SSCP Practice Test 34 — 15 Questions

Question 1

A small business wants to protect its data from ransomware. Which backup strategy provides the BEST protection against an attack where the backup files are also encrypted?

Accepted Answer

Weekly backups to tape stored in a fireproof safe offline. An offline (air-gapped) backup is not accessible from the network, preventing ransomware from encrypting it. Option A is wrong because a NAS device is network-attached, so ransomware can encrypt it if the network is compromised. Option B is wrong because cloud backups are also accessible from the network and can be encrypted by ransomware if credentials are compromised. Option C is wrong because an external hard drive connected via USB, when attached to the system, is accessible to ransomware and can be encrypted.

Answer

Daily backups to a network attached storage (NAS) device

Answer

Daily cloud backups with versioning

Answer

Weekly backups to an external hard drive connected via USB

Question 2

A security analyst notices that an employee's account has been sending large amounts of data to an external IP address during non-business hours. The analyst suspects the employee's credentials have been compromised. What is the FIRST step the analyst should take according to incident response procedures?

Accepted Answer

Disable the employee's user account.. Disabling the employee's user account immediately stops the unauthorized activity and prevents further data exfiltration, as per incident response procedures. Option A is wrong; blocking the external IP address may not stop the attacker if they have other methods or can change IPs. Option C is wrong; informing the manager is important but not the first action, as containment is the priority. Option D is wrong; contacting law enforcement is premature before containing the incident and gathering evidence.

Answer

Block the external IP address at the firewall.

Answer

Contact law enforcement.

Answer

Inform the employee's manager.

Question 3

A software development team is implementing input validation for a web application that accepts user email addresses. Which approach BEST prevents email injection attacks?

Accepted Answer

Whitelist allowed characters: alphanumeric, @, ., -, _. Whitelisting allowed characters (alphanumeric, @, ., -, _) restricts input to safe characters, effectively preventing injection of special characters used in email injection attacks. Option B is incorrect because blacklisting known malicious patterns is easily bypassed by attackers using novel patterns. Option C is incorrect because setting a maximum email length does not prevent injection of malicious characters within that length. Option D is incorrect because client-side validation alone can be bypassed by disabling JavaScript or intercepting requests, so server-side validation is essential.

Answer

Blacklist known malicious email patterns

Answer

Set maximum email length to 100 characters

Answer

Rely on client-side JavaScript validation only

Question 4

A company is implementing a new file-sharing application for employees. Which of the following is the most important security control to prevent unauthorized access to shared files?

Accepted Answer

Implement access control lists (ACLs) on shared folders.. The most important control to prevent unauthorized access to shared files is implementing access control lists (ACLs), which explicitly define who can access resources and what permissions they have. Encryption (E) protects data at rest but does not manage permissions; audit logging (D) is detective, not preventive; antivirus (C) prevents malware but does not control access; backups (A) ensure availability, not confidentiality. Therefore, B is correct.

Answer

Schedule regular backups.

Answer

Install antivirus software on all endpoints.

Answer

Enable detailed audit logging.

Answer

Encrypt files with AES-256.

Question 5

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

Accepted Answer

RAM, network connections, running processes, hard drive image. Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Answer

Hard drive image, network connections, running processes, RAM

Answer

Running processes, RAM, hard drive image, network connections

Answer

Network connections, hard drive image, RAM, running processes

Question 6

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

Accepted Answer

Removing malicious files and cleaning registry persistence. During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Answer

Reimaging the system from a verified clean image

Answer

Resetting compromised user credentials

Answer

Patching the exploited vulnerability

Question 7

A company's disaster recovery plan includes offsite tape backups. During a test, it is discovered that the tapes are stored at a location that shares the same power grid as the primary site. Which risk does this pose?

Accepted Answer

The tapes may be inaccessible during a power outage. Storing offsite tapes at a location that shares the same power grid as the primary site means a regional power outage could render both sites inaccessible, preventing retrieval of the tapes. Option A is incorrect because tape degradation is a separate issue related to storage conditions, not power grid dependency. Option C is incorrect because encryption is unrelated to power grid sharing. Option D is incorrect because RTO (Recovery Time Objective) could be affected, but the primary risk here is inaccessibility due to power outage, not necessarily exceeding RTO.

Answer

The tapes may degrade over time

Answer

The tapes are not encrypted

Answer

The recovery time may exceed the RTO

Question 8

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

Accepted Answer

RTO = 2 hours, RPO = 1 hour. The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Answer

RTO = 1 hour, RPO = 1 hour

Answer

RTO = 1 hour, RPO = 2 hours

Answer

RTO = 2 hours, RPO = 2 hours

Question 9

A company's security policy requires that employees must change their passwords every 60 days. However, help desk tickets show that many users are locked out after forgetting their new passwords. Which of the following would BEST balance security and usability?

