SSCP Practice Test 34 — 15 Questions

Question 1

A system administrator is configuring a Linux server to ensure that only authorized users can execute commands with superuser privileges. Which file should be edited to control sudo access?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the central configuration file that defines which users and groups may run which commands with elevated privileges via sudo. It uses a specific syntax (user/group, host, runas, command) and is edited with visudo to prevent syntax errors that could lock out sudo access. Editing this file is the standard way to control sudo authorization on Linux.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 2

A security auditor is reviewing the configuration of a remote access VPN. Which TWO features are considered best practices for securing the VPN connection?

Accepted Answer

Implementing multi-factor authentication (MFA). Option C is correct because implementing multi-factor authentication (MFA) ensures that even if a user's credentials are compromised, an additional verification factor (such as a TOTP code or hardware token) is required before the VPN tunnel is established, directly mitigating credential-based attacks. Option E is correct because TLS 1.3 with mandatory forward secrecy (using ephemeral key exchanges like ECDHE) ensures that session keys cannot be retroactively decrypted even if the server's long-term private key is later compromised, which is a recognized best practice for protecting VPN control and data channels. Option A is not a best practice because IKEv2 with pre-shared keys only lacks per-user authentication and scalability, and PSKs are vulnerable to offline dictionary attacks; certificate-based or EAP-based authentication is preferred. Option B is incorrect because disabling encryption removes confidentiality and integrity protections, defeating the purpose of a VPN. Option D is incorrect because enabling split tunneling for all traffic can bypass corporate security controls (such as inspection and DLP) and expose the endpoint and internal network to threats, so it is not a security best practice.

Answer

Using IKEv2 with pre-shared keys only

Answer

Disabling encryption to reduce latency

Answer

Enabling split tunneling for all traffic to improve performance

Question 3

A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?

Accepted Answer

Enforce a formal approval process via a change advisory board. A formal approval process via a change advisory board (CAB) is the most important control because it ensures changes are reviewed, authorized, and documented by appropriate stakeholders before implementation, directly preventing unauthorized changes. While testing, notification, and backout plans are valuable, they do not provide the authorization gate that stops unauthorized changes from being deployed.

Answer

Implement a staging environment to test all changes

Answer

Notify all users before the change window

Answer

Require a documented backout plan for every change

Question 4

Refer to the exhibit. A security administrator notices repeated events with the same failure reason for the Administrator account. What is the MOST likely type of attack?

Accepted Answer

Brute force. A brute force attack is characterized by repeated authentication attempts against the same account (here, Administrator) with the same failure reason, indicating systematic password guessing. The exhibit shows multiple failed logons for a single account, which is the classic signature of brute force. Password spraying would show one or two attempts across many accounts, not repeated failures on one account.

Answer

Spear phishing

Answer

Password spraying

Answer

Denial of service

Question 5

An organization is implementing system hardening. Which of the following actions are recommended by CIS Benchmarks? (Select all that apply.)

Accepted Answer

Remove unnecessary services and accounts. Option A is correct because CIS Benchmarks emphasize reducing the attack surface by removing or disabling unnecessary services, applications, and accounts that are not required for the system's role. Option C is correct because CIS Benchmarks recommend disabling autorun and autoplay to prevent automatic execution of potentially malicious code from removable media and network drives. Option D is correct because enabling User Account Control (UAC) ensures administrative actions require explicit elevation and helps enforce least privilege on Windows systems. Option B is incorrect because CIS Benchmarks generally recommend static IP configuration or controlled network settings for servers rather than enabling DHCP on all interfaces, which can introduce unauthorized or unpredictable network configuration. Option E is incorrect because CIS Benchmarks recommend enabling and properly configuring host-based firewalls, not disabling them, to filter inbound and outbound traffic.

Answer

Enable DHCP for all network interfaces

Answer

Disable the host-based firewall

Question 6

A small financial services company has deployed a SIEM solution collecting logs from their firewall, web server, and domain controller. They also have an IDS monitoring the network perimeter. The security analyst receives an alert from the IDS indicating a potential exploit attempt against the web server from an external IP. The analyst checks the SIEM and sees that the firewall log shows the connection was allowed, but the web server log does not show any corresponding request. The domain controller logs show no abnormal activity. The company has a policy to immediately contain any confirmed threats. What should the analyst do first based on this information?

Accepted Answer

Verify the web server's integrity by checking for filesystem changes or anomalous processes. The analyst should first verify the web server's integrity by checking for filesystem changes or anomalous processes, because the IDS alert plus the firewall 'allow' but missing web server log entry suggests a possible discrepancy—either the request was dropped before reaching the app, or the web server was compromised and its logging tampered with. Confirming whether exploitation actually occurred is the correct first step before containment, since the policy requires containing 'confirmed' threats. This aligns with the incident response 'identification/validation' phase before eradication and containment.

Answer

Reboot the web server to clear any potential memory-resident malware

Answer

Block the external IP at the firewall

Answer

Escalate the alert to the incident response team

Question 7

During a security assessment, it is discovered that a Linux server has unnecessary services running, including Telnet and FTP. The server is also missing critical security patches. Which of the following is the MOST effective approach to harden this server according to industry best practices?

