SSCP Practice Test 38 — 15 Questions

Question 1

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the users from the security group that grants access to the drives.. The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Answer

Delete the user accounts of the affected employees.

Answer

Reconfigure the shared drive to deny access to all users except HR.

Answer

Manually remove each user's permissions on the shared drive.

Question 2

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

Accepted Answer

Weekly full backups and hourly incremental backups. Hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Answer

Weekly full backups and daily differential backups

Answer

Monthly full backups and weekly incremental backups

Answer

Daily full backups with no incremental backups

Question 3

A security awareness program is being developed. Which topic is MOST critical for all employees to understand to reduce the risk of social engineering?

Accepted Answer

How to recognize and report phishing attempts and other suspicious communications. Social engineering attacks, such as phishing, vishing, and smishing, exploit human psychology rather than technical vulnerabilities. The most critical defense for all employees is the ability to recognize indicators of these attacks (e.g., spoofed sender addresses, urgent language, mismatched URLs) and follow the proper reporting procedure to enable rapid incident response. Without this skill, even the strongest technical controls can be bypassed by a single successful click.

Answer

The risks of posting on social media

Answer

The proper use of mobile devices

Answer

How to create strong passwords

Question 4

An organization is reviewing its account lifecycle management process. Which TWO activities are part of the provisioning phase? (Select TWO.)

Accepted Answer

Creating user accounts in the identity store. Provisioning involves creating accounts and assigning initial roles/permissions upon onboarding. Modifying roles is a change, not initial provisioning. Disabling is deprovisioning.

Answer

Modifying user roles due to job change

Answer

Archiving user data for compliance

Answer

Disabling accounts upon termination

Question 5

An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?

Accepted Answer

Smart card. Something you have includes physical tokens like smart cards and hardware tokens. Biometrics are something you are, and passwords are something you know.

Answer

Answer

Retina scan

Answer

Fingerprint

Question 6

An organization is implementing 802.1X authentication for wired network access. Which server is required to authenticate users?

Accepted Answer

RADIUS server. 802.1X is a port-based network access control protocol that uses the Extensible Authentication Protocol (EAP) to authenticate devices before granting network access. The authentication server in an 802.1X deployment must be a RADIUS server, as defined in IEEE 802.1X-2020, because it acts as the backend that validates credentials and communicates with the authenticator (switch) via RADIUS (RFC 2865).

Answer

DHCP server

Answer

TACACS+ server

Answer

Kerberos server

Question 7

Refer to the exhibit. An organization's incident response policy defines these actions. In what sequence should these phases be applied?

Accepted Answer

Isolate, reimage, restore from backup. The correct sequence is Isolate, reimage, restore from backup because containment (isolation) must occur first to prevent the incident from spreading, followed by eradication (reimaging) to remove the threat, and finally recovery (restoring from backup) to return the system to a known good state. This aligns with the NIST SP 800-61 incident response lifecycle, where containment, eradication, and recovery are performed in that order.

Answer

Reimage, isolate, restore

Answer

Restore, isolate, reimage

Answer

Isolate, restore, reimage

Question 8

A security administrator is implementing a change management process. Which TWO of the following are essential components of a change management policy? (Choose two.)

Accepted Answer

A rollback plan. The essential components of a change management policy include a rollback plan (to revert changes if issues arise) and approval from the change advisory board (CAB) to ensure proper oversight. Vulnerability scanning results and automated patch deployment schedules are not policy components; they are operational activities. Emergency change procedures are a specific type of change, not a fundamental component of the policy itself.

Answer

Vulnerability scanning results

Answer

Emergency change procedures

Answer

Automated patch deployment schedule

Question 9

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack is most likely occurring because the exhibit shows repeated login attempts with different passwords for the same username, which is the hallmark of an automated password guessing attack. The rapid succession of failed authentication events indicates a systematic trial of credentials, not a single intercepted session or resource exhaustion.

Answer

Man-in-the-middle attack

Answer

Denial of service attack

Answer

Social engineering attack

Question 10

Based on the exhibit, what is the most critical observation?

Accepted Answer

A root user is opening RDP to the world.. The most critical observation is that a root user is opening RDP (TCP/3389) to the world (0.0.0.0/0). This creates an extreme security risk because it exposes the administrative interface to the entire internet, allowing any attacker to attempt brute-force or exploit RDP vulnerabilities. In AWS CloudTrail, this event indicates a direct violation of the principle of least privilege and is a common vector for compromise.

Answer

A user is modifying a security group.

Answer

The event is from EC2 service.

Answer

The source IP is internal.

Question 11

Which TWO of the following are considered key components of a disaster recovery plan?

Accepted Answer

RPO (Recovery Point Objective). RPO and RTO are fundamental metrics in a disaster recovery plan. RPO defines the maximum acceptable data loss measured in time, dictating the frequency of backups. RTO defines the maximum acceptable downtime after a disaster, setting the target for system restoration. Both directly drive the technical design of replication, backup schedules, and failover procedures.

Answer

SLA (Service Level Agreement)

Answer

BCP (Business Continuity Plan)

Answer

MTBF (Mean Time Between Failures)

Question 12

Which TWO of the following are characteristics of mandatory access control (MAC)?

Accepted Answer

The system enforces access decisions based on policies. Mandatory access control (MAC) enforces access decisions based on centrally defined policies, not at the discretion of individual users. The system compares security labels assigned to subjects (e.g., users, processes) and objects (e.g., files, resources) to determine if access is allowed. This ensures that even the owner of an object cannot override the policy, which is a core characteristic of MAC.

Answer

Access decisions are based on the user’s discretion

Answer

It is commonly used in commercial environments

Answer

Users can grant access to other users

Question 13

A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?

Accepted Answer

Encrypt all sensitive data stored on the device using a key derived from the user's passcode.. Encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.

Answer

Require a strong screen lock passcode.

Answer

Disable cloud backups for the app.

Answer

Use app sandboxing to isolate app data from other apps.

Question 14

An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?

Accepted Answer

Configure Group Policy to require BitLocker encryption on removable drives.. Configuring Group Policy to require BitLocker encryption on removable drives is the most effective control because it enforces the encryption policy automatically and centrally across all domain-joined systems, preventing users from bypassing the requirement. Unlike a memo or auditing, Group Policy provides a technical enforcement mechanism that blocks unencrypted removable media from being used, ensuring compliance without relying on user discretion.

Answer

Distribute a memo to all employees about the policy.

Answer

Enable auditing for removable drive usage.

Answer

Enable BitLocker on all laptops.

Question 15

A system administrator needs to assign permissions to a new employee who will be performing database backups. The employee should only be able to execute the backup command but not read or modify the data. Which access control principle should be applied?

Accepted Answer

Least privilege. The least privilege principle dictates that a user should be granted only the minimum permissions necessary to perform their job function. In this scenario, the employee needs only the ability to execute the backup command (e.g., using a tool like `pg_dump` or `mysqldump` with a read-only snapshot), not read or modify the underlying data files. Applying least privilege ensures the backup process can run without granting broader SELECT or FILE privileges that would allow data access or alteration.

Answer

Need to know

Answer

Separation of duties

Answer

Defense in depth