SSCP Practice Test 31 — 15 Questions

Question 1

A system administrator notices a high number of half-open TCP connections to the company's web server. The server is becoming unresponsive. Which attack is likely occurring, and which mitigation is effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood; mitigation: enable SYN cookies.. A SYN flood attack exploits the TCP three-way handshake by sending many SYN packets with spoofed source addresses, leaving the server with numerous half-open connections that exhaust the backlog queue. Enabling SYN cookies allows the server to avoid allocating state until the handshake completes, mitigating the flood. This matches the symptom of high half-open TCP connections and an unresponsive web server.

Answer

ARP spoofing; mitigation: static ARP entries.

Answer

Smurf attack; mitigation: disable IP broadcasts.

Answer

Ping of death; mitigation: block fragmented ICMP packets.

Question 2

A company is implementing a biometric authentication system for physical access to a data center. The system must minimize false acceptances. Which metric is most directly related to false acceptance rate (FAR)?

Accepted Answer

Threshold setting. FAR is the rate at which an unauthorized person is incorrectly accepted. The threshold setting directly impacts FAR; a higher (more stringent) threshold reduces FAR but may increase FRR.

Answer

Crossover error rate (CER)

Answer

Equal error rate (EER)

Answer

False rejection rate (FRR)

Question 3

A security analyst is investigating a network incident. Which TWO of the following are indicators of a man-in-the-middle attack using ARP spoofing? (Select TWO)

Accepted Answer

An ARP entry for the default gateway points to an unknown MAC address.. Option B is correct because in ARP spoofing the attacker sends forged ARP replies claiming the gateway's IP, so the victim's ARP entry for the default gateway resolves to the attacker's (unknown/unexpected) MAC address instead of the legitimate router MAC. Option C is correct because duplicate/conflicting ARP entries—two different MAC addresses bound to the same IP such as the gateway IP—are a classic sign of ARP cache poisoning, where the attacker's reply overwrites or races with the legitimate mapping. Option A is not specific to ARP spoofing, since TCP retransmissions can result from many causes (congestion, packet loss, duplex mismatch) and are only a generic symptom. Option D describes MAC flooding against a switch CAM table, not ARP spoofing. Option E (multiple IPs mapping to one MAC) is typical of NAT, proxy ARP, or a router interface, not an ARP spoofing indicator.

Answer

High number of TCP retransmissions from a single host.

Answer

The switch's CAM table has multiple MAC entries on the same port.

Answer

Multiple IP addresses resolve to the same MAC address in the ARP cache.

Question 4

Which TWO of the following are examples of technical threat sources that should be considered during risk identification?

Accepted Answer

Hardware failure. Hardware failure (B) is a technical threat source because it arises from the failure of IT infrastructure components such as servers, disks, or network devices, which is a classic technology-originated risk considered in risk identification. Software bug (D) is also a technical threat source, as flaws in application or system code can introduce vulnerabilities and cause failures or exploitable conditions. These two are correct because they stem from technology itself rather than from natural events or deliberate human behavior. In contrast, earthquake (A) is an environmental/natural threat source, unauthorized access by employee (C) is a human/internal threat source, and social engineering (E) is a human-driven threat that exploits people rather than a technical fault.

Answer

Earthquake

Answer

Unauthorized access by employee

Answer

Social engineering

Question 5

When using CBC mode encryption, what is the purpose of the initialization vector (IV)?

Accepted Answer

To add randomness and prevent identical ciphertext for repeated plaintext. The initialization vector (IV) in CBC mode ensures that each encryption of the same plaintext with the same key produces a different ciphertext. The IV is XORed with the first plaintext block before encryption, introducing randomness that prevents patterns from being exposed in the ciphertext, which is critical for semantic security.

Answer

To provide authentication

Answer

To increase the key length

Answer

To enable parallel encryption

Question 6

A company is implementing a new file-sharing application for employees. Which of the following is the most important security control to prevent unauthorized access to shared files?

Accepted Answer

Implement access control lists (ACLs) on shared folders.. Implementing access control lists (ACLs) on shared folders is the most direct and effective control to prevent unauthorized access to shared files. ACLs define which users or groups have permissions to read, write, or execute files, thereby enforcing the principle of least privilege.

Answer

Schedule regular backups.

Answer

Install antivirus software on all endpoints.

Answer

Enable detailed audit logging.

Answer

Encrypt files with AES-256.

