SSCP Practice Test 35 — 15 Questions

Question 1

A company uses role-based access control (RBAC). A user is assigned to the 'Sales' role, which grants access to CRM and reporting, and also to the 'Sales Manager' role, which grants additional access to team reports. However, the user cannot access team reports. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's session is not properly managed. In an RBAC system, users are assigned roles, and they establish a session during which they select which authorized roles to activate. If the user's session is not properly managed—for example, they activated only the 'Sales' role and not the 'Sales Manager' role—they would not have the permissions from the 'Sales Manager' role, thus preventing access to team reports. Even though both roles are assigned, the active role set determines effective permissions.

Answer

An access control list on the report folder explicitly denies the 'Sales' role

Answer

The user account has been disabled

Answer

RBAC role hierarchy is not configured

Question 2

An analyst reviews a Windows security log. Given the event, what is the MOST likely cause of the lockout?

Accepted Answer

A remote attacker is attempting to brute-force the user's password via RDP. A Remote Desktop (RDP) session using Logon Type 10 with multiple failed attempts from the same source is indicative of a brute-force attack, which commonly causes account lockouts. Option A is incorrect because using an old password after a password change would typically result in a single failure, not a lockout. Option B is incorrect because expired cached credentials would not trigger a lockout; they would simply prevent authentication. Option D is incorrect because a single wrong password entry at the physical console would not cause a lockout unless the account lockout threshold is set to 1, which is uncommon; moreover, the logon type for physical console is Logon Type 2, not the RemoteInteractive type mentioned in the scenario.

Answer

The user's password was changed and they are using the old password

Answer

The user's cached credentials are expired

Answer

The user entered the wrong password at the physical console

Question 3

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 4

An organization's security policy prohibits employees from sharing passwords. What type of policy is this?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines the rules and guidelines for using an organization's IT resources, including prohibited behaviors like password sharing. This policy sets the overall acceptable behavior framework, whereas a Password Policy specifically governs password creation, complexity, and rotation rules, not the act of sharing. Therefore, a prohibition on sharing passwords falls under the AUP because it addresses user conduct rather than technical password parameters.

Answer

Data Handling Policy

Answer

Password Policy

Answer

Remote Access Policy

Question 5

An organization experiences a ransomware attack that encrypts critical data. The incident response team isolates affected systems. What is the NEXT step?

Accepted Answer

Identify the root cause. After isolating affected systems to contain the ransomware, the next step is to identify the root cause (e.g., how the ransomware entered, which vulnerability was exploited, or which user account was compromised). This aligns with the NIST SP 800-61 incident response lifecycle, where identification and analysis precede eradication and recovery. Without determining the root cause, reimaging or restoring from backup risks reinfection or missing a persistent backdoor.

Answer

Reimage systems

Answer

Notify law enforcement

Answer

Restore from backup

Question 6

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Answer

Warm site

Answer

Mobile site

Answer

Cold site

Question 7

Drag and drop the steps for performing a risk assessment according to NIST SP 800-30 into the correct order.

Accepted Answer

Step 1: Characterize system, Step 2: Identify threats, Step 3: Identify vulnerabilities, Step 4: Determine risk, Step 5: Mitigate. Risk assessment steps: characterize system, identify threats, identify vulnerabilities, determine risk, then mitigate.

Answer

Step 1: Identify threats, Step 2: Characterize system, Step 3: Identify vulnerabilities, Step 4: Determine risk, Step 5: Mitigate

Answer

Step 1: Characterize system, Step 2: Identify vulnerabilities, Step 3: Identify threats, Step 4: Determine risk, Step 5: Mitigate

Answer

Step 1: Characterize system, Step 2: Identify threats, Step 3: Determine risk, Step 4: Identify vulnerabilities, Step 5: Mitigate

Question 8

Which TWO are security implications of using deprecated cryptographic protocols such as SSL 3.0 and TLS 1.0?

Accepted Answer

Susceptibility to downgrade attacks. Deprecated protocols such as SSL 3.0 and TLS 1.0 have well-known security vulnerabilities. Option A is correct because these protocols are susceptible to downgrade attacks (e.g., POODLE) where an attacker forces the use of the weaker protocol. Option D is correct because they often employ weak key exchange algorithms, making encrypted communications easier to decrypt. Option E is incorrect because interoperability issues are a practical concern, not a direct security implication; the question specifically asks for security implications. Options B and C are not security implications: increased computational overhead is a performance issue, and compliance with regulations refers to legal requirements, not inherent security flaws.

Answer

Increased computational overhead

Answer

Compliance with regulations

Answer

Interoperability issues with modern systems

Question 9

Which TWO are benefits of network segmentation using VLANs? (Choose two.)

