SSCP Practice Test 36 — 15 Questions

Question 1

A government agency requires all employees to use smart cards for network access. The security team notices a pattern of failed authentication attempts from a specific building after hours. The attempts occur every night at 2:00 AM for about 10 minutes. The building has a badge reader at the entrance. The team suspects an attacker is trying to brute-force smart card PINs. However, the building's door logs show no entry at that time. Which of the following should the security team do FIRST to identify the risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Correlate the authentication logs with physical access logs to see if any employee was present. Correlating authentication logs with physical access logs is the best first step because it can confirm whether the failed authentication attempts originated from someone physically inside the building. The door logs show no entry after hours, so if the authentication logs correlate with physical access logs, it might indicate an employee was present (e.g., piggybacking or badge sharing). If there is no correlation, it suggests the attempts are from outside, likely an attacker. This analysis informs further action. Options B, C, and D are premature without this evidence.

Answer

Immediately isolate the building's network segment

Answer

Change all smart card PINs for that building's employees

Answer

Notify law enforcement about a potential cyberattack

Question 2

A hospital's IT department manages a network with hundreds of medical devices, including patient monitors and infusion pumps, all connected to a separate VLAN. The security team has identified that several devices are running outdated firmware with known vulnerabilities. The vendor has not released patches for these legacy devices. The hospital cannot replace them immediately due to budget constraints. The network team proposes moving the devices to a more restrictive firewall zone and implementing intrusion detection. Which of the following additional controls should be implemented to BEST reduce the risk of a breach exploiting these devices?

Accepted Answer

Implement strict network segmentation and access control lists (ACLs) to allow only necessary traffic. The best additional control is strict network segmentation and ACLs (option D) to limit communication to only essential traffic, reducing the attack surface despite the unpatched devices. Daily vulnerability scans (A) only identify issues without remediation. Host-based IPS (B) is often unsupported on legacy medical devices. A WAF (C) protects web applications, not the device-specific protocols used by monitors and pumps. Since the devices are already on a separate VLAN, further restricting allowed traffic with ACLs minimizes exposure to exploits and prevents lateral movement.

Answer

Conduct daily vulnerability scans on the device VLAN

Answer

Deploy host-based intrusion prevention on each device

Answer

Use a web application firewall (WAF) in front of the devices

Question 3

A security policy requires that all access to sensitive data be logged. Which access control function does this support?

Accepted Answer

Accounting. The requirement to log all access to sensitive data directly supports the Accounting (auditing) function of access controls. Accounting tracks user activities and resource usage, providing an audit trail that can be reviewed for compliance, security incidents, and policy enforcement. This is distinct from Authentication (verifying identity) and Authorization (granting permissions), which do not inherently produce logs of access events.

Answer

Authentication

Answer

Authorization

Answer

Provisioning

Question 4

A security team identifies a vulnerability in a web application that allows SQL injection. Which risk response strategy involves implementing input validation and parameterized queries to reduce the risk to an acceptable level?

Accepted Answer

Risk mitigation. Risk mitigation involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. Implementing input validation and parameterized queries directly addresses the SQL injection vulnerability by preventing malicious SQL from being executed, thereby reducing the risk without eliminating the application's functionality.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 5

An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?

Accepted Answer

User identity, time of day, and device compliance status. ABAC policies can combine subject (user), object (document), and environment (time, device management status) attributes to make access decisions.

Answer

User department and document creation date

Answer

User role and document classification

Answer

Document owner and file size

Question 6

A hospital is implementing an access control system for its electronic health record (EHR) system. The system must comply with HIPAA regulations, which require that access to patient records is limited to personnel who need it to perform their job duties. The hospital has many roles: doctors, nurses, lab technicians, and administrative staff. Each role can access different types of records. The system currently uses a DAC model where each user sets permissions on their own files. However, a recent risk assessment identified that some nurses have been sharing their accounts with each other to access records outside their unit. The hospital wants to implement a more restrictive model that enforces access based on job roles and prevents sharing of accounts. Which access control model should the hospital adopt?

Accepted Answer

Role-Based Access Control (RBAC) with mandatory account uniqueness. Role-Based Access Control (RBAC) enforces access permissions based on job roles, directly aligning with HIPAA's need-to-know principle. Mandatory account uniqueness prevents account sharing by requiring each user to have a unique identifier, eliminating the ability to share credentials. This combination provides a more restrictive, policy-driven model than DAC, which allowed users to set their own permissions and led to unauthorized access.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC) with clearance labels

Answer

Discretionary Access Control (DAC)

Question 7

A certificate authority (CA) issues a certificate with the extended key usage (EKU) extension specifying 'serverAuth'. Which of the following is this certificate allowed to do?

