SSCP Practice Test 33 — 15 Questions

Question 1

Refer to the exhibit. A systems administrator configures this Group Policy setting. What is the direct consequence?

Accepted Answer

Members of Backup Operators cannot connect to the server using Remote Desktop.. The 'Deny log on through Remote Desktop Services' policy explicitly prevents members of Backup Operators from using Remote Desktop. Therefore, they cannot connect via RDP, making Option A correct. Option B is incorrect because the policy only affects Remote Desktop, not local console logon. Option C is incorrect because the policy denies, not allows. Option D is incorrect because it does not affect other remote access methods like SSH unless specifically configured.

Answer

Members of Backup Operators are prohibited from local console logon.

Answer

Members of Backup Operators can connect via Remote Desktop.

Answer

Members of Backup Operators are prevented from using any remote access method.

Question 2

An analyst runs the netstat command on a web server. Based on the output, which connection is the MOST suspicious?

Accepted Answer

The connection from 203.0.113.5:8080. 203.0.113.5 is from the documentation IP range (RFC 5737), which should not appear in real network traffic. This indicates potential spoofing or malicious activity. Options B and C are internal private IPs, which are expected. Option D is the normal HTTP listening service.

Answer

The connection from 192.168.1.10:54321

Answer

The connection from 10.0.2.50:44350

Answer

The listening on 0.0.0.0:80

Question 3

A small business has 50 employees and uses a cloud-based email service. The IT manager receives a report that several employees have been receiving phishing emails that appear to come from the company's CEO. The emails request that employees purchase gift cards and send the codes urgently. Two employees have already complied, losing $500 total. The manager wants to prevent this from recurring. The company has a limited budget and no dedicated security staff. Which of the following actions should the manager take FIRST?

Accepted Answer

Enable multi-factor authentication (MFA) on the CEO's email account. The most immediate action is to secure the compromised account by enabling multi-factor authentication (MFA) on the CEO's email account. This stops attackers from using stolen credentials to send fraudulent emails, directly addressing the root cause. While other options may help long-term, they do not prevent the current attack vector: Option A (creating a policy) is reactive and does not stop the ongoing threat; Option C (security awareness training) is important but does not prevent the CEO's account from being used; Option D (email filtering) may not catch all spoofed emails and does not address the compromised account.

Answer

Create a policy prohibiting gift card purchases

Answer

Conduct security awareness training for all employees

Answer

Set up email filtering rules to block emails with the CEO's name

Question 4

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (ABAC) is attribute-based and not the traditional model for military-grade security. Option C (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option D (RBAC) uses roles, not classification levels.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 5

Which THREE of the following are common types of malware?

Accepted Answer

Trojan horse. Options A, B, and C are correct. Trojan horse, virus, and worm are common types of malware. Option D (firewall) is a security device or software, not malware. Option E (patch) is a security update, not malware.

Answer

Firewall

Answer

Patch

Question 6

A security administrator discovers that a web application is vulnerable to SQL injection. Which of the following is the most effective mitigation to implement at the application layer?

Accepted Answer

Use parameterized queries or prepared statements.. (parameterized queries or prepared statements) is the most effective mitigation at the application layer because it ensures user input is treated as data, not executable SQL code, thus preventing SQL injection. Option A (input validation via blacklist) can be bypassed by attackers using encoding or alternative characters. Option B (encrypting the database connection with TLS) protects data in transit but does not prevent SQL injection. Option D (output encoding) addresses cross-site scripting (XSS), not SQL injection. Option E (deploying a WAF) operates at the network layer and can be circumvented; it is not an application-layer control.

Answer

Implement input validation using a blacklist of SQL keywords.

Answer

Encrypt the database connection using TLS.

Answer

Encode all output sent to the browser.

Answer

Deploy a web application firewall (WAF) in front of the server.

Question 7

A DevOps team implements a CI/CD pipeline for a web application. Which security control is BEST to ensure that only properly reviewed code reaches production?

Accepted Answer

Require a manual approval gate before deployment. Requiring a manual approval gate ensures a human has reviewed the code before deployment, which is the best way to ensure only properly reviewed code reaches production. Option A is wrong because SAST (static application security testing) is automated and may miss logic flaws or business logic issues that require human review. Option C is wrong because automated unit and integration tests verify functionality but do not constitute a code review; they can pass even if the code has logic errors or security issues not covered by tests. Option D is wrong because code signing ensures the integrity and authenticity of artifacts but does not involve reviewing the code content for correctness or security.

Answer

Run static application security testing (SAST) in the pipeline

Answer

Run automated unit tests and integration tests

Answer

Implement code signing for all artifacts

Question 8

An organization requires that all laptops used by employees be encrypted. Which type of encryption should be used to protect the entire hard drive?