Accepted Answer

Disable Telnet and FTP services, and apply all critical security patches.. The most effective hardening approach directly addresses the identified vulnerabilities: disabling insecure services (Telnet and FTP, which transmit credentials in cleartext) and applying critical security patches to close known exploitable flaws. This removes the actual attack vectors rather than merely monitoring or isolating them, aligning with CIS and NIST hardening guidance.

Answer

Move the server to a more secure network segment and implement network access controls.

Answer

Enable SELinux and configure a host-based firewall using iptables.

Answer

Install a host-based intrusion detection system (HIDS) to monitor for attacks.

Question 8

An organization wants to quantify the potential financial loss from a specific risk scenario. The risk team estimates that a data breach would cost $500,000 in direct expenses and that such an event is expected to occur once every five years. Which metric are they calculating?

Accepted Answer

Annualized loss expectancy (ALE). The team is calculating annualized loss expectancy by multiplying the single loss expectancy by the annualized rate of occurrence. With an SLE of $500,000 and an ARO of 0.2 (once every five years), the ALE is $100,000. This quantifies the expected yearly financial impact and helps prioritize risk mitigation investments.

Answer

Single loss expectancy (SLE)

Answer

Annualized rate of occurrence (ARO)

Answer

Exposure factor (EF)

Question 9

A company deploys a web application and wants to protect against SQL injection and XSS attacks. Which security control is specifically designed to inspect HTTP traffic and block such attacks?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at the application layer (HTTP/HTTPS) and inspects request and response payloads for attack signatures such as SQL injection and cross-site scripting (XSS). It can block or filter malicious requests before they reach the web application, making it the control specifically designed for this purpose.

Answer

Intrusion Detection System (IDS)

Answer

Network segmentation

Answer

Host-based firewall

Question 10

An organization is hardening a Linux server. Which TWO of the following are effective steps to reduce the attack surface?

Accepted Answer

Remove unnecessary services and software packages. Removing unnecessary services and software reduces potential vulnerabilities. Proper file permissions using chmod and chown enforce least privilege.

Answer

Disable SELinux for better performance

Answer

Install all available packages to ensure compatibility

Answer

Enable the root account for direct login

Question 11

A security engineer is designing a network segmentation strategy to isolate a DMZ containing public-facing web servers from the internal corporate network. Which TWO controls should be implemented? (Select two)

Accepted Answer

Separate VLANs for DMZ and internal networks. Option A is correct because placing the DMZ and internal network in separate VLANs provides Layer 2 segmentation, preventing broadcast traffic and direct frame-level communication between the two zones unless explicitly routed through a Layer 3 device. Option B is correct because a firewall enforcing least privilege between zones is the core segmentation control: it allows only required inbound traffic (e.g., TCP 443 to the web servers) into the DMZ and restricts outbound DMZ-to-internal traffic, blocking lateral movement if a public-facing server is compromised. Option D is not sufficient on its own because a separate IP subnet alone does not enforce traffic filtering; routing between subnets can still occur without a firewall policy. Option C does not belong because NAC controls endpoint admission to the network and does not segment an existing DMZ from the internal network. Option E does not belong because an IDS only monitors and alerts on traffic; it does not enforce segmentation or block unauthorized flows.

Answer

Network Access Control (NAC) on all endpoints

Answer

A separate IP subnet for the DMZ

Answer

An intrusion detection system (IDS) monitoring traffic between segments

Question 12

A small business needs basic protection against malware. Which solution is MOST cost-effective and provides real-time protection?

Accepted Answer

Deploy an endpoint protection platform (EPP). An Endpoint Protection Platform (EPP) provides real-time, continuous protection against malware on endpoints through signature-based detection, behavioral analysis, and often centralized management. For a small business needing basic but real-time malware defense, EPP is the most cost-effective solution because it replaces manual scanning with always-on protection and typically includes a management console for the whole fleet.

Answer

Schedule weekly antivirus scans

Answer

Install a host-based firewall on each computer

Answer

Use email encryption for all communications

Question 13

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 14

A Linux administrator is hardening a server. Which TWO commands are used to manage file permissions? (Select TWO.)

Accepted Answer

chmod. Option D, chmod, is correct because it directly manages file permissions by changing the read, write, and execute bits (the mode) for the owner, group, and others on files and directories, using symbolic or octal notation. Option E, chown, is correct because it manages file ownership, changing the owning user and/or group of a file, which is a core part of file permission management since permissions are evaluated against the owner and group. Option A, usermod, is incorrect because it modifies user account attributes such as group membership, home directory, and shell, not file permissions. Option B, passwd, is incorrect because it manages user authentication passwords, not file permissions. Option C, groupadd, is incorrect because it creates new groups in the system, not file permissions.

Answer

usermod

Answer

passwd

Answer

groupadd

Question 15

An organization implements a policy requiring passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 60 days. Which password policy elements are being enforced?

Accepted Answer

Length, complexity, and expiry. The policy specifies three elements: a minimum length of 12 characters (length), a requirement for uppercase, lowercase, digits, and special characters (complexity), and a 60-day change interval (expiry). Lockout and history are not mentioned in the policy, so they are not being enforced. The correct answer is length, complexity, and expiry.

Answer

Complexity, expiry, and lockout

Answer

Length, complexity, and history

Answer

Length, complexity, and lockout