SSCP Practice Test 33 — 15 Questions

Question 1

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

Accepted Answer

Sanitise the hard drive and then dispose or reassign. Sanitising the hard drive before disposal or reassignment is the correct action because it ensures all sensitive company and employee data is securely removed, preventing data leakage. This aligns with data remanence best practices and regulatory requirements for media sanitisation. Reassigning or disposing without sanitisation exposes the organization to data breach risks.

Answer

Keep the hardware in storage indefinitely

Answer

Recycle the hardware without any data removal

Answer

Reassign the hardware to a new employee without wiping

Question 2

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Accepted Answer

Risk mitigation. Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 3

Which TWO of the following are effective measures to prevent cross-site scripting (XSS) vulnerabilities in a web application?

Accepted Answer

Implement a Content Security Policy (CSP).. Option A is correct because a Content Security Policy (CSP) delivered via the Content-Security-Policy HTTP response header restricts which scripts the browser may execute (e.g., disallowing inline scripts with 'unsafe-inline' and limiting sources via script-src), which directly mitigates the impact and execution of injected XSS payloads. Option D is correct because context-aware output encoding (e.g., HTML entity encoding, JavaScript/attribute/URL encoding) ensures that user-supplied data is rendered as inert text rather than executable markup or script when placed into HTTP responses, which is the primary defense against XSS. Option B is not a reliable preventive measure because a WAF only pattern-matches known payloads and can be bypassed with obfuscation or novel vectors, so it is a compensating control rather than a fix. Option C does not prevent XSS because the HTTP method (GET vs. POST) is irrelevant to whether untrusted input is safely rendered in the response. Option E does not prevent XSS because HTTPS only protects data in transit against eavesdropping and tampering; injected scripts still execute in the victim's browser over an encrypted connection.

Answer

Use a web application firewall (WAF) to block known XSS payloads.

Answer

Replace GET requests with POST for all form submissions.

Answer

Use HTTPS for all communications.

Question 4

An organization uses a cloud-based file synchronization service to share project files with external partners. The security team discovers that an unauthorized third party accessed sensitive documents by guessing weak passwords. Which additional control would most effectively mitigate this risk?

Accepted Answer

Enforcing multi-factor authentication for all external users.. The breach occurred because attackers guessed weak passwords, so the root cause is inadequate authentication strength. Enforcing multi-factor authentication (MFA) for all external users adds a second factor beyond the password, so even a correctly guessed or brute-forced password is insufficient to gain access. This directly addresses the credential-guessing attack vector described in the scenario.

Answer

Requiring all file transfers to use SFTP instead of HTTPS.

Answer

Implementing file-level encryption with keys stored on-premises.

Answer

Configuring the service to use a custom domain certificate.

Question 5

A security awareness program is being developed. Which topic is MOST critical for all employees to understand to reduce the risk of social engineering?

Accepted Answer

How to recognize and report phishing attempts and other suspicious communications. Social engineering attacks, such as phishing, vishing, and smishing, exploit human psychology rather than technical vulnerabilities. The most critical defense for all employees is the ability to recognize indicators of these attacks (e.g., spoofed sender addresses, urgent language, mismatched URLs) and follow the proper reporting procedure to enable rapid incident response. Without this skill, even the strongest technical controls can be bypassed by a single successful click.

Answer

The risks of posting on social media

Answer

The proper use of mobile devices

Answer

How to create strong passwords

Question 6

A company's backup strategy uses a full backup on Sundays and differential backups on other days. On Thursday, the storage system fails. How many backups are required to restore the data?

Accepted Answer

Two (the full backup and the Thursday differential). A differential backup copies all data changed since the last full backup. Therefore, to restore data on Thursday, you need the last full backup (Sunday) and the most recent differential backup (Thursday), which contains all changes from Sunday through Thursday. This totals two backups.

Answer

One (the full backup only)

Answer

Five (the full backup and all differentials from Monday to Thursday)

Answer

Six (all backups from Sunday to Thursday)

Question 7

A security analyst is evaluating the cryptographic settings for a new application that requires both confidentiality and integrity for data in transit. The analyst needs to choose a symmetric cipher that provides authenticated encryption. Which of the following is the best choice?

Accepted Answer

AES in GCM mode. AES in GCM mode provides authenticated encryption, offering both confidentiality and integrity/authenticity in a single operation. GCM (Galois/Counter Mode) is an AEAD (Authenticated Encryption with Associated Data) mode, making it the best choice for data in transit requiring both properties.

