SSCP Practice Test 32 — 15 Questions

Question 1

During a security audit, a penetration tester successfully extracts the PMKID from a wireless beacon. What information can be derived from this attack?

Accepted Answer

The ability to crack the passphrase offline. The PMKID attack captures the PMKID from a wireless beacon or association frame, which is derived from the PMK and other values. This PMKID can be used to perform an offline brute-force or dictionary attack against the passphrase (PSK). The attacker cannot directly derive the PMK or PSK from the PMKID, but can attempt to crack the passphrase offline.

Answer

The PMK (pairwise master key) directly

Answer

The encryption keys used in the session

Answer

The PSK (pre-shared key) directly

Question 2

Which THREE of the following are essential elements of an effective incident response plan? (Choose three.)

Accepted Answer

Containment, eradication, and recovery. The incident response plan lifecycle, as defined by NIST SP 800-61, includes four core phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Options A, B, and E directly map to these essential phases, ensuring the organization can detect an incident, contain it to prevent spread, eradicate the root cause, recover normal operations, and continuously improve through training and preparation.

Answer

Public relations and media notification

Answer

Cyber insurance purchasing

Question 3

An administrator notices that a certificate used for code signing is about to expire. The certificate is signed by a trusted root CA. What is the correct procedure to ensure continued trust?

Accepted Answer

Request a new certificate from the same CA before expiration. The correct procedure is to request a new certificate from the same trusted root CA before the current certificate expires. This ensures that the new certificate is signed by the same trusted root, maintaining the chain of trust without interruption. Continuing to use an expired certificate would break trust validation, as clients and operating systems reject expired code-signing certificates to prevent execution of untrusted code.

Answer

Continue using the expired certificate until a new one is obtained

Answer

Extend the validity period of the existing certificate by modifying the certificate

Answer

Switch to a self-signed certificate

Question 4

A company's incident response plan includes a step to preserve evidence. Which action BEST ensures the integrity of forensic evidence?

Accepted Answer

Create a forensic image with write blocker and hash. Creating a forensic image with a write blocker ensures that the original data is not altered during acquisition, and hashing (e.g., SHA-256) provides a cryptographic integrity check that can later verify the image is an exact bit-for-bit copy. This preserves the chain of custody and admissibility of evidence in legal proceedings.

Answer

Turn off the system immediately

Answer

Copy files to a network share

Answer

Run a checksum on the live system

Question 5

A security engineer is hardening a Linux server. Which TWO actions are recommended to reduce the attack surface? (Select TWO.)

Accepted Answer

Remove unnecessary services and daemons. Option A is correct because removing unnecessary services and daemons eliminates listening ports, binaries, and potential vulnerabilities that attackers could exploit, directly shrinking the attack surface. Option B is correct because disabling unused user accounts removes dormant credentials and login paths that could be abused for unauthorized access or privilege escalation. Option C is wrong because installing a web server for management adds a new network-facing service and increases, rather than reduces, the attack surface. Option D is wrong because setting umask to 000 makes newly created files world-readable and world-writable, weakening permissions instead of hardening them. Option E is wrong because enabling IPv6 routing adds network functionality and exposure that is unnecessary on a hardened server and can introduce additional attack vectors.

Answer

Install a web server for management

Answer

Set umask to 000

Answer

Enable IPv6 routing

Question 6

In X.509 certificate format, which field is used to specify the fully qualified domain name(s) for which the certificate is valid?

Accepted Answer

Subject Alternative Name. The Subject Alternative Name (SAN) extension in an X.509 certificate explicitly lists the fully qualified domain names (FQDNs), IP addresses, or other identifiers for which the certificate is valid. Modern browsers and TLS libraries primarily check the SAN field to validate a server's identity, ignoring the Common Name (CN) in the Subject field. The SAN is defined in RFC 5280 and is critical for multi-domain (SAN) certificates and wildcard certificates.

Answer

Key Usage

Answer

Issuer

Answer

Subject

Question 7

An organization is setting up a site-to-site VPN between two branch offices. They require encryption of the entire IP packet, including the original IP header, and plan to use IPsec. Which mode should they configure?

Accepted Answer

Tunnel mode. Tunnel mode in IPsec encapsulates the entire original IP packet, including the original IP header, within a new IP packet with a new IP header. This provides confidentiality and integrity for the entire packet and is typically used for site-to-site VPNs between gateways. Transport mode only encrypts the payload, leaving the original IP header intact, which does not meet the requirement.

Answer

Transport mode

Answer

ESP mode

Answer

AH mode

Question 8

A company's risk management policy states that all risks with a residual risk score of 8 or higher (on a scale of 1-10) must be treated. A risk is identified with an inherent risk score of 9, and after applying controls, the residual risk score is 7. What is the appropriate action?

Accepted Answer

Formally accept the residual risk. The policy threshold is a residual risk score of 8 or higher requiring treatment. The residual score after controls is 7, which is below the threshold, so the risk no longer mandates further treatment and can be formally accepted. Inherent risk (9) is only the pre-control score and is not the trigger for action once controls are applied. Therefore, documenting acceptance of the residual risk is the correct action.

