SSCP Practice Test 31 — 15 Questions

Question 1

A company implements a password policy requiring a minimum length of 12 characters, including uppercase, lowercase, digits, and special characters. Passwords must be changed every 90 days, and the last 10 passwords cannot be reused. After a brute-force attack, several accounts were compromised despite the policy. Which additional control would most effectively mitigate such attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a number of failed attempts prevents brute-force attacks by limiting the number of guesses an attacker can make.

Answer

Use a password blacklist

Answer

Increase minimum password length to 16 characters

Answer

Require password change every 30 days

Question 2

Refer to the exhibit. A security analyst notices that multiple internal hosts are using the same inside global IP address but different port numbers. Which technology is being used?

Accepted Answer

PAT (Port Address Translation). The scenario describes multiple internal hosts sharing a single inside global IP address but using different port numbers. This is the defining behavior of Port Address Translation (PAT), also known as NAT overload. PAT maps multiple private IP addresses to one public IP by differentiating sessions based on the transport-layer port number (TCP/UDP), allowing many hosts to share a single public address.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Port forwarding

Question 3

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

Accepted Answer

Removing the backdoor executable and associated persistence mechanisms. In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging. Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Answer

Resetting all user passwords

Answer

Reimaging all affected systems from a known-good backup

Answer

Conducting security awareness training for all employees

Question 4

Refer to the exhibit. Which of the following is most likely a web browsing session?

Accepted Answer

192.168.1.100:49154 to 74.125.224.72:443. It shows an HTTPS session to port 443, which is the most common web browsing protocol. Option A also shows an HTTP session (port 80), which is a web browsing session, but HTTPS is more prevalent. Option C shows a DNS query (port 53), which is not a web browsing session; it is a name resolution protocol. Therefore, only B is a web browsing session, and option D is incorrect because it includes C.

Answer

192.168.1.100:49152 to 203.0.113.10:80

Answer

192.168.1.100:49153 to 192.168.1.1:53

Answer

Both A and C

Question 5

An analyst detects suspicious outbound traffic from a workstation to a known command-and-control IP. Which IoC blocking method is MOST appropriate as an immediate containment measure?

Accepted Answer

Block the IP address at the perimeter firewall. Blocking the IP address at the perimeter firewall is the most appropriate immediate containment measure because it directly cuts the outbound communication channel to the known command-and-control (C2) server. This stops data exfiltration and prevents the attacker from issuing further commands, buying time for deeper analysis. Firewall ACLs or blackhole routes can be applied in seconds without altering the endpoint, which is critical when the malware may have persistence mechanisms or anti-forensic capabilities.

Answer

Delete the malicious files from the system

Answer

Remove the malware from the workstation using EDR

Answer

Disable the user's account

Question 6

During a ransomware incident, the incident response team needs to recover encrypted servers. Which THREE steps are essential for successful recovery? (Select THREE)

Accepted Answer

Restore data from the most recent clean backup. Restoring from the most recent clean backup is the primary recovery method for ransomware incidents. It ensures that encrypted data can be recovered without paying the ransom, provided the backup was taken before the infection and is stored offline or immutable to prevent encryption. This aligns with the 3-2-1 backup strategy (three copies, two media types, one offsite) and is a core step in the NIST SP 800-61 incident response process.

Answer

Pay the ransom to obtain the decryption key

Answer

Delete all user accounts and recreate them

Question 7

An organization wants to implement a cryptographic solution that ensures forward secrecy for its internal communications. Which key exchange method should be used?

Accepted Answer

Diffie-Hellman Ephemeral (DHE). DHE (Diffie-Hellman Ephemeral) generates a fresh, temporary key pair for each session and never reuses the private key, ensuring that compromise of a long-term key does not expose past session keys. This provides forward secrecy because the ephemeral keys are destroyed after the session ends, making it computationally infeasible to decrypt recorded traffic even if the server's static key is later compromised.

Answer

RSA key exchange

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

Static Diffie-Hellman

Question 8

Match each security control to its type (administrative, technical, physical).

Accepted Answer

Firewall: Technical. Firewall, security policy, and biometric lock are correctly matched to technical, administrative, and physical controls respectively. Common confusions include misclassifying firewalls as physical controls or security policies as technical controls.

