SSCP Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. A security administrator is troubleshooting connectivity to a web server. Users report they can access the website via HTTP and HTTPS, but cannot establish new SSH connections. Which of the following best explains this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall is configured to drop new SSH connections, which prevents users from initiating new SSH sessions.. The firewall drops all new TCP connections to port 22 (SSH) using the state NEW module, which prevents users from establishing new SSH sessions. Option D correctly identifies this configuration. Option A describes the rule's behavior but includes the irrelevant point about established sessions, making it less direct. Option B is incorrect because the INPUT chain policy being ACCEPT does not override the specific drop rule for new SSH traffic. Option C is incorrect because the rule does not block all traffic on port 22, only new connections.

Answer

The firewall is dropping SSH connections only when they are new, but established sessions may still be allowed.

Answer

The firewall policy is set to ACCEPT on the INPUT chain, so SSH should work.

Answer

The firewall is blocking all incoming traffic on port 22.

Question 2

A military system uses mandatory access control with classifications Unclassified, Confidential, Secret, and Top Secret. A user with Secret clearance attempts to read a file labeled Top Secret. What will occur?

Accepted Answer

Access is denied because the subject's clearance is lower than the object's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the subject's clearance level with the object's classification label. Since the user has a Secret clearance and the file is classified Top Secret, the subject's clearance is lower than the object's classification, so read access is denied per the Bell-LaPadula model's Simple Security Property (no read up).

Answer

Access is granted because the user has write permission

Answer

Access is granted if the user is the owner of the file

Answer

Access is granted because the user has a need-to-know

Question 3

Refer to the exhibit. A network administrator is reviewing the VPN configuration on a site-to-site VPN hub. Which of the following is the most significant security vulnerability in this configuration?

Accepted Answer

The pre-shared key is applied to all potential peers due to the wildcard address. The most significant security vulnerability in this configuration is the use of a wildcard peer address (0.0.0.0 0.0.0.0) for the ISAKMP key. This allows any device to attempt authentication using the same pre-shared key, effectively turning it into a shared secret across all potential peers. An attacker who obtains the key can establish unauthorized VPN connections. While AES-256 is a strong encryption algorithm, SHA is generally secure (though specific versions like SHA-1 are deprecated), and the key length is not the issue here. The wildcard setting is the critical flaw, making Option B correct.

Answer

The encryption algorithm AES-256 is too weak

Answer

The hash algorithm SHA is insecure

Answer

The pre-shared key is too short and easily guessable

Question 4

A company's incident response plan includes a requirement to notify law enforcement within 24 hours of certain security incidents. Which regulation most likely mandates this requirement?

Accepted Answer

PCI DSS. PCI DSS Requirement 12.10.1 mandates that the incident response plan includes specific procedures to notify law enforcement within 24 hours of detecting a breach involving cardholder data. This is because PCI DSS is a contractual security standard for entities that handle payment card information, and timely law enforcement notification is critical for forensic investigation and legal compliance in payment card fraud cases.

Answer

SOX

Answer

GDPR

Answer

HIPAA

Question 5

An IT auditor reports that firewall logs are not being reviewed regularly. Which control should be implemented to address this finding?

Accepted Answer

Deploy a Security Information and Event Management (SIEM) system. A SIEM system automates log collection, correlation, and alerting, ensuring that firewall logs are monitored and reviewed in a timely manner. Option A is incorrect; archiving logs to read-only medium preserves logs but does not enforce review. Option B is incorrect; disabling low-priority logging reduces data but does not address the lack of review. Option C is incorrect; increasing retention extends storage but still requires manual review, which is the root problem.

Answer

Archive logs to a read-only medium

Answer

Disable logging for low-priority events

Answer

Increase the log retention period to 12 months

Question 6

You are a security consultant for a hospital that is deploying a new IoT medical device system. The devices wirelessly transmit patient vital signs to a central server. The hospital is subject to HIPAA. The devices were developed by a startup and are not widely field-tested. The IT department wants to connect the devices to the existing network for real-time monitoring. The risk management team has identified potential threats including data interception, device tampering, and denial of service. They have no prior experience with IoT security. Which of the following risk treatment strategies is MOST appropriate given the high uncertainty?

