answer

Ease of implementation

Question 3

An organization wants to implement a cryptographic solution that ensures forward secrecy for its internal communications. Which key exchange method should be used?

Accepted Answer

Diffie-Hellman Ephemeral (DHE). DHE (Diffie-Hellman Ephemeral) generates a fresh, temporary key pair for each session and never reuses the private key, ensuring that compromise of a long-term key does not expose past session keys. This provides forward secrecy because the ephemeral keys are destroyed after the session ends, making it computationally infeasible to decrypt recorded traffic even if the server's static key is later compromised.

Answer

RSA key exchange

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

Static Diffie-Hellman

Question 4

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Accepted Answer

DES. DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.

Answer

RSA-2048

Answer

AES-256

Question 5

Refer to the exhibit. A network engineer is configuring a site-to-site VPN. The remote peer is using AES-256 encryption and SHA-1 for integrity. Which configuration parameter is likely misconfigured?

Accepted Answer

Group 5. The remote peer is using AES-256 encryption and SHA-1 for integrity, which are both supported in an IPsec transform-set. However, the exhibit shows that the local peer is configured with Group 5 (Diffie-Hellman 1536-bit), while the remote peer likely expects a different DH group (e.g., Group 2 or Group 14). DH group mismatch during Phase 1 (IKE) negotiation causes the VPN tunnel to fail, even if encryption and integrity algorithms match.

Answer

Transform-set

Answer

Pre-shared key

Answer

IKE lifetime

Question 6

Which TWO of the following are appropriate actions when preserving digital evidence at a crime/incident scene?

Accepted Answer

Document all actions taken. Documenting all actions taken (Option A) is a fundamental principle of digital forensics, as it creates a verifiable chain of custody and ensures the integrity of evidence. This documentation includes timestamps, tools used, and any changes made to the system, which is critical for admissibility in legal proceedings. Without proper documentation, the evidence may be challenged as tampered or unreliable.

Answer

Connect to the internet to check online resources

Answer

Use the system to check files

Answer

Power off the system immediately

Question 7

In a forensic investigation, a hash of a suspect file is computed. Which of the following is the primary purpose of hashing in this context?

Accepted Answer

To verify file integrity. In forensic investigations, hashing (using algorithms like SHA-256 or MD5) produces a unique fixed-size digest of the file's contents. The primary purpose is to verify file integrity by comparing the hash before and after analysis, ensuring the evidence has not been altered. This provides a cryptographic chain of custody, as any change to the file results in a completely different hash value.

Answer

To compress the file

Answer

To decrypt the file

Answer

To identify the file owner

Question 8

Which THREE of the following are standard phases of the incident response lifecycle?

Accepted Answer

Preparation. Option A is correct because Preparation is the foundational phase of the incident response lifecycle, as defined by NIST SP 800-61 Rev. 2. This phase involves establishing policies, creating incident response plans, forming a CSIRT, and provisioning tools (e.g., SIEM, forensic workstations) before any incident occurs. Without proper preparation, all subsequent phases are significantly less effective.

Answer

Auditing

Answer

Budgeting

Question 9

A company uses a SOAR platform for incident response. Which factor is most critical for effective automation?

Accepted Answer

High-quality playbooks. High-quality playbooks are the most critical factor because SOAR automation relies on predefined, tested, and context-rich workflows to orchestrate response actions. Without accurate playbooks that map to specific incident types, automated actions can misidentify threats, execute incorrect containment steps, or fail to adapt to evolving attack patterns, rendering integrations and feeds ineffective.

Answer

Integration with all security tools

Answer

Low false positive rate

Answer

Real-time threat intelligence feeds

Question 10

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer

Question 11

An organization has detected a ransomware infection on a critical file server. The incident response team has been activated. Which TWO actions should be performed FIRST during the initial response phase?

Accepted Answer

Immediately disconnect the file server from the network. Option B is correct because immediately disconnecting the file server from the network is a critical containment action that stops the ransomware from encrypting additional files on the server and prevents lateral movement to other systems. This aligns with the first priority in incident response: containment before eradication or recovery. Disconnecting at the switch port or disabling the network interface card (NIC) is preferred over a graceful shutdown to avoid triggering any persistence mechanisms.