Accepted Answer

Full disk encryption (FDE). Full disk encryption (FDE) encrypts the entire hard drive, including the operating system and all files, providing the strongest protection for data at rest on lost or stolen laptops. File-level encryption only encrypts individual files, leaving metadata and other files exposed. Folder-level encryption is similar but at the folder level. Transport encryption (TLS) protects data in transit, not at rest. Application-level encryption encrypts data within a specific application, not the entire drive. Therefore, full disk encryption (Option B) is the correct choice for protecting the entire hard drive.

Answer

File-level encryption

Answer

Transport encryption (TLS)

Answer

Application-level encryption

Answer

Folder-level encryption

Question 9

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force attack.. The exhibit shows a high number of failed authentication attempts (e.g., 1000+ failures) from a single source IP within a short time window, targeting a specific user account. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations to gain unauthorized access. Unlike a dictionary attack, which uses a predefined list of likely passwords, a brute force attack exhaustively tests all possible combinations, as indicated by the sheer volume of attempts.

Answer

Denial of service.

Answer

Dictionary attack.

Answer

Man-in-the-middle.

Question 10

An administrator notices that a certificate used for code signing is about to expire. The certificate is signed by a trusted root CA. What is the correct procedure to ensure continued trust?

Accepted Answer

Request a new certificate from the same CA before expiration. The correct procedure is to request a new certificate from the same trusted root CA before the current certificate expires. This ensures that the new certificate is signed by the same trusted root, maintaining the chain of trust without interruption. Continuing to use an expired certificate would break trust validation, as clients and operating systems reject expired code-signing certificates to prevent execution of untrusted code.

Answer

Continue using the expired certificate until a new one is obtained

Answer

Extend the validity period of the existing certificate by modifying the certificate

Answer

Switch to a self-signed certificate

Question 11

Refer to the exhibit. A security incident responder sees this alert in the SIEM. What should the responder do first?

Accepted Answer

Check if the source IP is a legitimate internal scanner.. The correct first step is to verify whether the source IP (10.0.0.5) is a legitimate internal scanner (e.g., authorized vulnerability scanner) as indicated in Option A. Blocking the IP (Option B) could disrupt authorized scanning. Updating the firewall signature database (Option C) does not address the immediate alert. Rebooting the internal host (Option D) is premature without further investigation.

Answer

Block the source IP at the firewall.

Answer

Update the firewall signature database.

Answer

Reboot the internal host 192.168.1.10.

Question 12

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

Accepted Answer

The web application firewall is blocking legitimate traffic.. A 403 Forbidden error indicates that the server understood the request but is refusing to authorize it. The most likely cause is the web application firewall (WAF) blocking legitimate traffic due to false positives or overly strict rules. Option B (expired SSL certificate) would cause SSL handshake errors, not 403. Option C (database connection pool exhausted) would result in 500-type errors. Option D (IP address change) would cause connection timeouts or DNS errors, not 403.

Answer

The SSL certificate has expired.

Answer

The application's database connection pool is exhausted.

Answer

The web server's IP address has changed.

Question 13

A security analyst needs to ensure that a legacy application running on an unsupported operating system remains secure until it can be replaced. Which strategy provides the most effective risk reduction?

Accepted Answer

Move the application to a sandboxed virtual machine and isolate it from the network.. Isolating the legacy application in a sandboxed virtual machine with network restrictions minimizes the attack surface and prevents exploitation of OS-level vulnerabilities. Option B is incorrect because third-party patches are unreliable and may introduce instability or conflicts. Option C is incorrect because upgrading the application is not feasible if it runs on an unsupported OS, and vendor support is unavailable. Option D is incorrect because application whitelisting only controls execution but does not protect against OS vulnerabilities that could compromise the entire system.

Answer

Apply all available security patches from third-party sources.

Answer

Upgrade the application to the latest version with vendor support.

Answer

Implement application whitelisting to allow only approved executables.

Question 14

Which THREE of the following are best practices for securely managing cryptographic keys in an enterprise environment?

Accepted Answer

Implement key escrow to allow recovery of encrypted data.. The correct answers are C, D, and E. Option C: Key escrow enables recovery of encrypted data when keys are lost, which is a best practice for enterprise environments. Option D: Regular key rotation limits the impact of a key compromise and is a fundamental security practice. Option E: Storing keys in an HSM provides tamper-resistant hardware protection. Option A is incorrect because using the same key for both encryption and signing violates key separation principles. Option B is incorrect because email is not a secure channel for sharing keys; encrypted email is still vulnerable to interception or misconfiguration.

Answer

Use the same key for encryption and decryption (symmetric) and also for signing.

Answer

Share keys via email encrypted with the recipient's public key.

Question 15

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

Accepted Answer

Perform a threat modeling exercise such as STRIDE. Threat modeling with STRIDE is the best approach because it systematically identifies threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) specific to the CRM's architecture, data flows, and trust boundaries. Unlike generic scans or assessments, STRIDE focuses on the unique attack surface of a cloud-based system, such as API endpoints, multi-tenancy risks, and shared responsibility model gaps.

Answer

Run a vulnerability scan on the CRM

Answer

Execute a business impact analysis (BIA)

Answer

Conduct a qualitative risk assessment using a generic framework