SSCP Practice Test 36 — 15 Questions

Question 1

Which of the following are considered secure cryptographic practices for key management? (Select THREE)

Accepted Answer

Implementing regular key rotation. Secure key management practices include: (B) implementing regular key rotation, which limits the amount of data protected by a single key and reduces the impact of a key compromise, consistent with guidance such as NIST SP 800-57; (C) using a Hardware Security Module (HSM) for key storage, since HSMs provide tamper-resistant hardware protection and keep keys out of general-purpose systems; and (E) securely destroying keys when they are no longer needed, so that retired or compromised keys cannot be recovered and misused. In contrast, storing keys in plaintext configuration files (A) and sharing keys over email (D) are insecure practices that expose keys to unauthorized disclosure.

Answer

Storing keys in plaintext configuration files

Answer

Sharing keys over email for convenience

Question 2

An analyst detects suspicious outbound traffic from a server to a known command-and-control IP address. According to NIST SP 800-61, which phase of the incident response lifecycle does this activity fall under?

Accepted Answer

Detection and Analysis. The detection of suspicious outbound traffic to a known command-and-control IP address is a clear indicator of a potential security incident. According to NIST SP 800-61, this activity falls under the 'Detection and Analysis' phase, which involves identifying and validating that an incident has occurred through monitoring, alerting, and analysis of security events.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 3

An organization is developing a risk register. Which TWO elements are essential for each risk entry?

Accepted Answer

Risk description. Option B (Risk description) is essential because every risk register entry must clearly document the nature of the risk — what could happen, the threat/vulnerability involved, and the potential consequence — so it can be understood, communicated, and managed consistently. Option D (Likelihood and impact rating) is essential because risk registers require each risk to be assessed and prioritized by combining the probability of occurrence (likelihood) with the severity of the outcome (impact), which drives risk ranking and treatment decisions. Option A (Risk owner) is a valuable governance field but is not one of the two essential elements tested here, as ownership can be assigned after the risk is identified and described. Option C (Residual risk level) is not essential at the point of entry because residual risk is determined only after mitigation or treatment has been applied. Option E (Mitigation cost) is not essential because cost is a treatment consideration, not a defining attribute required for every risk entry.

Answer

Risk owner

Answer

Residual risk level

Answer

Mitigation cost

Question 4

Based on the exhibit, if the user attempts to upload (write) a file to the shared data repository corporate-data, what is the result?

Accepted Answer

Denied because the explicit deny overrides any allow. The resource's access control policy includes an explicit deny statement that denies write permission for the user's principal. In standard access control policy evaluation, an explicit deny always overrides any allow, regardless of other permissions. Therefore, even if other statements allow write access, the explicit deny blocks the upload.

Answer

Allowed because the access policy likely allows public writes

Answer

Denied because write permission is not explicitly allowed

Answer

Allowed because the policy also allows read access

Question 5

A company is adopting a role-based access control (RBAC) model. Which TWO principles are fundamental to RBAC?

Accepted Answer

Roles can be organized in a hierarchy to inherit permissions. Option A is correct because RBAC supports role hierarchies, where a senior role (e.g., Manager) inherits the permissions of a junior role (e.g., Employee), which is a core RBAC capability for structuring permissions efficiently. Option B is correct because the defining characteristic of RBAC is assigning users to roles according to their job functions or responsibilities, and permissions are then granted to those roles rather than to individual users. Option C is incorrect because control by the data owner describes discretionary access control (DAC), not RBAC. Option D is incorrect because assigning permissions directly to users is the opposite of RBAC, which assigns permissions to roles. Option E is incorrect because access decisions based on subject and object attributes describe attribute-based access control (ABAC), not RBAC.

Answer

Access is controlled by the data owner

Answer

Permissions are assigned directly to users

Answer

Access decisions are based on subject and object attributes

Question 6

Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (ABAC) is attribute-based and not the traditional model for military-grade security. Option C (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option D (RBAC) uses roles, not classification levels.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 7

An IT administrator needs to ensure that all workstations receive security patches in a timely manner. Which process is MOST effective for this?

Accepted Answer

Deploy a centralized patch management solution. A centralized patch management solution (C) is the most effective because it provides a single point of control to automate the distribution, installation, and verification of security patches across all workstations. It ensures consistency, timeliness, and scalability, and typically includes reporting and compliance features that manual or decentralized methods lack. This directly addresses the need to patch all workstations in a timely manner.

Answer

Use only operating systems that no longer require security patches

Answer

Assign a technician to manually patch each workstation monthly

Answer

Enable automatic updates on each workstation from the vendor

Question 8

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Accepted Answer

Human intentional risk. The scenario describes a successful login after multiple failed attempts from an unfamiliar IP address at an unusual time (3:00 AM). This pattern strongly indicates a deliberate brute-force or credential-stuffing attack, where an attacker intentionally attempts to gain unauthorized access. Therefore, the risk is human intentional, as it involves a malicious actor's purposeful actions.