Answer

Apply additional controls to reduce the risk further

Answer

Purchase cyber insurance to transfer the risk

Answer

Reassess the inherent risk score

Question 9

A security analyst is recommending a symmetric encryption algorithm for a new application that requires both confidentiality and authentication. Which algorithm and mode combination should they select?

Accepted Answer

AES-GCM. AES-GCM (Galois/Counter Mode) is a symmetric encryption algorithm that provides both confidentiality and authentication in a single, efficient operation. It combines AES encryption in counter mode with a Galois field-based message authentication code (GMAC), making it ideal for applications requiring both security properties.

Answer

3DES-CBC

Answer

AES-ECB

Answer

RC4

Question 10

After an incident, what is the primary purpose of a lessons learned meeting?

Accepted Answer

Improve future response. The primary purpose of a lessons learned meeting after an incident is to identify what worked well and what did not during the response, enabling the team to refine procedures, update playbooks, and improve future incident response effectiveness. This aligns with the continuous improvement cycle in incident management, as outlined in NIST SP 800-61 and ISO 27035, where the focus is on process enhancement rather than punitive measures.

Answer

Update security policies

Answer

Assign blame

Answer

Document findings for litigation

Question 11

A security team identifies a vulnerability in a web application that allows SQL injection. Which risk response strategy involves implementing input validation and parameterized queries to reduce the risk to an acceptable level?

Accepted Answer

Risk mitigation. Risk mitigation involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. Implementing input validation and parameterized queries directly addresses the SQL injection vulnerability by preventing malicious SQL from being executed, thereby reducing the risk without eliminating the application's functionality.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 12

A security analyst reviews log files and sees multiple failed SSH attempts from various IP addresses. The analyst implements a rate-limiting rule on the firewall to block IPs after 5 failed attempts in 10 minutes. This is an example of which type of security control?

Accepted Answer

Preventive. Rate-limiting SSH attempts by blocking IPs after 5 failed attempts in 10 minutes is a preventive control because it actively stops unauthorized access before it can occur. By enforcing a threshold on the firewall, the control reduces the attack surface against brute-force attacks, directly preventing further authentication attempts from suspicious sources.

Answer

Compensating

Answer

Detective

Answer

Deterrent

Answer

Corrective

Question 13

Match each access control model to its description.

Accepted Answer

Discretionary Access Control (DAC): Access decisions are based on the identity of the subject and the discretion of the object owner.. The four primary access control models are DAC (owner-determined), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include mixing up DAC and MAC, or RBAC with DAC.

Answer

Discretionary Access Control (DAC): Access is based on security labels and clearances.

Answer

Role-Based Access Control (RBAC): Access decisions are made by the data owner.

Question 14

A network administrator is designing a secure remote access solution for employees using company laptops. The solution must support strong authentication, encryption, and be resistant to man-in-the-middle attacks. Which THREE components should be included?

Accepted Answer

EAP-TLS for authentication. EAP-TLS (B) is correct because it uses digital certificates on both client and server to perform mutual authentication, providing strong identity verification and enabling the certificate-based trust needed to resist impersonation. IPsec in tunnel mode (C) is correct because it encrypts and authenticates the entire original IP packet between endpoints, protecting confidentiality and integrity of the traffic across an untrusted network. IKEv2 (E) is correct because it securely negotiates and rekeys IPsec security associations using strong cryptographic exchanges, and its support for MOBIKE helps maintain secure sessions while resisting man-in-the-middle interception. L2TP (A) is not correct here because by itself it provides tunneling but no encryption or strong authentication, so it must be paired with IPsec rather than being the security component. PPTP with MPPE (D) is not correct because PPTP is obsolete and its MS-CHAPv2 authentication and MPPE encryption have well-known weaknesses that make it vulnerable to credential cracking and MITM attacks.

Answer

L2TP tunneling protocol

Answer

PPTP with MPPE encryption

Question 15

A company is migrating from WPA2 to WPA3 for wireless security. Which THREE features does WPA3 introduce? (Select three)

Accepted Answer

192-bit security suite for Enterprise networks. WPA3 introduces the 192-bit security suite for Enterprise networks (option A), which is based on CNSA Suite algorithms and provides stronger cryptographic protection for government, defense, and high-security enterprise environments. Simultaneous Authentication of Equals (SAE) (option C) is the new WPA3-Personal handshake that replaces WPA2's PSK method, providing forward secrecy and resistance to offline dictionary attacks. Protected Management Frames (PMF) mandatory (option D) is correct because WPA3 requires PMF (802.11w) to protect management frames from forging and eavesdropping attacks, whereas it was optional in WPA2. Wi-Fi Protected Setup (WPS) (option B) is not a WPA3-introduced feature; it predates WPA3 and is actually discouraged due to security weaknesses. CCMP encryption as mandatory (option E) is incorrect because CCMP is the WPA2 mandatory cipher, while WPA3-Personal still uses CCMP-128 but also introduces GCMP-256 in the 192-bit suite, so CCMP being 'mandatory' is not a new WPA3 feature.

Answer

Wi-Fi Protected Setup (WPS)

Answer

CCMP encryption as mandatory