Accepted Answer

Implement single sign-on (SSO) for all applications. Single sign-on (SSO) reduces the number of passwords users must remember to one set of credentials, which decreases the likelihood of forgotten passwords and lockouts. By centralizing authentication, SSO allows the organization to enforce a strong password policy (e.g., 60-day rotation) while improving usability, as users only need to manage a single password. This balances security (centralized control, stronger authentication) with usability (fewer password resets).

Answer

Require users to use a password manager

Answer

Extend the password change interval to 90 days

Answer

Disable account lockout after failed attempts

Question 10

A security analyst is responding to a malware incident on a Windows server. Which TWO actions should be taken to properly collect volatile evidence?

Accepted Answer

Capture a memory dump using WinPmem. WinPmem is a dedicated memory acquisition tool that captures the contents of RAM, which contains critical volatile evidence such as running processes, open network connections, and injected code. Since volatile data is lost on power loss or reboot, capturing a memory dump before any other action preserves this evidence for forensic analysis.

Answer

Reboot the system to clear malware from memory

Answer

Delete suspicious files to prevent further infection

Answer

Perform a full disk image using a write blocker

Question 11

An organization uses a central syslog server to collect logs from firewalls, servers, and network devices. Recently, the security team noticed that some critical events from the firewall are missing from the syslog server. The firewall configuration sends syslog messages using UDP to the syslog server. The syslog server administrator reports that the server is receiving a high volume of logs and occasionally drops packets due to buffer overflow. The team needs to ensure reliable delivery of all syslog messages without losing any. Which solution should the team implement?

Accepted Answer

Switch to TCP-based syslog with TLS.. Switching to TCP-based syslog with TLS provides a reliable, connection-oriented transport that guarantees delivery, and TLS adds encryption for security. Option B is incorrect because increasing the UDP buffer size may reduce packet drops due to buffer overflow but does not guarantee reliable delivery since UDP is connectionless and can still lose packets. Option C is incorrect because log aggregation at each network segment changes the architecture but does not solve the underlying transport reliability issue; it may still rely on UDP. Option D is incorrect because a load balancer distributes incoming syslog messages across multiple receivers but does not prevent UPD packet loss if UDP is still used; it only helps with load distribution, not reliability.

Answer

Increase the UDP buffer size on the syslog server.

Answer

Implement log aggregation at each network segment.

Answer

Use a load balancer for syslog receivers.

Question 12

A company wants to ensure that employees understand the proper use of corporate email and internet. Which policy should they implement?

Accepted Answer

Acceptable Use Policy. An Acceptable Use Policy (AUP) defines the rules and guidelines for using corporate IT resources, including email and internet. It specifies permitted and prohibited activities, such as personal browsing, sending sensitive data, or accessing inappropriate content, ensuring employees understand their responsibilities. This policy directly addresses the company's goal of educating employees on proper usage, unlike other policies that focus on data classification, remote connectivity, or authentication.

Answer

Data Handling Policy

Answer

Remote Access Policy

Answer

Password Policy

Question 13

You are the security analyst at a mid-sized retail company with 500 employees. The company recently experienced a ransomware attack that encrypted files on a file server. The infection was traced to a phishing email opened by an employee in accounting. The company has antivirus software, a firewall, and daily backups. After the incident, management wants to improve risk identification to prevent future attacks. Which of the following is the MOST effective first step to improve risk identification?

Accepted Answer

Conduct a risk assessment that includes threat modeling and vulnerability scanning. Performing a comprehensive risk assessment focusing on people, process, and technology will identify gaps like phishing training gaps, technical controls, etc. Option A only addresses one attack vector; C is reactive; D is a control but not a direct identification step.

Answer

Implement a data loss prevention (DLP) solution to monitor email traffic

Answer

Deploy a SIEM system to aggregate logs from all systems

Answer

Review the logs of the compromised file server for forensic details

Question 14

An organization is deploying a network-based intrusion detection system (NIDS). The security team must decide on placement and configuration. Which THREE considerations are critical for effective NIDS deployment?

Accepted Answer

Using a network tap or SPAN port to monitor traffic without introducing latency. Using a network tap or SPAN port ensures full visibility without introducing latency (A). Placing the NIDS on the internal network behind the firewall allows it to detect insider threats that have already passed perimeter defenses (D). Tuning signatures to match the environment reduces false positives, making alerts more actionable (E).

Answer

Placing the NIDS inline to block malicious traffic immediately

Answer

Configuring the NIDS to drop packets that match attack signatures

Question 15

A small business uses MAC address filtering on its wireless network to prevent unauthorized access. Which attack is most likely to bypass this control?

Accepted Answer

MAC spoofing. MAC address filtering is a weak access control because MAC addresses are transmitted in plaintext over the air and can be easily captured using a wireless sniffer (e.g., Wireshark). An attacker can then change their network interface's MAC address to match an allowed client via MAC spoofing, thereby bypassing the filter and gaining access to the network. This attack directly defeats the filtering mechanism without needing to crack encryption keys or impersonate the access point.

Answer

Deauthentication attack

Answer

Man-in-the-middle attack

Answer

Evil twin attack