Answer

Firewall: Physical

Answer

Security Policy: Technical

Question 9

If the web server is compromised, which of the following is a likely immediate risk?

Accepted Answer

Direct compromise of the database server. When a web server is compromised, the immediate risk is direct compromise of the database server because the web server typically holds the database credentials (e.g., in a configuration file like wp-config.php or appsettings.json) and has a trusted network path to the database. An attacker can pivot from the web server to the database server using those credentials, often over port 3306 (MySQL) or 1433 (MSSQL), without needing to bypass additional authentication.

Answer

Loss of web application data

Answer

Denial of service to the web server

Answer

Compromise of user credentials

Question 10

Match each security policy type to its purpose.

Accepted Answer

Acceptable Use Policy: Defines acceptable behaviors and proper use of organizational IT resources.. The correct matches are: Acceptable Use Policy (acceptable use), Data Classification Policy (data categorization), Password Policy (password rules), Incident Response Policy (incident handling). Common confusions: mixing up policy scopes.

Answer

Acceptable Use Policy: Outlines procedures for incident detection and response.

Answer

Data Classification Policy: Defines rules for password complexity and rotation.

Question 11

A security team detects lateral movement within the network. Which containment strategy should be applied first to limit the spread of the threat?

Accepted Answer

Isolate the affected systems by disconnecting them from the network.. Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

Answer

Disable user accounts associated with compromised systems.

Answer

Block the attacker's IP addresses at the perimeter firewall.

Answer

Reimage all compromised systems immediately.

Question 12

A security analyst is investigating a phishing incident that led to credential theft. Which TWO actions are appropriate during the containment phase? (Select TWO)

Accepted Answer

Reset the compromised user's password. Resetting the compromised user's password (A) immediately invalidates the stolen credentials, preventing the attacker from using them for further unauthorized access. This is a critical containment step because it cuts off the attacker's authenticated session and access to resources like email, VPN, or cloud services. Blocking the phishing domain at the email gateway (E) prevents additional users from receiving the phishing email, reducing the attack surface and stopping the spread of the incident. Both actions directly limit the impact and scope of the breach during the containment phase.

Answer

Update the incident response plan

Answer

Conduct a lessons learned meeting

Answer

Restore the user's machine from backup

Question 13

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Answer

Detection and Analysis

Question 14

Which of the following is a secure protocol for remote administration of a server, replacing insecure protocols like Telnet?

Accepted Answer

SSH. SSH (Secure Shell) is the correct answer because it provides encrypted remote administration capabilities, replacing insecure protocols like Telnet that transmit data in plaintext. SSH uses public-key cryptography for authentication and symmetric encryption (e.g., AES, ChaCha20) for session confidentiality, protecting against eavesdropping and man-in-the-middle attacks.

Answer

FTP

Answer

HTTP

Answer

Telnet

Question 15

A multinational corporation is migrating its on-premises applications to a cloud provider. The identity management infrastructure must support single sign-on (SSO) across multiple cloud services and maintain on-premises Active Directory as the authoritative identity source. The security team is concerned about credential stuffing attacks and password spray attacks. They want to implement a risk-based access policy that requires additional verification when logins originate from unusual locations or devices. Additionally, they need to ensure that user accounts are provisioned and deprovisioned in the cloud in near real-time based on AD changes. Which of the following solutions BEST meets these requirements?

Accepted Answer

Implement a SAML-based federation with AD FS and integrate with Azure AD Conditional Access policies.. SAML-based federation with AD FS and Azure AD Conditional Access provides SSO, risk-based policies (Conditional Access uses real-time signals like location and device), and near-real-time provisioning via Azure AD Connect. VPN with smart cards does not provide SSO or risk-based policies. OAuth 2.0 with client credentials is not for user authentication. A separate cloud identity store with password sync introduces delays and does not support risk-based access.

Answer

Deploy a VPN that requires smart card authentication for all cloud access.

Answer

Use OAuth 2.0 with client credentials grant for all applications.

Answer

Set up a separate cloud identity store and synchronize passwords using a directory sync tool.