SSCP Practice Test 37 — 15 Questions

Question 1

Refer to the exhibit. A network engineer is configuring an IPsec VPN. Which protocol does this configuration apply to?

Accepted Answer

IKE (Internet Key Exchange). The configuration shown in the exhibit is for an IPsec VPN, which relies on IKE (Internet Key Exchange) to establish security associations and negotiate cryptographic keys. IKE (RFC 7296) is the mandatory key management protocol for IPsec, handling authentication and key exchange over UDP ports 500 and 4500. Without IKE, IPsec cannot dynamically negotiate the encryption and hashing parameters required for secure tunnel establishment.

Answer

HTTPS

Answer

SSH

Answer

SSL/TLS

Question 2

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.

Answer

Threat

Answer

Risk

Answer

Exploit

Question 3

Which THREE of the following are key steps in performing a business impact analysis (BIA)?

Accepted Answer

Assessing the financial and operational impact of disruptions. Assessing the financial and operational impact of disruptions is a core step in a business impact analysis (BIA). The BIA focuses on quantifying the consequences of losing business functions, including revenue loss, regulatory fines, and reputational damage, rather than evaluating threat likelihood or selecting recovery solutions.

Answer

Assigning likelihood ratings to threats

Answer

Selecting backup and recovery solutions

Question 4

The security team discovers that a user in the finance department can read files in the human resources share. The share permissions on the HR folder are set to deny all except the HR group, and the user is not a member of HR. What is the most likely cause?

Accepted Answer

The user is logging on locally to the server where the files are stored. When a user logs on locally to the file server, Windows evaluates NTFS permissions directly, bypassing share permissions entirely. Share permissions only apply to network access via SMB, so a local logon allows the user to read files if NTFS permissions grant access, even if share permissions deny all except the HR group.

Answer

The user is an administrator on the file server

Answer

The user is using a different file server for HR files

Answer

The user's token includes a group that has been explicitly denied

Question 5

A vulnerability management team is scanning a network. Which THREE factors should be considered to minimize false positives?

Accepted Answer

Tuning the scanner based on the environment. Tuning the scanner to the specific environment (e.g., adjusting port ranges, timing, and service detection patterns) reduces the likelihood of misidentifying benign traffic or non-vulnerable services as vulnerabilities. Untuned scanners often flag default banner responses or open ports that are actually part of normal operations, leading to false positives.

Answer

Scanning only during peak hours

Answer

Using default scan profiles

Question 6

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Accepted Answer

Prioritize based on CVSS score, starting with critical and high severity. The Common Vulnerability Scoring System (CVSS) provides a standardized, industry-accepted method for rating vulnerability severity based on exploitability, impact, and other metrics. Prioritizing critical and high CVSS scores (e.g., 9.0-10.0 and 7.0-8.9) ensures the team addresses vulnerabilities with the highest potential for damage and exploitation first, which is a fundamental risk-based remediation strategy. This approach aligns with the NIST SP 800-40 guidance on prioritizing vulnerabilities by risk, not by arbitrary ordering or waiting for confirmation.

Answer

Remediate only vulnerabilities that are exploitable from the internet

Answer

Wait for the next scan to confirm the results before action

Answer

Remediate all vulnerabilities in alphabetical order by CVE ID

Question 7

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Accepted Answer

24-72 hours. A CVSS score of 9.8 falls into the 'Critical' severity range (9.0–10.0). Standard remediation SLAs for critical vulnerabilities typically require action within 24–72 hours because such vulnerabilities often allow remote code execution or complete compromise without authentication, posing an immediate and severe risk to the organization.

Answer

30 days

Answer

7 days

Answer

90 days

Question 8

A financial firm is implementing a new access control system for its critical trading application. The application currently uses local accounts and password authentication. The security team wants to enforce multi-factor authentication (MFA) and centralized user management. The firm has an existing Active Directory (AD) infrastructure and a certificate authority (CA). However, the trading application only supports smart card authentication via PKI and does not support integration with AD directly. The IT team must design a solution that meets security requirements while minimizing changes to the application. Which approach should the team take?

Accepted Answer

Deploy a RADIUS server that forwards authentication to AD and use smart card emulation for the application. The correct approach is to deploy a RADIUS server that authenticates against Active Directory and uses smart card emulation for the trading application. This solution centralizes user management via AD, enforces MFA through PKI-based smart cards, and requires no changes to the application code. Option A (SAML federation) would necessitate significant application modifications and is not inherently MFA-capable without additional setup. Option B (local accounts with strong passwords) ignores MFA and centralized management. Option D (separate LDAP synced with AD) adds complexity and does not support smart card authentication for the application.

Answer

Modify the application code to support SAML-based federation

Answer

Continue using local accounts but require a strong password policy and regular changes

Answer

Set up a separate LDAP directory for the application and sync with AD

Question 9

An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:

Accepted Answer

ARP spoofing. ARP spoofing involves sending gratuitous ARP replies to poison the ARP cache of other hosts.

Answer

DNS poisoning

Answer

DHCP spoofing

Answer

MAC flooding

Question 10

Refer to the exhibit. A web server at 10.0.0.50 received the payload shown. What is the MOST likely impact if the web application is vulnerable?

Accepted Answer

Authentication bypass via SQL injection.. The payload shown is a classic SQL injection attempt, specifically targeting authentication logic by injecting a tautology (e.g., ' OR '1'='1) into a login field. If the web application is vulnerable, this bypasses authentication by making the SQL query always return true, granting unauthorized access without valid credentials.

Answer

Directory traversal to read sensitive files.

Answer

Remote code execution on the web server.

Answer

Cross-site scripting (XSS) attack leading to session theft.

Question 11

Which TWO of the following are best practices for securing a wireless network?

Accepted Answer

Using WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Answer

Enabling MAC address filtering

Answer

Using WEP encryption

Answer

Leaving the default administrator password

Question 12

Which access control model allows the owner of a resource to grant permissions to others?

Accepted Answer

Discretionary Access Control (DAC). DAC (Discretionary Access Control) allows the resource owner to decide who can access the resource and with what permissions.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 13

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Accepted Answer

The ACCEPT rule matches before the DROP rule.. C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Answer

The DROP rule does not apply to SSH.

Answer

The DROP rule is misconfigured with wrong source.

Answer

The default policy allows traffic, overriding the DROP rule.

Question 14

An organization uses smart cards combined with a PIN to access secure facilities. This is an example of which type of authentication factor?

Accepted Answer

Two-factor authentication. Smart cards are a possession factor (something you have), and the PIN is a knowledge factor (something you know). Combining both satisfies the requirement for two distinct authentication factors, making this a textbook example of two-factor authentication (2FA). This is not single-factor because two separate categories of credentials are used, and it is not biometric because no physical characteristic is measured.

Answer

Token-based authentication

Answer

Single-factor authentication

Answer

Biometric authentication

Question 15

An organization is configuring a VPN using IPsec. To ensure forward secrecy, which key exchange method should be used?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE). Ephemeral Diffie-Hellman (DHE or ECDHE) provides forward secrecy because it generates a temporary, one-time key pair for each session. If the long-term private key is compromised, past session keys cannot be derived, as the ephemeral keys are discarded after use. This ensures that even if an attacker records encrypted traffic and later obtains the private key, they cannot decrypt past sessions.

Answer

RSA key exchange

Answer

Pre-shared key (PSK)

Answer

Static Diffie-Hellman