Accepted Answer

Authenticate a TLS server. The Extended Key Usage (EKU) extension specifies the intended purpose of a certificate. The 'serverAuth' OID (1.3.6.1.5.5.7.3.1) explicitly permits the certificate to be used for authenticating a TLS server during the SSL/TLS handshake, such as in HTTPS. This is defined in RFC 5280 and is enforced by TLS clients to ensure the certificate is used only for its designated purpose.

Answer

Encrypt email

Answer

Sign code

Answer

Issue subordinate CA certificates

Question 8

A company's risk management policy states that all risks with a residual risk score of 8 or higher (on a scale of 1-10) must be treated. A risk is identified with an inherent risk score of 9, and after applying controls, the residual risk score is 7. What is the appropriate action?

Accepted Answer

Formally accept the residual risk. The residual risk score of 7 is below the policy threshold of 8, so formal acceptance is appropriate. Option B is wrong because additional controls are not required since the risk is already at an acceptable level. Option C is wrong because risk transfer (insurance) is a treatment option but not necessary when residual risk is within acceptable limits. Option D is wrong because the inherent risk score was already assessed; reassessment is not needed.

Answer

Apply additional controls to reduce the risk further

Answer

Purchase cyber insurance to transfer the risk

Answer

Reassess the inherent risk score

Question 9

During a forensic investigation, you find that the attacker used a legitimate Windows tool to exfiltrate data. Which tool is commonly abused for this purpose?

Accepted Answer

PowerShell. PowerShell is a legitimate Windows administrative tool that attackers commonly abuse for data exfiltration because it provides native access to network protocols (e.g., HTTP, HTTPS, FTP, SMB) and can download/upload files directly from the command line without additional binaries. Its deep integration with the Windows operating system allows scripts to run in memory, bypassing traditional file-based detection mechanisms, making it a favored tool for post-exploitation data theft.

Answer

Telnet

Answer

Netcat

Answer

FTP

Question 10

In which access control model does the owner of a resource have full discretion over who can access it and with what permissions?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the model where the resource owner has full authority to grant or deny access to other subjects and to set the permissions (e.g., read, write, execute) on the object. This is typically implemented through Access Control Lists (ACLs) on files or objects, as seen in Windows NTFS or Linux file permissions, where the owner can change permissions using commands like `chmod` or through GUI properties.

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Question 11

A user reports that their computer is displaying a fake antivirus warning that demands payment. This is an example of which type of attack?

Accepted Answer

Scareware. Scareware is a type of malware that uses social engineering to trick users into believing their system is infected, then demands payment for a fake removal tool. The fake antivirus warning is a classic scareware tactic, as it creates urgency and fear to coerce payment, unlike ransomware which encrypts files and demands a ransom for decryption.

Answer

Social engineering

Answer

Ransomware

Answer

Phishing

Question 12

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Accepted Answer

The application passes user input to a shell command via exec() or system() functions.. The scenario describes command execution on the web server, which is a direct consequence of OS command injection. In PHP, passing unsanitized user input to functions like exec() or system() allows an attacker to execute arbitrary shell commands, bypassing input validation. This is the most likely root cause as it directly enables command execution, unlike other vulnerabilities that lead to different impacts.

Answer

The application uses unsanitized input in SQL queries.

Answer

The application reflects user input in HTTP responses without escaping.

Answer

The application uses hidden form fields to store session tokens.

Question 13

Which THREE types of evidence are MOST important to collect from a compromised Linux server during forensic acquisition?

Accepted Answer

List of running processes. A is correct because capturing a list of running processes from a compromised Linux server preserves volatile evidence of active malicious processes, such as reverse shells or cryptominers, that would be lost on shutdown. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data like process lists before acquiring less volatile evidence like disk images.

Answer

Full disk image

Answer

Network packet captures

Question 14

A BYOD policy allows personal devices to access corporate email. What is the best control to enforce device encryption and remote wipe?

Accepted Answer

Mobile Device Management (MDM) profile. Mobile Device Management (MDM) can enforce encryption and remote wipe policies. VPN encrypts data in transit but not the device. Containerization isolates corporate data but may not enforce full device encryption. NAC controls network access, not device settings.

Answer

Network Access Control (NAC)

Answer

Containerization app

Answer

Mandatory VPN connection

Question 15

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

Accepted Answer

ARP spoofing. ARP spoofing involves sending gratuitous ARP replies to associate the attacker's MAC with another IP address, enabling man-in-the-middle attacks at Layer 2.

Answer

MAC flooding

Answer

DHCP starvation

Answer

DNS poisoning