Answer

Determine the type of ransomware variant

Answer

Reimage the file server using a known good backup

Answer

Notify law enforcement authorities

Question 12

A network engineer configures a VLAN hopping attack prevention by setting all unused switch ports to an unused VLAN and disabling trunking. What vulnerability is being mitigated?

Accepted Answer

DTP spoofing. DTP spoofing is the correct answer because VLAN hopping attacks often exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between a switch and an attacker's device, allowing the attacker to send and receive traffic on multiple VLANs. By disabling trunking on all unused ports and assigning them to an unused VLAN, the switch will not respond to DTP negotiation requests, preventing unauthorized trunk establishment.

Answer

STP manipulation

Answer

ARP spoofing

Answer

MAC flooding

Answer

DHCP starvation

Question 13

A company wants to ensure that employees connecting from home use a secure tunnel to access internal resources. Which protocol should be implemented?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN creates an encrypted tunnel over HTTPS (port 443) between the remote user's browser or client and the corporate VPN gateway, securing all traffic to internal resources. This is the standard solution for remote access VPNs because it uses ubiquitous SSL/TLS protocols, avoids the need for IPsec client software, and can traverse firewalls and NAT devices easily.

Answer

SFTP

Answer

Telnet

Answer

SSH

Question 14

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 15

Which wireless encryption protocol is currently considered the most secure for home use?

Accepted Answer

WPA3-Personal. WPA3-Personal is currently the most secure wireless encryption protocol for home use because it replaces the Pre-Shared Key (PSK) model with Simultaneous Authentication of Equals (SAE), which provides forward secrecy and protects against offline dictionary attacks. Unlike WPA2, WPA3 mandates the use of GCMP-256 encryption and disables legacy TKIP, ensuring robust confidentiality and integrity for home networks.

Answer

WPA2-Enterprise

Answer

WEP (Wired Equivalent Privacy)

Answer

WPA2-PSK

Question 16

During a penetration test, the tester captures traffic on a switch port that is part of a VLAN other than the native VLAN. The tester is able to receive traffic destined for the management VLAN. What configuration flaw is exploited?

Accepted Answer

Trunk port misconfiguration with native VLAN mismatch. The correct answer is B because the scenario describes a native VLAN mismatch on a trunk port. When two switches have different native VLANs configured on a trunk, they will not tag frames for their respective native VLANs. This allows an attacker on a non-native VLAN to receive traffic destined for the management VLAN (typically VLAN 1) by sending frames with no 802.1Q tag, which the receiving switch treats as belonging to its own native VLAN, effectively bypassing VLAN segmentation.

Answer

Spanning tree protocol is enabled

Answer

Port security is not enabled

Answer

DHCP snooping is disabled

Answer

VLAN trunking protocol (VTP) is set to transparent mode

Question 17

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 18

A network analyst reviews firewall logs and sees multiple SYN packets to various ports from the same external IP in a short time, with no subsequent ACK. What is the most likely cause?

Accepted Answer

Port scan using SYN scan technique. A SYN scan sends SYN packets to multiple ports; if a port is open, the target responds with SYN-ACK, but the scanner never completes the handshake (no ACK). The absence of ACK packets after the SYN packets indicates the scanner is not establishing connections, which is characteristic of a SYN scan, not a brute force or DDoS attack.

Answer

Brute force password attack on SSH

Answer

Distributed denial-of-service (DDoS) attack

Answer

ICMP ping sweep

Question 19

Which TWO are benefits of network segmentation using VLANs? (Choose two.)

Accepted Answer

Improved security through traffic isolation. VLANs segment a network into separate broadcast domains at Layer 2. By isolating traffic between VLANs, they prevent unauthorized access and contain potential threats, which directly improves security. Additionally, because each VLAN is its own broadcast domain, broadcast frames are confined to that VLAN, reducing overall broadcast traffic on the network.

Answer

Increased available bandwidth

Answer

Elimination of routing requirements

Answer

Simplified IP address management

Question 20

Which TWO protocols are used to secure email communication at the message level?

Accepted Answer

PGP. PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) are the two primary protocols that secure email at the message level. They encrypt the entire email body and attachments, ensuring end-to-end confidentiality and integrity regardless of the transport path. PGP uses a web of trust model, while S/MIME relies on a hierarchical public key infrastructure (PKI) with X.509 certificates.

Answer

IPsec

Answer

SSL/TLS

Answer

SSH