Answer

Environmental risk

Answer

Human accidental risk

Answer

Technical risk

Question 9

A security analyst reviews the health dashboard of the organization's Security Information and Event Management (SIEM) platform and notices that event ingestion from the primary domain controllers stopped at 02:00, while all other log sources continue to report normally. Which of the following should the analyst investigate FIRST to determine why domain controller logs are missing?

Accepted Answer

The Windows Event Forwarding subscription and the collector service status on the domain controllers. When one log source class stops feeding a SIEM while others continue, the fault lies in the collection pipeline unique to that source, not in shared infrastructure. Windows Event Forwarding subscriptions and the Windows Event Collector service are the exact mechanisms that transport domain controller events, so checking subscription health and collector service state isolates the failure quickly before broader troubleshooting.

Answer

The network firewall rules governing outbound syslog traffic from all monitored hosts

Answer

The SIEM correlation rules that map domain controller event IDs to alert severity levels

Answer

The retention and rollover settings on the SIEM storage volumes

Question 10

A financial firm is designing access controls for a trading application. The firm wants to prevent any single employee from both initiating a large funds transfer and approving it, and it also wants to ensure that access rights are automatically revoked when an employee changes departments. Which combination of principles is the firm applying?

Accepted Answer

Separation of duties and role-based access control with lifecycle management. The requirement that one employee cannot both initiate and approve a transfer is the classic definition of separation of duties, which splits a sensitive process across multiple people. Automatically revoking or adjusting rights when an employee changes departments reflects role-based access control combined with lifecycle management, where access follows the current role rather than persisting indefinitely. Applying both principles together satisfies the firm's objectives.

Answer

Zero trust and continuous authentication

Answer

Defense in depth and mandatory access control

Answer

Least privilege and need to know

Question 11

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

Accepted Answer

Least privilege. Least privilege ensures that a user or process is granted only the minimum permissions necessary to perform their job function. In this scenario, the help desk technician needs the ability to reset passwords but must be restricted from modifying other user attributes, such as group membership or account expiration. By applying least privilege, the technician's account is assigned a role or permission set that specifically allows password reset operations (e.g., via Active Directory delegated permissions or a custom RBAC role) while explicitly denying write access to other user object properties.

Answer

Need-to-know

Answer

Separation of duties

Answer

Mandatory access control

Question 12

Which TWO of the following are considered secure cryptographic hash functions as of current standards? (Select TWO.)

Accepted Answer

SHA-3. SHA-3 (Option A) is correct because it is the latest NIST-standardized hash function family (FIPS 202), based on the Keccak sponge construction, and remains resistant to known collision and preimage attacks. SHA-256 (Option E) is correct because it is part of the SHA-2 family (FIPS 180-4) and is still considered cryptographically secure for collision resistance and preimage resistance in current standards. RC4 (Option B) is a stream cipher, not a hash function, and is deprecated due to biases in its keystream. SHA-1 (Option C) is no longer considered secure because practical collision attacks (e.g., SHAttered) have been demonstrated. MD5 (Option D) is also broken, with trivial collision generation, so it is unsuitable for security purposes.

Answer

RC4

Answer

SHA-1

Answer

MD5

Question 13

A system administrator notices that a user's account has been locked out multiple times within an hour. The admin reviews the logs and finds repeated failed login attempts from an unusual IP address. What is the BEST immediate action to mitigate further risk?

Accepted Answer

Implement a firewall rule to block the IP address. The account is already locked out from repeated failed login attempts, so disabling it does not add protection against the current attack. The BEST immediate action to mitigate further risk is to block the unusual source IP address (Option C), which stops the ongoing attack at the network level. While an attacker could change IPs, blocking the known malicious source is the most direct and effective immediate mitigation. Disabling the account (Option A) is redundant given the lockout and does not address the source of the attack.

Answer

Disable the user account

Answer

Delete the failed login log entries

Answer

Reset the user's password

Question 14

A company is selecting a cryptographic algorithm for digital signatures. Which THREE of the following algorithms can be used for digital signatures? (Select THREE.)

Accepted Answer

DSA. DSA (Option B) is a Digital Signature Algorithm designed specifically to generate and verify digital signatures using discrete logarithms, so it is correct. RSA (Option D) can produce digital signatures by signing a hash with the private key and verifying with the public key, making it a valid signature algorithm. ECDSA (Option E) is the Elliptic Curve Digital Signature Algorithm, which provides digital signatures based on elliptic-curve cryptography and is also correct. SHA-256 (Option A) is only a hash function used to create message digests, not a signature algorithm by itself, and AES (Option C) is a symmetric block cipher for encryption, not for digital signatures.

Answer

SHA-256

Answer

AES

Question 15

Which THREE of the following are common techniques for identifying risks?

Accepted Answer

Stakeholder interviews. Stakeholder interviews are a common technique for identifying risks because they leverage the knowledge and experience of individuals who have a direct interest in or are affected by the project or system. By engaging stakeholders, you can uncover risks that may not be apparent from documentation or technical analysis, as they provide insights into operational, regulatory, and business-specific threats. This aligns with the risk identification process in the SSCP domain, which emphasizes gathering input from diverse sources to build a comprehensive risk profile.

Answer

Penetration testing

Answer

Quantitative risk analysis