SSCP Practice Test 32 — 15 Questions

Question 1

Which TWO of the following are key components of a risk assessment process?

Accepted Answer

Asset identification. Asset identification (B) is a key component because you cannot assess risk without knowing what assets need protection. Threat identification (E) is also essential because risk is defined as the likelihood of a threat exploiting a vulnerability to cause harm to an asset. Together, asset and threat identification form the foundational inputs for calculating risk.

Answer

Control testing

Answer

Vulnerability identification

Answer

Risk treatment selection

Question 2

A risk manager is calculating the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $5,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$1,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, SLE = $5,000 and ARO = 0.2, so ALE = $5,000 × 0.2 = $1,000. This represents the expected annual financial loss from the server risk.

Answer

$25,000

Answer

$5,000

Answer

$100

Question 3

A company wants to implement a key management system. They need to generate cryptographic keys that are unpredictable. Which source of randomness should be used?

Accepted Answer

Hardware random number generator (HRNG). A hardware random number generator (HRNG) is the correct choice because it derives randomness from physical processes (e.g., thermal noise, quantum effects) that are inherently unpredictable and non-deterministic. Cryptographic key generation requires true entropy to resist brute-force and prediction attacks, which software-based deterministic methods cannot guarantee.

Answer

Random numbers from a website

Answer

Linear congruential generator (LCG)

Answer

Pseudorandom number generator (PRNG) seeded with current timestamp

Question 4

A security analyst is recommending a symmetric encryption algorithm for a new application that requires both confidentiality and authentication. Which algorithm and mode combination should they select?

Accepted Answer

AES-GCM. AES-GCM (Galois/Counter Mode) is a symmetric encryption algorithm that provides both confidentiality and authentication in a single, efficient operation. It combines AES encryption in counter mode with a Galois field-based message authentication code (GMAC), making it ideal for applications requiring both security properties.

Answer

3DES-CBC

Answer

AES-ECB

Answer

RC4

Question 5

Which type of IDS uses a database of known attack patterns to identify malicious activity?

Accepted Answer

Signature-based IDS. Signature-based IDS (D) is correct because it relies on a pre-defined database of known attack patterns, or signatures, to match against network traffic or system activity. When a packet or event matches a signature, the IDS generates an alert. This is the traditional method used by systems like Snort, which compares traffic against rule sets containing specific byte sequences or protocol anomalies.

Answer

Behavior-based IDS

Answer

Network-based IDS

Answer

Anomaly-based IDS

Question 6

An organization uses a hot disaster recovery (DR) site and has a Recovery Time Objective (RTO) of 4 hours. During a DR test, the team discovers that data replication from the primary site fails. Which TWO actions should the team take to meet the RTO while ensuring data integrity? (Choose two.)

Accepted Answer

Verify the integrity of the backup before restoration using hash checks.. Verifying the integrity of the backup using hash checks (e.g., SHA-256 or MD5) ensures that the data has not been corrupted during storage or transfer, which is critical before restoration to maintain data integrity. Option D is correct because restoring the latest valid backup from the primary site to the DR site provides a known-good data set, allowing the organization to meet the 4-hour RTO by having a consistent state to failover to, even if replication has failed.

Answer

Extend the RTO to allow time for manual data re-entry.

Answer

Failover to the hot DR site immediately without data restoration.

Answer

Switch to a cold DR site that requires hardware setup.

Question 7

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 8

What is the primary purpose of a baseline configuration in configuration management?

Accepted Answer

To provide a consistent, secure starting point for systems. A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

Answer

To store configuration items in the CMDB

Answer

To detect malware infections

Answer

To track software licenses

Question 9

During a physical security audit, it is discovered that employees often prop open the mantrap door to allow easier access. What is the BEST control to address this?

Accepted Answer

Add a time-delay alarm that triggers if the door is open too long. A time-delay alarm is the best control because it directly addresses the root cause—employees propping the door open—by alerting security or triggering a response if the door remains open beyond a preset interval (e.g., 10–30 seconds). This maintains the integrity of the mantrap, which is designed to prevent tailgating and unauthorized access by ensuring only one person enters at a time. Unlike passive measures, the alarm provides immediate feedback and deterrence against the unsafe behavior.

Answer

Implement a clean desk policy

Answer

Install a CCTV camera to monitor the mantrap

Answer

Use biometric readers on both doors

Question 10

An organization is migrating from 3DES to AES-256 for encrypting data at rest. Which mode of AES is recommended for authenticated encryption?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides both confidentiality and authenticity in a single, efficient mode. For data at rest, authenticated encryption ensures that encrypted data cannot be tampered with undetected, which is critical for integrity. AES-256-GCM is widely recommended and standardized (NIST SP 800-38D) for this purpose.

Answer

ECB

Answer

CBC

Answer

CTR

Question 11

In RSA, the public exponent e is often chosen as 65537. What is the primary reason for this choice?

Accepted Answer

It offers a balance between security and performance due to low Hamming weight. 65537 (0x10001) has a low Hamming weight of only 2 bits set, which makes modular exponentiation significantly faster than using a random large exponent, while still providing strong security. This choice balances computational efficiency with cryptographic strength, as a larger exponent would slow down encryption without proportional security gains.

Answer

It ensures that the private key d is small

Answer

It prevents side-channel attacks

Answer

It provides the highest security level

Question 12

A user reports that they cannot access a network share. The administrator checks the share permissions and NTFS permissions. The share permission allows Everyone: Read, and the NTFS permission allows the user: Full Control. What is the user's effective access?

Accepted Answer

Read. When accessing a network share, the effective permissions are the most restrictive of the share permissions and the NTFS permissions. Here, the share permission is Read and the NTFS permission is Full Control. The most restrictive permission is Read, so the user's effective access is Read.

Answer

Full Control

Answer

No access

Answer

Modify

Question 13

A security operations team is developing an incident response plan. Which TWO steps are part of the 'containment, eradication, and recovery' phase? (Choose two.)

Accepted Answer

Restoring systems from known good backups. Options B and E are correct. Isolating affected systems (E) is a containment action, and restoring systems from known good backups (B) is part of recovery. Option A (lessons learned) occurs after the incident. Option C (root cause) is part of identification and analysis, not containment/eradication/recovery. Option D (preserving forensic evidence) is important but typically done during identification and analysis, not as part of containment/eradication/recovery.

Answer

Conducting a lessons learned meeting

Answer

Identifying the root cause of the incident

Answer

Preserving forensic evidence

Question 14

After implementing a new IDS, the security team receives numerous alerts about legitimate traffic being flagged as malicious. This phenomenon is known as:

Accepted Answer

False positives. A false positive occurs when the IDS incorrectly classifies legitimate traffic as malicious, generating an alert for benign activity. This is a common issue after deploying a new IDS with default or overly sensitive signature sets, leading to alert fatigue. The core reasoning is that the IDS's detection logic (e.g., pattern matching or anomaly thresholds) misidentifies normal behavior as an attack.

Answer

Noise

Answer

False negatives

Answer

True positives

Question 15

An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?

Accepted Answer

$12,500. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $25,000 and an ARO of 0.5, the ALE is $25,000 × 0.5 = $12,500. This quantifies the expected annual financial loss from the SQL injection vulnerability.

Answer

$50,000

Answer

$25,000

Answer

$6,250