Answer

RC4 stream cipher

Answer

AES in ECB mode

Answer

AES in CBC mode

Question 8

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Answer

Strong password policy

Answer

Asset tracking software

Answer

Remote wiping capability

Question 9

An administrator wants to ensure that a Linux web server only allows the www-data user to run specific commands with elevated privileges. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file defines which users or groups may run which commands with elevated privileges via sudo. To allow www-data to run specific commands as root, you add entries there (typically using visudo). This enforces least privilege by limiting the commands the web user can execute with sudo.

Answer

/etc/pam.d/

Answer

/etc/chmod.conf

Answer

/etc/selinux/config

Question 10

Which TWO of the following are best practices for password management?

Accepted Answer

Implement account lockout after a few failed attempts. Option A is correct because implementing account lockout after a few failed attempts mitigates brute-force and password-guessing attacks by temporarily disabling the account after a threshold of invalid logins, a core control in standards like NIST SP 800-53 and CIS Benchmarks. Option E is correct because enforcing password complexity requirements (e.g., minimum length, mixed character classes) increases the search space an attacker must cover, making dictionary and brute-force attacks less likely to succeed. Option B is incorrect because allowing reuse of the last 5 passwords undermines password history policies and lets compromised or previously breached credentials remain valid. Option C is incorrect because storing passwords in plaintext exposes them to any attacker or insider with file access; passwords should be salted and hashed with a strong algorithm such as bcrypt, scrypt, or Argon2. Option D is incorrect because sharing passwords via email transmits credentials in cleartext over untrusted channels and violates the principle of individual accountability; credentials should never be shared, and privileged access should use vaulting or PAM solutions instead.

Answer

Allow reuse of the last 5 passwords

Answer

Store passwords in plaintext for quick recovery

Answer

Share passwords via email for convenience

Question 11

Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?

Accepted Answer

WPA2. WPA2 is the Wi-Fi Alliance certification that implements the IEEE 802.11i standard and mandates AES-CCMP for encryption and integrity. It replaced WPA's TKIP/RC4-based Temporal Key Integrity Protocol with the stronger AES block cipher in Counter Mode with CBC-MAC Protocol. This is why WPA2 is the correct answer for AES-CCMP plus 802.11i.

Answer

WEP

Answer

WPA

Answer

WPA3

Question 12

Which THREE steps are essential during the identification phase of incident response?

Accepted Answer

Monitor logs and alerts. During the identification phase of incident response, the essential steps are monitoring logs and alerts (C) to detect potential incidents, determining the scope of the incident (D) to understand its impact, and classifying incident severity (E) to prioritize response. Options A and B are not part of identification; eradication occurs later in the response phase, and stakeholder notification typically happens after identification and analysis.

Answer

Eradicate the threat

Answer

Notify stakeholders

Question 13

Which wireless security standard replaces WPA2 and mandates Protected Management Frames (PMF) to prevent certain types of attacks?

Accepted Answer

WPA3. WPA3 is the wireless security standard that replaces WPA2 and mandates Protected Management Frames (PMF) to prevent attacks such as deauthentication and disassociation. PMF provides integrity protection for management frames, which WPA2 did not require.

Answer

802.1X

Answer

WEP

Answer

WPA2

Question 14

Which of the following is the primary purpose of network segmentation?

Accepted Answer

Enhance security by isolating sensitive systems. The primary purpose of network segmentation is to enhance security by isolating sensitive systems and limiting lateral movement of threats. Option D is correct. Option A is incorrect because segmentation does not directly increase bandwidth. Option B is incorrect; while performance may improve due to reduced broadcast domains, security is the primary goal. Option C is incorrect because segmentation can complicate IP address management. Option E is incorrect because segmentation often increases hardware cost.

Answer

Increase bandwidth

Answer

Improve network performance

Answer

Simplify IP address management

Answer

Reduce hardware cost

Question 15

A Linux server is being hardened. The security team wants to enforce mandatory access control policies that confine processes to limited access to files and resources. Which technology should be implemented?

Accepted Answer

SELinux. SELinux (Security-Enhanced Linux) implements mandatory access control (MAC) by labeling processes and files with security contexts and enforcing policy rules that confine processes to only the resources they are permitted to access. This is exactly what the security team needs to enforce MAC and limit process access to files and resources.

Answer

PAM

Answer

iptables

Answer

auditd