SSCP Practice Test 35 — 15 Questions

Question 1

A military system uses mandatory access control with classifications Unclassified, Confidential, Secret, and Top Secret. A user with Secret clearance attempts to read a file labeled Top Secret. What will occur?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access is denied because the subject's clearance is lower than the object's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the subject's clearance level with the object's classification label. Since the user has a Secret clearance and the file is classified Top Secret, the subject's clearance is lower than the object's classification, so read access is denied per the Bell-LaPadula model's Simple Security Property (no read up).

Answer

Access is granted because the user has write permission

Answer

Access is granted if the user is the owner of the file

Answer

Access is granted because the user has a need-to-know

Question 2

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Accepted Answer

False positive management process. Option C (False positive management process) is essential because scanners inevitably generate findings that are not genuine vulnerabilities, and a mature program must triage, validate, and document these to prevent wasted remediation effort and alert fatigue. Option D (Remediation SLAs based on severity) is correct because best practices such as those in NIST SP 800-40 and CIS Controls require risk-based timeframes (for example, critical vulnerabilities remediated in days versus low-severity in weeks) to prioritize limited resources. Option E (Continuous scanning capability) is correct because mature programs move beyond point-in-time assessments to ongoing discovery and monitoring, enabling timely detection of new vulnerabilities and asset changes. Option A (Manual patch management) does not belong because mature programs automate patching and configuration management rather than relying on manual processes, which are error-prone and unscalable. Option B (Quarterly vulnerability scans) does not belong because quarterly scanning alone is insufficient and outdated; mature programs scan continuously or at least much more frequently, and quarterly scans are typically only a compliance minimum, not a best-practice component.

Answer

Manual patch management

Answer

Quarterly vulnerability scans

Question 3

Which TWO of the following are symmetric encryption algorithms? (Select exactly two.)

Accepted Answer

DES. DES (Data Encryption Standard) is a symmetric encryption algorithm that uses a single key for both encryption and decryption. It operates on 64-bit blocks with a 56-bit key, and while now considered insecure due to its small key size, it remains a foundational symmetric cipher. AES (Advanced Encryption Standard) is also symmetric, using block sizes of 128 bits and key sizes of 128, 192, or 256 bits, and is the current standard for symmetric encryption.

Answer

RSA

Answer

ECC

Answer

SHA-256

Question 4

Which of the following is a primary function of a firewall?

Accepted Answer

Filter traffic based on rules. A firewall's primary function is to filter network traffic based on a defined set of security rules, such as source/destination IP addresses, ports, and protocols. It operates at the network layer (or higher) to permit or deny packets, acting as a barrier between trusted and untrusted networks. This rule-based filtering is the core mechanism that enforces access control policies.

Answer

Assign IP addresses

Answer

Encrypt network traffic

Answer

Detect malware on endpoints

Question 5

A network engineer configures a VLAN hopping attack prevention by setting all unused switch ports to an unused VLAN and disabling trunking. What vulnerability is being mitigated?

Accepted Answer

DTP spoofing. DTP spoofing is the correct answer because VLAN hopping attacks often exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between a switch and an attacker's device, allowing the attacker to send and receive traffic on multiple VLANs. By disabling trunking on all unused ports and assigning them to an unused VLAN, the switch will not respond to DTP negotiation requests, preventing unauthorized trunk establishment.

Answer

STP manipulation

Answer

ARP spoofing

Answer

MAC flooding

Answer

DHCP starvation

Question 6

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

Accepted Answer

Patch the exploited vulnerability and ensure the backup is free of malware.. Restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.

Answer

Verify the integrity of backup data by restoring to an isolated test environment.

Answer

Notify law enforcement immediately.

Answer

Disconnect all systems from the network.

Question 7

Which backup strategy is MOST suitable for a server with an RTO of 4 hours and an RPO of 15 minutes?

Accepted Answer

Full backup daily, transaction log backup every 15 minutes. A full backup daily combined with transaction log backups every 15 minutes meets the RPO of 15 minutes by allowing point-in-time recovery to within that window, and the full backup ensures the RTO of 4 hours is achievable because restoring the full backup plus the transaction logs is a well-understood process that can complete within the time limit. Transaction log backups capture every committed change, enabling granular recovery without requiring a full backup more frequently.

Answer

Full backup daily

Answer

Full backup monthly, incremental daily

Answer

Full backup weekly, differential daily

Question 8

During the preparation phase of the incident response lifecycle, which of the following is the MOST important component to establish?

Accepted Answer

Incident response plan. The incident response plan is the foundational document that outlines the entire process, including roles, procedures, and escalation paths. Without a formal, approved plan, other components like the communication plan, team, or tools lack the necessary structure and authority to function effectively during an incident.

Answer

Communication plan

Answer

Incident response team

Answer

Forensic analysis tools

Question 9

An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?