Accepted Answer

Improved security through traffic isolation. VLANs segment a network into separate broadcast domains at Layer 2. By isolating traffic between VLANs, they prevent unauthorized access and contain potential threats, which directly improves security. Additionally, because each VLAN is its own broadcast domain, broadcast frames are confined to that VLAN, reducing overall broadcast traffic on the network.

Answer

Increased available bandwidth

Answer

Elimination of routing requirements

Answer

Simplified IP address management

Question 10

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Incremental backup

Answer

Snapshot backup

Answer

Full backup

Question 11

Match each vulnerability assessment tool to its use.

Accepted Answer

Nmap: Network mapping and port scanning. Correct matches: Nmap for network mapping, Nessus for vulnerability scanning, Wireshark for packet analysis, Metasploit for exploitation testing. Common confusions include swapping Nmap with Nessus or confusing packet analysis with vulnerability scanning.

Answer

Nmap: Vulnerability scanning and identification

Answer

Nessus: Packet capture and analysis

Question 12

A company deploys a web application that processes credit card payments. The development team uses parameterized queries for all database interactions. However, during a penetration test, the tester successfully injects malicious code into a search field and retrieves sensitive customer data. Which of the following is the most likely cause?

Accepted Answer

The application uses dynamic SQL despite parameterized queries for some fields.. The use of parameterized queries prevents SQL injection, but if dynamic SQL is constructed elsewhere in the application (e.g., for the search field), it can still be vulnerable. Option B is incorrect because directory traversal exploits file system access, not database query injection. Option C is incorrect because direct query execution would require explicit permissions beyond the application's context. Option D is incorrect because XSS affects client-side execution, not direct data retrieval from the database.

Answer

The web server is misconfigured to allow directory traversal.

Answer

The database server has weak permissions allowing direct query execution.

Answer

The search field output is not sanitized, allowing stored XSS.

Question 13

An organization is moving away from legacy encryption and wants to avoid stream ciphers due to known vulnerabilities. Which of the following algorithms should be avoided because it is a stream cipher with known weaknesses like the BEAST attack?

Accepted Answer

RC4. RC4 is a stream cipher with known weaknesses, such as biases in its output stream that can lead to plaintext recovery attacks. Although the BEAST attack actually exploits CBC mode in TLS 1.0, RC4 was often used as a workaround; however, RC4 itself has inherent vulnerabilities, making it unsuitable for secure encryption. Since the organization wants to avoid stream ciphers due to such vulnerabilities, RC4 should be avoided.

Answer

3DES

Answer

AES-GCM

Answer

ChaCha20

Question 14

A medium-sized financial services company has recently deployed a new web application that processes sensitive customer data, including Social Security numbers and account balances. The security team implemented network segmentation, a web application firewall (WAF) from a reputable vendor, and quarterly vulnerability scans. The developers assert that they use parameterized queries for all database calls in the main application code. During a recent penetration test, testers successfully exploited a SQL injection vulnerability, extracting the entire customer database. Further investigation reveals that the main application indeed uses parameterized queries, but a third-party reporting module, integrated to generate compliance reports, constructs SQL queries by concatenating user-supplied date range inputs directly into SQL strings. The WAF is configured with a generic rule set and has not been tuned to the application's specific traffic patterns. What is the most effective course of action to remediate this vulnerability and prevent future occurrences?

Accepted Answer

Replace the third-party reporting module with an alternative that uses parameterized queries.. The root cause is the third-party module's insecure query construction. Replacing it with a module that uses parameterized queries directly eliminates the vulnerability at its source. Input validation (A) is a defense-in-depth measure but not sufficient if concatenation is still used. Increasing scan frequency (C) does not fix the underlying issue. Configuring the WAF (D) provides a layer of defense but can be bypassed and is not as reliable as eliminating the vulnerable code.

Answer

Implement strict input validation to sanitize user-supplied date inputs.

Answer

Increase the frequency of vulnerability scans from quarterly to monthly.

Answer

Configure the WAF to block SQL injection patterns with custom rules.

Question 15

An organization is implementing a digital signature solution to ensure non-repudiation of documents. Which combination of keys is used during the signing process?

Accepted Answer

Sender's private key to sign, sender's public key to verify. Digital signatures use asymmetric cryptography where the sender creates a signature with their private key, and the recipient verifies it with the sender's public key. This ensures non-repudiation because only the sender possesses their private key, so they cannot deny having signed the document. The process typically involves hashing the document and encrypting the hash with the sender's private key.

Answer

Recipient's public key to sign, recipient's private key to verify

Answer

Sender's public key to sign, recipient's private key to verify

Answer

A shared symmetric key for both signing and verification