SSCP Practice Test 36 — 15 Questions

Question 1

A hospital is implementing an access control system for its electronic health record (EHR) system. The system must comply with HIPAA regulations, which require that access to patient records is limited to personnel who need it to perform their job duties. The hospital has many roles: doctors, nurses, lab technicians, and administrative staff. Each role can access different types of records. The system currently uses a DAC model where each user sets permissions on their own files. However, a recent risk assessment identified that some nurses have been sharing their accounts with each other to access records outside their unit. The hospital wants to implement a more restrictive model that enforces access based on job roles and prevents sharing of accounts. Which access control model should the hospital adopt?

Accepted Answer

Role-Based Access Control (RBAC) with mandatory account uniqueness. Option D is correct because Role-Based Access Control (RBAC) enforces access permissions based on job roles, directly aligning with HIPAA's need-to-know principle. Mandatory account uniqueness prevents account sharing by requiring each user to have a unique identifier, eliminating the ability to share credentials. This combination provides a more restrictive, policy-driven model than DAC, which allowed users to set their own permissions and led to unauthorized access.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC) with clearance labels

Answer

Discretionary Access Control (DAC)

Question 2

An e-commerce company runs its web application on a Windows Server 2019 with IIS 10. The security team runs a vulnerability scan and discovers that the server supports TLS 1.0 and several CBC-mode cipher suites, which are prohibited by the company's security policy. The policy requires disabling all versions of TLS below 1.2 and all cipher suites that do not use GCM mode. The administrator needs to implement the required changes without affecting the application's functionality, as it still needs to support a small number of legacy clients that require TLS 1.2 but not CBC. Which action should the administrator take?

Accepted Answer

Disable TLS 1.0 via the registry and configure the cipher suite order in IIS to prefer GCM-based ciphers.. Option C is correct because the administrator can disable TLS 1.0 via the Windows registry (e.g., by creating the 'Enabled' DWORD under 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' and setting it to 0) and then configure the cipher suite order in IIS using the 'SchUseStrongCrypto' registry key or the 'Cipher Suites' group policy to prioritize GCM-based ciphers (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). This directly enforces the policy—disabling TLS below 1.2 and non-GCM ciphers—while still allowing legacy clients that support TLS 1.2 with GCM to connect without breaking functionality.

Answer

Upgrade the server to Windows Server 2022, which automatically disables TLS 1.0.

Answer

Implement a reverse proxy with strong TLS configuration and route all traffic through it.

Answer

Apply a hotfix from Microsoft that removes TLS 1.0 support.

Question 3

A small business experienced a ransomware attack that encrypted all files on the file server. They have no backups. The attacker demands a ransom. The CEO asks for advice. Which recommendation should the incident responder give?

Accepted Answer

Contact law enforcement and attempt decryption from public tools. Option C is correct because contacting law enforcement and attempting decryption using public tools is the most responsible action. Paying the ransom (A) is discouraged and does not guarantee recovery. Wiping the server (B) and rebuilding from cloud sync would lose all data if no sync exists. Reinstalling and rebuilding manually (D) is extremely time-consuming and likely impossible without backups.

Answer

Wipe the server and restore from the cloud sync if available

Answer

Pay the ransom immediately to regain access

Answer

Reinstall the OS and rebuild data from manual copies

Question 4

An organization uses a central syslog server to collect logs from firewalls, servers, and network devices. Recently, the security team noticed that some critical events from the firewall are missing from the syslog server. The firewall configuration sends syslog messages using UDP to the syslog server. The syslog server administrator reports that the server is receiving a high volume of logs and occasionally drops packets due to buffer overflow. The team needs to ensure reliable delivery of all syslog messages without losing any. Which solution should the team implement?

Accepted Answer

Switch to TCP-based syslog with TLS.. Option B is correct because switching to TCP-based syslog with TLS provides reliable, connection-oriented delivery with encryption. Option A is incorrect because increasing the UDP buffer may reduce drops but does not guarantee reliability. Option C is incorrect because log aggregation at each segment does not address the transport reliability issue. Option D is incorrect because a load balancer would distribute load but not prevent UDP packet loss.

Answer

Increase the UDP buffer size on the syslog server.

Answer

Implement log aggregation at each network segment.

Answer

Use a load balancer for syslog receivers.

Question 5

A small business uses a wireless network for employees and guests. The network uses WPA2-PSK with a single SSID, and the guest network is separate but broadcasts the same SSID. Recently, employees report intermittent connection drops and slow internet speeds. A site survey shows multiple access points from neighboring businesses operating on channels 1, 6, and 11. The business's access points are set to auto-channel selection. What is the most likely cause of the issue?