Accepted Answer

Network connections, memory dump, disk image. Volatile data must be collected in order of decreasing volatility. Network connections (active sessions, ARP cache, routing tables) are more volatile than RAM and can change or disappear within seconds, so they are captured first. Memory (RAM) is collected next because it is lost on power loss but persists slightly longer than network state. The disk image is collected last because it is persistent storage and the least volatile. This order preserves ephemeral evidence such as active sessions, running processes, and encryption keys before it disappears.

Answer

Disk image, network connections, memory dump

Answer

Memory dump, network connections, disk image

Answer

Disk image, memory dump, network connections

Question 10

During a malware outbreak, a security analyst needs to contain the spread. The affected systems are on the same VLAN as critical servers. Which of the following containment actions should be performed FIRST to minimize impact?

Accepted Answer

Isolate the affected systems by applying VLAN quarantine or ACLs. Isolating the affected systems by applying VLAN quarantine or ACLs is the correct first action because it immediately stops the malware from spreading laterally across the same VLAN to critical servers, while preserving forensic evidence. This network-level containment is faster and less disruptive than account or system-level changes, and it prevents the outbreak from propagating before any remediation begins.

Answer

Disable user accounts associated with the infected systems

Answer

Reboot the affected systems to clear malware from memory

Answer

Restore the affected systems from backup

Question 11

A security team discovers that a legacy system uses ECB mode to encrypt credit card numbers. What is the primary security concern with this mode?

Accepted Answer

Identical plaintext blocks produce identical ciphertext, revealing patterns. ECB (Electronic Codebook) mode encrypts each plaintext block independently using the same key. This means identical plaintext blocks produce identical ciphertext blocks, which allows an attacker to detect patterns, data boundaries, and repetitions in the encrypted data. For credit card numbers, which often have predictable formats (e.g., BIN ranges, fixed lengths), this pattern leakage can reveal sensitive information without breaking the encryption key.

Answer

It is slow compared to other modes

Answer

It is vulnerable to padding oracle attacks

Answer

It does not provide integrity

Question 12

Which metric is used to measure the average time it takes to detect an incident?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the correct metric because it specifically measures the average time elapsed between the occurrence of an incident and its detection by monitoring systems or security personnel. This metric is critical in incident response as it directly impacts the window of opportunity for attackers to cause damage before containment begins.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Resolve (MTTR)

Answer

Recovery Time Objective (RTO)

Question 13

During an audit, it is discovered that a contractor’s account has read access to a financial database even though the contractor’s project ended six months ago. Which type of access control failure is this?

Accepted Answer

Poor account management. The contractor's account retained access privileges after the project ended, which is a failure of the account lifecycle management process. Proper account management requires disabling or removing accounts when a user's role or affiliation changes, such as when a contract terminates. This is not an authorization or authentication issue, as the access was originally granted correctly but was not revoked in a timely manner.

Answer

Inadequate authorization

Answer

Insufficient authentication

Answer

Weak password policy

Question 14

Which TWO of the following are key indicators of a potential data exfiltration attempt?

Accepted Answer

Unusual outbound traffic to a known malicious IP address. Option B is correct because unusual outbound traffic to a known malicious IP address is a classic exfiltration indicator — data leaving the network to an attacker-controlled command-and-control (C2) or drop server, often over DNS, HTTP/S, or other protocols, signals that stolen data may be leaving the environment. Option E is correct because a sudden spike in database read operations by a single account indicates bulk collection or staging of data, a common precursor or component of exfiltration (e.g., SELECT-heavy queries or mass table dumps). Option A is not an exfiltration indicator but rather a sign of brute-force or credential-stuffing activity, which is an initial-access attempt. Option C is not specific to exfiltration; firewall rule changes suggest configuration tampering or persistence, not necessarily data leaving. Option D indicates compromised credentials or impossible-travel/account takeover, which is an access anomaly rather than proof of data being exfiltrated.

Answer

Large number of failed login attempts from multiple accounts

Answer

Multiple firewall rule changes in a short period

Answer

Successful logins from unusual geolocations for multiple users

Question 15

An organization wants to implement a hashing algorithm for integrity checks. Which of the following should be avoided due to known vulnerabilities? (Select TWO)

Accepted Answer

MD5. MD5 (C) must be avoided because it is cryptographically broken: practical collision attacks (e.g., the 2004 Wang attacks and later chosen-prefix collisions) allow two different inputs to produce the same 128-bit digest, so it cannot reliably detect malicious modification. SHA-1 (E) must also be avoided because collision attacks are practical (the 2017 SHAttered attack produced two colliding PDFs), making its 160-bit digest unsuitable for integrity checks against adversaries. SHA-3 (A) and SHA-256 (B) are unmarked because they are current, collision-resistant hash functions from the SHA-2/SHA-3 families and are appropriate for integrity verification. HMAC-SHA256 (D) is unmarked because it is a keyed MAC built on SHA-256 that provides both integrity and authenticity and has no known practical breaks.

Answer

SHA-3

Answer

SHA-256

Answer

HMAC-SHA256