SSCP Practice Test 38 — 15 Questions

Question 1

A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?

Accepted Answer

AES. AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.

Answer

RSA

Answer

Diffie-Hellman

Answer

SHA-256

Question 2

Which TWO of the following are common indicators of a ransomware attack?

Accepted Answer

Files with .encrypted extension appearing in directories.. Option A is correct because ransomware typically renames victim files with a distinctive extension (e.g., .encrypted, .locked, .crypto) after encrypting them, so the sudden appearance of files with an .encrypted extension in directories is a classic indicator of an active ransomware attack. Option D is correct because most ransomware families drop a ransom note (often named README.txt, DECRYPT_INSTRUCTIONS.txt, or similar) into every affected folder to instruct the victim on how to pay for the decryption key, making its presence a strong forensic indicator. Option B is not the best choice here because while unusual outbound traffic can indicate malware or C2 communication, it is a generic indicator of many compromises rather than a specific hallmark of ransomware. Option C is incorrect because ransomware does not typically reduce network latency; if anything, mass encryption and file operations tend to degrade system and network performance. Option E is incorrect because failed login attempts point to brute-force or credential-stuffing activity, which is an initial access technique rather than a ransomware-specific indicator.

Answer

Unusual outbound network traffic to unknown IPs.

Answer

Decreased network latency.

Answer

System log entries showing failed login attempts.

Question 3

A security analyst is reviewing OWASP Top 10 vulnerabilities in a web application. Which TWO are injection-related attacks? (Select TWO.)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) (B) is correct because it is an injection attack in which attacker-supplied JavaScript is injected into a web page and executed in a victim's browser, typically via unescaped user input rendered into HTML, allowing session theft or DOM manipulation. SQL injection (E) is correct because it injects malicious SQL statements through unsanitized input into a database query, enabling data exfiltration, authentication bypass, or command execution on the DBMS. Both belong to the injection class of attacks where untrusted data is interpreted as code or commands by an interpreter. Security Misconfiguration (A) is a configuration weakness, not an injection flaw. Cross-Site Request Forgery (CSRF) (C) abuses a victim's authenticated session to force unintended requests, not code injection. Insecure Direct Object References (IDOR) (D) is an access-control flaw where object identifiers are manipulated to reach unauthorized resources, not an injection attack.

Answer

Security Misconfiguration

Answer

Cross-Site Request Forgery (CSRF)

Answer

Insecure Direct Object References (IDOR)

Question 4

Which of the following is the correct order of steps in the change management process?

Accepted Answer

Change request, impact assessment, CAB approval, testing, implementation, post-implementation review. The standard change management lifecycle begins with a formal change request, followed by an impact/risk assessment so the CAB has the information needed to evaluate the change. Only after that assessment does the CAB approve or reject, then testing occurs in a non-production environment, then implementation, and finally a post-implementation review to confirm success and capture lessons learned. This sequence ensures decisions are made with full information and that changes are validated before touching production.

Answer

Change request, CAB approval, impact assessment, testing, implementation, post-implementation review

Answer

Impact assessment, change request, CAB approval, testing, implementation, post-implementation review

Answer

Change request, testing, impact assessment, CAB approval, implementation, post-implementation review

Question 5

A network administrator notices that legitimate clients are unable to obtain IP addresses from the DHCP server. The network logs show a high volume of DHCP Discover messages from different MAC addresses. Which attack is most likely occurring?

Accepted Answer

DHCP starvation. DHCP starvation occurs when an attacker floods the DHCP server with Discover requests using spoofed MAC addresses, exhausting the DHCP address pool. Legitimate clients then cannot obtain leases because the server has no available IPs to offer. The high volume of Discover messages from many different MAC addresses is the signature of this attack.

Answer

DHCP spoofing

Answer

ARP spoofing

Answer

DNS amplification

Question 6

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

Accepted Answer

Add a threshold of 5 failed logins within 5 minutes. Adding a threshold of 5 failed logins within 5 minutes reduces false positives from isolated accidental lockouts while still detecting the sustained pattern of failed attempts characteristic of brute-force attacks. This aligns with SIEM tuning best practices where aggregation over a time window filters out noise without losing signal.

Answer

Disable the rule entirely

Answer

Increase the severity level of the alert

Answer

Ignore failed logins from known users

Question 7

Match each disaster recovery site type to its description.

Accepted Answer

Hot site: A fully equipped and operational facility ready to take over immediately after a disaster.. Disaster recovery site types vary in readiness and equipment. Hot sites are fully operational, warm sites are partially equipped, cold sites provide only infrastructure, and mobile sites are portable units. Common confusions include mixing the definitions of hot and cold sites, or mistaking mobile sites for cold sites.

Answer

Hot site: A basic facility with power and cooling but no equipment, requiring full setup after a disaster.

