SSCP Practice Test 37 — 15 Questions

Question 1

Which of the following is the primary purpose of a chain of custody form in digital forensics?

Accepted Answer

To track the possession and handling of evidence from collection to presentation. A chain of custody form is used to document the chronological sequence of custody, control, transfer, analysis, and disposition of evidence. Its primary purpose is to track who had possession of the evidence and what was done with it from the moment of collection through to presentation in court. This ensures the evidence is admissible and has not been tampered with.

Answer

To document the steps taken to contain an incident

Answer

To record the hash values of forensic images

Answer

To provide a list of approved forensic tools

Question 2

A defense contractor runs an air-gapped laboratory where removable media are used to move engineering data between isolated enclaves. Policy requires that a workstation be usable only when a specific approved removable device is inserted, and that the workstation become unusable the instant that device is removed. Which access control approach best enforces this behavior?

Accepted Answer

Implement a hardware token interlock that permits operation only while the approved device is physically engaged. The policy couples system availability to the physical presence of one approved object, which is a property of a hardware interlock rather than of any logical permission scheme. Interlocks act at the level of the machine itself, so the workstation cannot operate without the device and cannot continue operating after the device is removed, regardless of who is logged on.

Answer

Require multifactor authentication with a smart card before any user may log on to the workstation

Answer

Deploy a role-based policy that grants laboratory staff access to the enclave during working hours

Answer

Apply discretionary access control so that file owners may share engineering data only with vetted colleagues

Question 3

Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?

Accepted Answer

NIDS. A Network Intrusion Detection System (NIDS) is specifically designed to monitor traffic on a network segment, capturing packets in real time and analyzing them for known attack signatures or anomalous patterns. Unlike host-based systems, NIDS operates at the network layer, inspecting headers and payloads to detect malicious activity such as port scans, DoS attacks, or exploit attempts.

Answer

HIDS

Answer

UBA

Answer

SIEM

Question 4

A system administrator receives an alert from the SIEM indicating a possible brute-force attack on a server. The logs show 100 failed logins in 2 minutes from a single source. Which of the following is the best immediate action to verify and respond?

Accepted Answer

Check firewall logs for the source IP and block it in the firewall. The immediate priority is to stop the ongoing attack by blocking the source IP at the firewall. Checking firewall logs confirms the source IP and ensures the block is applied to the correct address, preventing further authentication attempts. This aligns with the principle of containment before remediation in incident response.

Answer

Immediately disable the user account that was targeted most

Answer

Reset all user passwords and enable multi-factor authentication

Answer

Ignore the alert because it is likely a false positive

Question 5

Which TWO of the following are characteristics of a Mandatory Access Control (MAC) system?

Accepted Answer

Access decisions are based on security labels.. Option A is correct because a MAC system bases every access decision on security labels (sensitivity levels and categories) assigned to subjects and objects, rather than on user discretion; the system compares these labels against a policy to grant or deny access. Option E is correct because MAC is historically and commonly implemented in military and government environments, where strict confidentiality and need-to-know enforcement (e.g., via labels like Top Secret, Secret, Confidential) is required. Option B is incorrect because basing access on the object's owner describes Discretionary Access Control (DAC), where the owner decides who gets access. Option C is incorrect because using roles to assign permissions describes Role-Based Access Control (RBAC), not MAC. Option D is incorrect because allowing users to change permissions on their own objects is a hallmark of DAC, whereas in MAC users cannot alter the labels or permissions that govern access.

Answer

Access is determined by the owner of the object.

Answer

It uses roles to assign permissions.

Answer

Users can change permissions on their own objects.

Question 6

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 7

Which TWO are common methods to secure a wireless network against unauthorized access?

Accepted Answer

Implement WPA2-Enterprise. WPA2-Enterprise (option A) is correct because it uses IEEE 802.1X authentication with a RADIUS server, requiring each user or device to authenticate with unique credentials or certificates, which prevents unauthorized clients from joining even if they know the pre-shared key. A wireless intrusion prevention system (option E) is correct because a WIPS continuously monitors the RF spectrum for rogue access points, evil twins, and deauthentication attacks, and can automatically contain or block those threats. Enabling SSID broadcast (option B) actually advertises the network and does not secure it, since hidden SSIDs are not a real security control anyway. Disabling DHCP (option C) only forces manual IP configuration and is easily bypassed by an attacker who assigns a static address. MAC filtering (option D) is weak because MAC addresses can be spoofed, so it does not reliably prevent unauthorized access.

Answer

Enable SSID broadcast

Answer

Disable DHCP

Answer

Use MAC filtering

Question 8

A security analyst is reviewing a script that performs automated backups. The script uses a hardcoded password to connect to the database. What is the most secure alternative?

Accepted Answer

Retrieve the password from a secrets management service at runtime.. Retrieving the password from a secrets management service at runtime is the most secure alternative because it eliminates hardcoded credentials from the script and centralizes secret storage with access controls, auditing, and rotation. Services like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault issue short-lived credentials and log access. This removes the secret from source code and version control entirely.

Answer

Change the password manually every week.

Answer

Store the password in an environment variable.

Answer

Replace the password with SSH key authentication.

Answer

Use a more complex password.

Question 9

Which TWO protocols are considered insecure and should be replaced with secure alternatives? (Choose two.)