Question 7

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) is a correct answer because it defines the maximum acceptable downtime after a disruption, specifying how quickly systems and services must be restored, which is a core metric every DRP must establish to guide recovery priorities. The Recovery Point Objective (RPO) is also correct because it defines the maximum tolerable amount of data loss measured in time, determining the required backup frequency and replication strategy within the DRP. Together, RTO and RPO are essential, quantifiable components that shape the recovery strategies, resource allocation, and backup/replication design of a disaster recovery plan. The Business Continuity Plan (BCP) is not a component of a DRP but rather a broader, higher-level plan that encompasses and coordinates the DRP alongside other continuity activities. A RACI matrix for incident response belongs to incident management and role assignment, not to the essential recovery objectives of a DRP, and penetration test results are security assessment artifacts that may inform risk analysis but are not essential DRP components.

Answer

Business Continuity Plan (BCP)

Answer

A RACI matrix for incident response

Answer

Results of a penetration test

Question 8

A BYOD policy allows personal devices to access corporate email. What is the best control to enforce device encryption and remote wipe?

Accepted Answer

Mobile Device Management (MDM) profile. An MDM profile pushes configuration and policy to enrolled personal devices, including enforced storage encryption, screen-lock requirements, and the ability to issue a remote wipe of corporate data. It is the standard control for BYOD because it operates at the OS management layer regardless of the network path.

Answer

Network Access Control (NAC)

Answer

Containerization app

Answer

Mandatory VPN connection

Question 9

A network security team is implementing a defense-in-depth strategy. Which three layers should be included? (Choose three.)

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is a key layer in defense-in-depth because it monitors network traffic for suspicious activity and known attack signatures, providing visibility and alerting when perimeter defenses like firewalls are bypassed. It operates by analyzing packets against a rule set (e.g., Snort rules) and generating alerts, enabling a response before damage escalates. This adds a detection layer that complements preventive controls, ensuring that even if an attacker penetrates the outer defenses, the breach is identified.

Answer

Single sign-on (SSO)

Answer

Physical security controls

Question 10

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Accepted Answer

Extend log retention period to at least 1 year. The organization's log retention policy was insufficient to cover the incident timeline. The SIEM retained logs for only 90 days, but the incident occurred 120 days ago, meaning the logs were overwritten or purged before the incident was discovered. Extending the retention period to at least one year ensures logs are available for post-incident forensic analysis, aligning with industry best practices (e.g., NIST SP 800-61) and regulatory requirements that often mandate 6–12 months of log retention.

Answer

Use a different SIEM vendor

Answer

Increase log verbosity

Answer

Implement real-time alerting

Question 11

An organization needs to recover data from a backup after a ransomware attack. The backup was taken 12 hours ago, and the RPO is 4 hours. What is the impact?

Accepted Answer

The RPO is violated because more than 4 hours of data may be lost. RPO (Recovery Point Objective) defines the maximum acceptable data loss. If the backup is 12 hours old and RPO is 4 hours, the organization has lost 8 hours of data, exceeding the objective.

Answer

The RPO is met because data can be recovered

Answer

The RTO is exceeded

Answer

The 3-2-1 rule is violated

Question 12

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

Accepted Answer

Key performance indicator (KPI). A Key Performance Indicator (KPI) is a measurable value that demonstrates how effectively an organization is achieving key business objectives. The percentage of systems with critical patches applied within 48 hours is a performance metric that tracks the efficiency of the patch management process, making it a KPI. It indicates how well the security team is performing against a defined target.

Answer

Service level agreement (SLA)

Answer

Control objective

Answer

Key risk indicator (KRI)

Question 13

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Accepted Answer

SLE = $20,000, ALE = $10,000. The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.

Answer

SLE = $50,000, ALE = $25,000

Answer

SLE = $10,000, ALE = $5,000

Answer

SLE = $20,000, ALE = $40,000

Question 14

Which access control model allows the owner of a resource to grant permissions to others?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is defined by the owner of an object having the discretion to grant or revoke access to other subjects, typically via ACLs on files or resources. This owner-controlled permission model is the defining characteristic of DAC, as opposed to MAC where the system enforces labels and RBAC where roles determine access.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 15

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

Accepted Answer

Risk monitoring. The analyst is actively monitoring the VPN gateway for security events (failed logins) and then adjusting controls (lockout threshold, geo-IP blocking) in response to observed threats. This continuous observation and adjustment is the essence of risk monitoring, which is the ongoing process of tracking identified risks and evaluating the effectiveness of controls. The actions taken are not about identifying new risks, assessing their likelihood/impact, or formally reporting them, but rather about reacting to real-time data to maintain an acceptable risk posture.

Answer

Risk identification

Answer

Risk assessment

Answer

Risk reporting