Answer

Cold site: A portable, self-contained unit that can be transported and quickly deployed.

Question 8

Which TWO of the following are effective methods for monitoring risk in real-time?

Accepted Answer

Security information and event management (SIEM) systems. Option B is correct because SIEM systems aggregate and correlate log and event data from across the environment in real time, generating alerts on suspicious patterns so risk can be monitored continuously. Option E is correct because IDS solutions inspect network or host traffic continuously and raise alerts on malicious or anomalous activity as it happens, providing real-time risk visibility. The unmarked options do not belong because user access reviews (A) are periodic governance activities, quarterly vulnerability scanning (C) runs on a scheduled cadence rather than continuously, and annual penetration testing (D) is a point-in-time assessment performed only once a year.

Answer

User access reviews

Answer

Quarterly vulnerability scanning

Answer

Annual penetration testing

Question 9

In a Bell-LaPadula model implementation, a user with a Secret clearance attempts to read a document classified as Top Secret. Additionally, they try to write to a document classified as Unclassified. What are the results of these actions?

Accepted Answer

Read denied, write denied. Under Bell-LaPadula, the Simple Security Property (no read up) denies a Secret-cleared user from reading a Top Secret document. The *-Property (no write down) denies the same user from writing to an Unclassified document. Therefore, both the read and the write are denied.

Answer

Read denied, write allowed

Answer

Read allowed, write allowed

Answer

Read allowed, write denied

Question 10

A security administrator receives an alert from the SIEM indicating a configuration change on a critical server. The change was not part of any approved change request. What should be the first step?

Accepted Answer

Investigate the change to determine its source and impact. The first step when an unauthorized configuration change is detected is to investigate the change to determine its source and impact. This aligns with the incident response process, where initial assessment (identification and scoping) precedes containment or remediation. Without investigation, reverting or disabling could destroy forensic evidence or disrupt legitimate services.

Answer

Notify the server owner

Answer

Revert the server to the last known good configuration

Answer

Disable the server's network access

Question 11

Which of the following is a common vulnerability source that would be documented in a risk register?

Accepted Answer

CVE entries. D is correct because CVE (Common Vulnerabilities and Exposures) entries are standardized identifiers for known security vulnerabilities, making them a direct source of vulnerability information that should be documented in a risk register. A risk register captures identified risks, including specific vulnerabilities, and CVE entries provide the precise technical details needed to assess and track those risks.

Answer

Password policies

Answer

Intrusion alerts

Answer

Firewall logs

Question 12

In the Bell-LaPadula model, which property prevents a subject from reading an object at a higher classification level?

Accepted Answer

The Simple Security Property (no read up). The Simple Security Property (also called the no-read-up rule) in the Bell-LaPadula model states that a subject at a given security level cannot read an object at a higher classification level. This prevents unauthorized disclosure of classified information and is the foundational confidentiality rule of the model.

Answer

The *-property (no write down)

Answer

The Discretionary Security Property

Answer

The Lattice Security Property

Question 13

A network administrator wants to prevent unauthorized devices from connecting to the wired network. Which technology can be used to enforce authentication at the switch port level before granting network access?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control that authenticates devices before granting access to the wired network. It uses EAP over LAN to communicate with a RADIUS server, ensuring only authorized devices can connect. This directly enforces authentication at the switch port level.

Answer

MAC address filtering

Answer

WPA2-Enterprise

Answer

VLAN segmentation

Question 14

A company wants to implement a firewall that can track the state of network connections and make decisions based on the context of traffic (e.g., allowing return packets for an established connection). Which type of firewall should they choose?

Accepted Answer

Stateful firewall. A stateful firewall tracks the state of network connections in a state table, allowing return packets for established sessions without requiring explicit inbound rules. This context-aware behavior is exactly what the question describes.

Answer

Application proxy firewall

Answer

Stateless packet filter

Answer

Next-generation firewall

Question 15

Which TWO of the following are key components of a security awareness program?

Accepted Answer

User training on password policies. Option A (User training on password policies) is correct because a security awareness program must educate users on creating strong passwords, recognizing password-related threats, and following organizational password rules, which directly reduces credential-based risks. Option B (Regular phishing simulations) is correct because simulated phishing campaigns test and reinforce user vigilance against social engineering, providing measurable feedback that strengthens the human element of security. Option C (Incident response drills) is not a core awareness component; it tests the security team's technical and procedural response to incidents rather than end-user awareness. Option D (Quarterly vulnerability scans) is a technical control that identifies system weaknesses and does not train or educate users. Option E (Annual penetration testing) is an offensive security assessment of systems and applications, not an awareness activity for the general workforce.

Answer

Incident response drills

Answer

Quarterly vulnerability scans

Answer

Annual penetration testing