SSCP Practice Test 35 — 15 Questions

Question 1

A company's security policy requires that employees must change their passwords every 60 days. However, help desk tickets show that many users are locked out after forgetting their new passwords. Which of the following would BEST balance security and usability?

Accepted Answer

Implement single sign-on (SSO) for all applications. Single sign-on (SSO) reduces the number of passwords users must remember to one set of credentials, which decreases the likelihood of forgotten passwords and lockouts. By centralizing authentication, SSO allows the organization to enforce a strong password policy (e.g., 60-day rotation) while improving usability, as users only need to manage a single password. This balances security (centralized control, stronger authentication) with usability (fewer password resets).

Answer

Require users to use a password manager

Answer

Extend the password change interval to 90 days

Answer

Disable account lockout after failed attempts

Question 2

An organization uses a SIEM to correlate events. The SIEM receives Windows Security Event ID 4625 (failed login) and 4776 (credential validation). An analyst wants to detect a brute-force attack against a service account. Which correlation rule is most effective?

Accepted Answer

Alert on multiple failed logins for the same account from different source IPs in 10 minutes. Option C is correct because a brute-force attack against a service account typically involves multiple failed login attempts from different source IPs, as attackers often distribute their attempts to evade IP-based blocking. Correlating Event ID 4625 (failed login) and 4776 (credential validation) across multiple source IPs for the same account within a short time window (e.g., 10 minutes) directly identifies this distributed brute-force pattern, which a single-IP threshold would miss.

Answer

Alert on more than 10 failed logins from a single IP in 5 minutes

Answer

Alert on successful logins after multiple failures

Answer

Alert on any Event ID 4625 or 4776 with severity high

Question 3

A new employee needs access to the CRM, email, and file servers. The security policy requires that access privileges are granted based on job function. Which process should be used?

Accepted Answer

The identity management team assigns the employee to a role that includes the necessary permissions. Option C is correct because role-based access control (RBAC) assigns permissions based on job functions, not individual requests or ad-hoc approvals. By placing the employee into a predefined role (e.g., 'Sales Rep'), the identity management team ensures that the CRM, email, and file server permissions are granted consistently and in compliance with the security policy. This process enforces the principle of least privilege and simplifies auditing.

Answer

The employee completes a request form detailing the access they need

Answer

The IT department grants full access to all systems and later reviews

Answer

The employee's supervisor decides which access is appropriate and informs IT

Question 4

A security engineer is configuring a firewall to block all inbound traffic except for specific services. Which of the following design principles is being applied?

Accepted Answer

Least privilege. The correct answer is D, Least Privilege, because the security engineer is configuring the firewall to block all inbound traffic except for specific services. This aligns with the principle of least privilege, which dictates that only the minimum necessary access should be granted—in this case, only allowing specific services through while denying everything else by default. The firewall rule set explicitly permits only required ports (e.g., TCP/443 for HTTPS) and implicitly denies all other traffic, ensuring that no unnecessary access is permitted.

Answer

Separation of duties

Answer

Default deny

Answer

Defense in depth

Question 5

An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?

Accepted Answer

Configure Group Policy to require BitLocker encryption on removable drives.. Configuring Group Policy to require BitLocker encryption on removable drives is the most effective control because it enforces the encryption policy automatically and centrally across all domain-joined systems, preventing users from bypassing the requirement. Unlike a memo or auditing, Group Policy provides a technical enforcement mechanism that blocks unencrypted removable media from being used, ensuring compliance without relying on user discretion.

Answer

Distribute a memo to all employees about the policy.

Answer

Enable auditing for removable drive usage.

Answer

Enable BitLocker on all laptops.

Question 6

Which TWO of the following are examples of preventive controls for data leakage?

Accepted Answer

Encryption.. Encryption is a preventive control because it renders data unreadable to unauthorized parties, thereby preventing data leakage even if the data is intercepted or accessed without authorization. By transforming plaintext into ciphertext using algorithms like AES-256, encryption ensures that only entities with the correct decryption key can access the original data, effectively blocking data exfiltration at rest or in transit.

Answer

Log monitoring.

Answer

Security awareness training.

Answer

User access reviews.

Question 7

A security analyst is investigating a potential data exfiltration incident. The logs show a large number of outbound DNS queries to a domain that resolves to an IP address in a foreign country. The queries contain encoded strings in the subdomain. Which type of attack is MOST likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses to bypass network security controls. The large volume of outbound queries to a foreign IP, combined with encoded subdomain strings, is the classic signature of data exfiltration via DNS tunneling, as the protocol is often allowed through firewalls.

Answer

DNS poisoning

Answer

DNS amplification attack

Answer

DNS rebinding

Question 8

A security administrator is tasked with managing user access. Which THREE of the following are principles of least privilege? (Choose three.)

Accepted Answer

Grant users the minimum rights needed to perform their job.. Option C is correct because the principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. It is a foundational access control concept enforced through role-based access control (RBAC) or attribute-based access control (ABAC) policies.