Accepted Answer

Telnet. Both Telnet and FTP are considered insecure because they transmit data, including login credentials, in cleartext. Telnet (B) uses TCP port 23 and lacks encryption, making it vulnerable to packet sniffing and man-in-the-middle attacks. FTP (E) similarly transmits usernames and passwords over TCP port 21 in cleartext, and also allows anonymous access and passive data transfer issues. Secure alternatives include SSH for remote access (replacing Telnet) and SFTP or FTPS for file transfer (replacing FTP). IPsec (A), HTTPS (C), and SNMPv3 (D) are all considered secure protocols as they incorporate encryption and authentication.

Answer

IPsec

Answer

HTTPS

Answer

SNMPv3

Question 10

A web application processes user-supplied data in SQL queries. Which practice best prevents SQL injection?

Accepted Answer

Parameterized queries. Parameterized queries (also known as prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:name` in PDO). The database engine treats the user input strictly as data, never as executable SQL code, which inherently prevents SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Input length validation

Question 11

Drag and drop the steps to configure a static route on a network device into the correct order.

Accepted Answer

Step 1: Enter configuration mode. Step 2: Configure the static route by specifying destination network, subnet mask, and next-hop address. Step 3: Exit configuration mode. Step 4: Save the configuration.. To configure a static route on a network device, the correct order is: (1) enter configuration mode, (2) configure the static route by specifying the destination network, subnet mask, and next-hop address, (3) exit configuration mode, and (4) save the configuration. The order of parameters within the static route command itself does not constitute separate steps, so option D is not a distinct correct sequence.

Answer

Step 1: Configure the static route by specifying destination network, subnet mask, and next-hop address. Step 2: Enter configuration mode. Step 3: Exit configuration mode. Step 4: Save the configuration.

Answer

Step 1: Enter configuration mode. Step 2: Exit configuration mode. Step 3: Configure the static route by specifying destination network, subnet mask, and next-hop address. Step 4: Save the configuration.

Answer

Step 1: Enter configuration mode. Step 2: Configure the static route by specifying the next-hop address first, then destination network, then subnet mask. Step 3: Exit configuration mode. Step 4: Save the configuration.

Question 12

During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)

Accepted Answer

Snapshots may contain unpatched vulnerabilities. Option A is correct because a snapshot captures the VM's disk state at a point in time, including the guest OS and installed applications; if that state predates patching, restoring or mounting the snapshot reintroduces unpatched vulnerabilities into the environment. Option B is correct because snapshots preserve the full contents of the virtual disks (and often memory state), so credentials, keys, and other sensitive data that were later deleted or rotated can persist inside snapshot files such as .vmdk delta disks or .avhd files. Option D is correct because rolling back to a snapshot reverts the entire VM state, including security settings, firewall rules, group policies, and patch levels, potentially undoing hardening or remediation performed after the snapshot was taken. Option C is not a snapshot-specific risk; VM sprawl refers to the uncontrolled proliferation of VMs, not snapshot files, and is a lifecycle/governance issue rather than an inherent snapshot risk. Option E is not correct because VM escape exploits hypervisor or virtualization-layer vulnerabilities, not snapshots themselves; snapshots are a data-exposure and rollback concern, not a mechanism for escaping the VM boundary.

Answer

Snapshots cause VM sprawl

Answer

Snapshots can be used as an attack vector for VM escape

Question 13

An incident responder is investigating a compromised Linux server and needs to collect volatile data. The responder has root access and wants to ensure that the data collected is admissible in a court of law. Which of the following commands should be used FIRST to capture the contents of physical memory?

Accepted Answer

LiME (Linux Memory Extractor) to dump memory to a file. LiME is specifically designed for Linux memory forensics, allowing a responder to capture physical memory in a forensically sound manner. It loads as a kernel module and writes the memory image to a file or network destination, preserving the integrity of the evidence. This method is accepted in legal proceedings because it does not alter the system state unnecessarily and captures a comprehensive image.

Answer

gcore to dump the memory of all running processes

Answer

The 'free' command to display memory usage statistics

Answer

dd if=/dev/mem of=/evidence/memory.dd

Question 14

Which protocol is used to securely transfer files between a client and server, typically over TCP port 22?

Accepted Answer

SSH. SSH (Secure Shell) operates over TCP port 22 and provides an encrypted channel for secure file transfer (via SFTP or SCP) as well as remote shell access. Its encryption and host authentication replace the cleartext credentials and data of legacy protocols like FTP and Telnet. This makes SSH the correct answer for secure file transfer on port 22.

Answer

SMTP

Answer

TFTP

Answer

FTP

Question 15

A security professional is designing a key management system and needs to ensure that keys are generated using a truly random source. Which of the following is the most appropriate method for generating cryptographic keys?

Accepted Answer

Hardware random number generator. A hardware random number generator (HRNG) uses a physical entropy source (e.g., thermal noise, quantum effects) to produce truly random numbers, making it the most appropriate for generating cryptographic keys. Cryptographic keys require high entropy and unpredictability; HRNGs provide true randomness, unlike deterministic PRNGs.

Answer

Cryptographically secure PRNG seeded with a static password

Answer

Pseudorandom number generator (PRNG) seeded with current timestamp

Answer

User-memorized passphrase