Accepted Answer

Channel interference due to overlapping channels. The correct answer is C. With multiple neighboring access points operating on channels 1, 6, and 11, and the business's access points set to auto-channel selection, the most likely cause is channel interference. Auto-channel selection may not dynamically avoid co-channel or adjacent-channel overlap, leading to contention, retransmissions, and degraded performance. The separate guest network broadcasting the same SSID can also cause client confusion and increased collisions.

Answer

RADIUS server misconfiguration

Answer

Rogue access point

Answer

Weak PSK passphrase

Question 6

A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?

Accepted Answer

Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.. Option A is correct because applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.

Answer

Add a firewall rule to block all traffic to and from the server's IP.

Answer

Move the server to a quarantine VLAN with no route to the internet.

Answer

Shut down the switch port to disconnect the server immediately.

Question 7

You work for a financial services firm that must comply with GDPR and PCI DSS. The company uses a cloud-based CRM to store customer data. The security team recently discovered that the CRM vendor had a data breach that exposed the company's customer records. An investigation shows that the breach occurred because the vendor did not have multi-factor authentication (MFA) enabled for administrative accounts. The contract with the vendor states that the vendor is responsible for security of their platform. However, your company had not conducted a risk assessment of the vendor before signing the contract. Management wants to improve risk identification for third-party relationships. Which of the following is the BEST long-term solution?

Accepted Answer

Implement a third-party risk management program with periodic security assessments and contractual security requirements. Option A is correct because a third-party risk management (TPRM) program with periodic security assessments and contractual security requirements directly addresses the root cause: the lack of pre-contract risk identification and ongoing vendor oversight. By embedding MFA requirements into contracts and performing regular assessments (e.g., reviewing SOC 2 reports, conducting penetration tests), the company can proactively enforce security controls like MFA for administrative accounts, preventing future breaches. This is a sustainable, long-term solution that aligns with GDPR and PCI DSS due diligence obligations.

Answer

Demand that the vendor reimburse the company for breach costs

Answer

Cancel the contract with the vendor and move to a private cloud solution

Answer

Require all vendors to provide SOC 2 reports

Question 8

A company runs a critical web application on an internal server that authenticates users against a Microsoft SQL Server database. The application was developed by a vendor that is no longer in business, and the source code is unavailable. The current authentication process stores user passwords using reversible encryption. The security team has identified this as a high-risk vulnerability. They propose implementing a database-level trigger that hashes the password column during INSERT and UPDATE operations, and modifying the application's stored procedures to compare hashed values during login. However, after implementation, users report that they cannot log in. The authentication logs show that the password comparison always fails. The database administrator confirms that the trigger is working and that new user registrations store the SHA-256 hash. What is the most likely cause of the login failures?

Accepted Answer

The stored procedure for login is still comparing the plain-text password with the hash.. Option C is correct because the stored procedure for login likely still expects a plain-text password and compares it directly to the stored hash, causing failure. Option A is incorrect because the trigger should fire on all updates, including those by the same user. Option B is incorrect because the trigger uses SHA-256 and the stored procedure should use the same algorithm. Option D is incorrect because the trigger should be defined on the password column.

Answer

The trigger does not hash the password during UPDATE operations that are performed by the same user.

Answer

The application is using a different hashing algorithm than the trigger.

Answer

The trigger hashes the password only if the password column is part of a specific set of columns.

Question 9

A company has deployed an internal public key infrastructure (PKI) using Microsoft Active Directory Certificate Services (AD CS) to issue certificates for internal web servers. The certificate policy requires RSA 2048-bit keys and SHA-256 hashing. During a routine security audit, the administrator discovers that several web server certificates issued by the internal CA are using SHA-1 signatures. The CA is configured with a default Web Server certificate template. The administrator wants to ensure that all future certificates from this CA use SHA-256 as the hash algorithm. What is the most effective and secure course of action?

Accepted Answer

Update the certificate template to specify SHA-256 as the hash algorithm and reissue certificates. Updating the certificate template to specify SHA-256 ensures that all new requests use the correct hash algorithm. Changing the CA signing algorithm (A) does not affect templates; revoking certificates (C) is disruptive and unnecessary; setting security level (D) is vague and does not change the hash algorithm.

Answer

Increase the CA's security level in the console and restart the service

Answer

Modify the CA's signing algorithm in the registry to force SHA-256

Answer

Revoke all SHA-1 certificates and request new ones from a public CA

Question 10

A company has 200 employees using a Windows Active Directory environment. The security administrator receives multiple alerts that user accounts are being locked out every 15 minutes. The help desk confirms that users who report the issue are able to log in successfully after unlocking their accounts, but they get locked out again shortly after. The administrator checks the domain controller security logs and sees many failed logon attempts with a specific service account name 'svc_backup' from multiple workstations. The svc_backup account is used for a backup application that runs scheduled tasks. What should the administrator do to resolve the issue?