Answer

Implement mandatory access control.

Answer

Require manager approval for privilege escalation.

Question 9

An organization is migrating from on-premises servers to a cloud IaaS model. The security team must ensure that virtual machine (VM) images are hardened before deployment. Which of the following is the MOST effective control to ensure consistency and compliance with security baselines?

Accepted Answer

Create a golden image that is hardened and approved for use, and deploy VMs from that image. Creating a golden image that is hardened and approved for use ensures that every VM deployed from it inherits a consistent, pre-configured security baseline. This approach eliminates configuration drift and manual errors by baking security controls into the image before deployment, making it the most effective control for consistency and compliance.

Answer

Perform vulnerability scans on each VM after deployment

Answer

Apply the latest OS patches to each VM immediately after deployment

Answer

Train administrators on hardening procedures and rely on manual configuration

Question 10

A system administrator needs to securely transfer log files from a Linux server to a central log collector. Which protocol should be used to ensure confidentiality and integrity?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted tunnels for data transfer, ensuring both confidentiality and integrity of log files in transit. It uses strong cryptographic algorithms (e.g., AES, ChaCha20) and HMAC-based integrity checks, making it the correct choice for secure file transfer over untrusted networks.

Answer

SMTP

Answer

NFS

Answer

FTP

Question 11

Which TWO of the following are key components of an organization's security policy framework? (Choose two.)

Accepted Answer

Standard operating procedures. Standard operating procedures (SOPs) are a key component of an organization's security policy framework because they provide detailed, step-by-step instructions for implementing security controls and responding to incidents. SOPs operationalize high-level policies into actionable tasks, ensuring consistency and compliance across the organization. They are formal documents that define the 'how' of security operations, such as patch management or user account provisioning.

Answer

Intrusion detection system

Answer

Access control lists

Answer

Firewall rules

Question 12

During a security assessment, a penetration tester discovers that a web application allows users to upload files without proper validation. The tester successfully uploads a PHP web shell. Which control would have MOST effectively prevented this exploitation?

Accepted Answer

Validate file extension and content type on the server side.. Option D is correct because server-side validation of both file extension and content type (e.g., MIME type magic bytes) is the most effective control to prevent uploading executable files like a PHP web shell. Without this validation, an attacker can bypass client-side checks and upload a malicious script that the server will execute. Disabling PHP execution in the upload directory (Option A) is a compensating control but does not prevent the upload itself, and a WAF rule (Option B) can be evaded with obfuscation or encoding.

Answer

Disable PHP execution in the upload directory.

Answer

Implement a WAF rule to block common webshell patterns.

Answer

Enable audit logging for file uploads.

Question 13

Which THREE of the following are key objectives of data classification?

Accepted Answer

Identify and protect sensitive information. Data classification is a foundational security control that directly supports the identification and protection of sensitive information. By categorizing data based on its sensitivity and criticality, organizations can apply appropriate security controls, such as access controls and encryption, to safeguard confidential data from unauthorized disclosure or modification.

Answer

Reduce storage costs by identifying duplicate data

Answer

Determine the encryption algorithm to use

Question 14

An organization wants to ensure that only authorized devices can connect to its internal network. Which of the following should be implemented?

Accepted Answer

Network access control (NAC). Network Access Control (NAC) is the correct choice because it enforces security policy by evaluating the identity, posture, and compliance of devices before granting network access. NAC solutions (e.g., Cisco ISE, Aruba ClearPass) can authenticate devices via 802.1X, check for antivirus updates or patch levels, and quarantine non-compliant endpoints, ensuring only authorized and healthy devices connect to the internal network.

Answer

Intrusion detection system

Answer

Port security on switches

Answer

Virtual private network

Question 15

A multinational corporation is migrating its on-premises applications to a cloud provider. The identity management infrastructure must support single sign-on (SSO) across multiple cloud services and maintain on-premises Active Directory as the authoritative identity source. The security team is concerned about credential stuffing attacks and password spray attacks. They want to implement a risk-based access policy that requires additional verification when logins originate from unusual locations or devices. Additionally, they need to ensure that user accounts are provisioned and deprovisioned in the cloud in near real-time based on AD changes. Which of the following solutions BEST meets these requirements?

Accepted Answer

Implement a SAML-based federation with AD FS and integrate with Azure AD Conditional Access policies.. SAML-based federation with AD FS and Azure AD Conditional Access provides SSO, risk-based policies (Conditional Access uses real-time signals like location and device), and near-real-time provisioning via Azure AD Connect. VPN with smart cards does not provide SSO or risk-based policies. OAuth 2.0 with client credentials is not for user authentication. A separate cloud identity store with password sync introduces delays and does not support risk-based access.

Answer

Deploy a VPN that requires smart card authentication for all cloud access.

Answer

Use OAuth 2.0 with client credentials grant for all applications.

Answer

Set up a separate cloud identity store and synchronize passwords using a directory sync tool.