Accepted Answer

Change the password for svc_backup and update the backup application with the new password. The repeated lockouts are caused by a service account (svc_backup) being used with an incorrect or expired password. The most effective solution is to reset the password for that account and update it in the backup application. Disabling the account or increasing the lockout threshold does not fix the root cause. Creating a new account without addressing the password mismatch will not stop the current account from being used.

Answer

Disable the svc_backup account until the backup vendor releases a patch

Answer

Create a new service account with a different name and grant it the same permissions

Answer

Increase the account lockout threshold to prevent lockouts

Question 11

A medium-sized financial services company has recently deployed a new web application that processes sensitive customer data, including Social Security numbers and account balances. The security team implemented network segmentation, a web application firewall (WAF) from a reputable vendor, and quarterly vulnerability scans. The developers assert that they use parameterized queries for all database calls in the main application code. During a recent penetration test, testers successfully exploited a SQL injection vulnerability, extracting the entire customer database. Further investigation reveals that the main application indeed uses parameterized queries, but a third-party reporting module, integrated to generate compliance reports, constructs SQL queries by concatenating user-supplied date range inputs directly into SQL strings. The WAF is configured with a generic rule set and has not been tuned to the application's specific traffic patterns. What is the most effective course of action to remediate this vulnerability and prevent future occurrences?

Accepted Answer

Replace the third-party reporting module with an alternative that uses parameterized queries.. The root cause is the third-party module's insecure query construction. Replacing it with a module that uses parameterized queries directly eliminates the vulnerability at its source. Input validation (A) is a defense-in-depth measure but not sufficient if concatenation is still used. Increasing scan frequency (C) does not fix the underlying issue. Configuring the WAF (D) provides a layer of defense but can be bypassed and is not as reliable as eliminating the vulnerable code.

Answer

Implement strict input validation to sanitize user-supplied date inputs.

Answer

Increase the frequency of vulnerability scans from quarterly to monthly.

Answer

Configure the WAF to block SQL injection patterns with custom rules.

Question 12

You are the security administrator for a mid-sized financial services company. The company uses Active Directory (AD) for identity management and has implemented role-based access control (RBAC) for its core banking application. Recently, the company acquired a smaller firm and is integrating its employees into AD. During the integration, you notice that many of the new employees have been assigned multiple roles that grant them access to sensitive financial data, despite their job descriptions indicating they need only limited access. Additionally, some users who left the acquired company have not been disabled in AD. The company's security policy mandates the principle of least privilege and requires that access reviews be conducted quarterly, but no review has been performed in the past year. You have been tasked with remediating these issues. Which of the following approaches is the MOST effective initial step to address the immediate risk of excessive access?

Accepted Answer

Immediately disable all user accounts from the acquired company that have not been logged in within the last 90 days.. Option D is the most effective initial step because it immediately reduces the attack surface by disabling accounts that are likely orphaned (no login in 90 days), directly addressing the immediate risk of excessive access from former employees. This aligns with the principle of least privilege and is a quick, high-impact remediation that can be performed before a full access review or recertification.

Answer

Conduct a comprehensive access recertification review for all users in the acquired company.

Answer

Implement multifactor authentication (MFA) for all users in the acquired company.

Answer

Roll back all user permissions to the default role and then re-add each user based on their job function.

Question 13

A large financial institution has deployed a new web application for customer account management. The application uses role-based access control (RBAC) with roles such as Customer, Teller, Manager, and Admin. Recently, an audit revealed that a Teller was able to view and modify account details belonging to customers outside their assigned branch. The application authenticates users via the corporate Active Directory and uses AD groups for role mapping. The Teller's AD group membership was verified to be correct. The security team suspects a flaw in the authorization logic. Which of the following is the MOST likely root cause?

Accepted Answer

The application fails to validate the user's branch attribute after authentication.. The Teller's AD group membership was verified correct, so the role mapping (RBAC) is functioning. However, the Teller could access accounts outside their assigned branch, indicating the application lacks a post-authentication check of the user's branch attribute. This is a classic failure of attribute-based access control (ABAC) within an RBAC framework, where the application must validate the user's branch (e.g., from an AD attribute like 'physicalDeliveryOfficeName' or a custom attribute) against the account's branch before allowing read/write operations.

Answer

The application's role-to-permission mapping is based on group SID rather than group name.

Answer

The application does not perform proper session management.

Answer

The application uses a horizontal privilege escalation vulnerability.

Question 14

A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?

Accepted Answer

Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.. Option A is correct because replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.

Answer

Continue using RC4 and accept the risk, since the network is isolated.

Answer

Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.

Answer

Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.

Question 15

A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?

Accepted Answer

Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.. Option A is correct because the root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.

Answer

Publish a certificate revocation list (CRL) and wait for existing certificates to expire.

Answer

Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.

Answer

Enable OCSP stapling on all web servers to check revocation status in real time.