Accepted Answer

Avoid the risk by delaying deployment until a thorough risk assessment and independent security testing are completed. The high uncertainty surrounding the startup's untested IoT devices, combined with the criticality of patient safety and HIPAA compliance, makes avoidance the most prudent strategy. Delaying deployment allows for a thorough risk assessment and independent security testing to identify vulnerabilities before exposing the hospital network to potential data interception, device tampering, or denial-of-service attacks. This approach directly addresses the risk management team's lack of IoT security experience by preventing exposure until the threat landscape is better understood.

Answer

Accept the risk because the devices improve patient care

Answer

Transfer the risk by purchasing cyber insurance

Answer

Mitigate the risk by segmenting the devices on a separate VLAN and encrypting all communications

Question 7

A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)

Accepted Answer

Network connections and open ports. Network connections and open ports (C) are highly volatile because they can change rapidly and are lost when the system is disconnected from the network. Capturing this data first preserves evidence of active remote connections, which is critical for identifying the attacker's point of entry and ongoing malicious activity. Tools like netstat -anob or CurrPorts can be used to collect this information before any other forensic steps.

Answer

System event logs

Answer

Hard drive image

Question 8

Refer to the exhibit. The security analyst sees this event from a user workstation. What is the most likely conclusion?

Accepted Answer

A user is trying to escalate privileges. The event shows a user account (likely a standard user) attempting to add itself to a privileged group such as the local Administrators group. This action requires administrative rights, and the attempt by a non-admin user to modify group membership is a classic privilege escalation technique. The security analyst should recognize this as an unauthorized attempt to gain higher access, not a normal administrative action.

Answer

A malware is spreading

Answer

A legitimate administrator added a user

Answer

A failed login attempt

Question 9

A university IT department manages a lab of 50 computers running Windows 10 that are used by students for coursework. The computers are joined to a domain and have Group Policy applied to restrict administrative access. Recently, several students were able to install unauthorized software by using the built-in Administrator account, which had the same password on all lab computers. The IT department wants to prevent this without affecting the students' ability to run required academic software. Which of the following is the most effective solution?

Accepted Answer

Use a tool to assign a unique, random password to the local Administrator account on each computer.. Assigning a unique, random password to the local Administrator account on each computer prevents unauthorized use of that account without impacting normal user operations. Option A is incorrect because configuring computers to only allow standard user accounts would prevent students from installing unauthorized software, but it might also block required academic software that needs administrative privileges, and it does not address the vulnerability of the shared Administrator account. Option B is incorrect because disabling the local Administrator account could break legitimate administrative tasks or require alternative methods, and it does not prevent students from using other accounts with admin privileges. Option D is incorrect because Software Restriction Policies can block unauthorized executables, but they do not prevent students from directly using the Administrator account to bypass restrictions.

Answer

Configure the computers to only allow standard user accounts.

Answer

Disable the local Administrator account on all lab computers.

Answer

Implement Software Restriction Policies to block unauthorized executables.

Question 10

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

Accepted Answer

Application whitelisting. Application whitelisting is the correct control because it explicitly defines a list of approved software that is allowed to execute on workstations. This prevents unauthorized or malicious software from running, even if it bypasses other defenses, by enforcing a default-deny policy at the operating system level (e.g., via Windows AppLocker or Software Restriction Policies). Unlike antivirus, which relies on signatures to detect known threats, whitelisting blocks unknown or unapproved executables by default.

Answer

Antivirus software

Answer

Patch management

Answer

Host-based firewall

Question 11

A security analyst sees the event log exhibit. What does this indicate?

Accepted Answer

A remote attacker attempted to log on as Administrator. The event log shows multiple failed logon attempts for the built-in Administrator account from a remote IP address (e.g., 10.0.0.5) using different passwords, which is a classic brute-force attack pattern. Event ID 4625 (Windows Security Log) with Logon Type 3 (Network logon) and a non-zero workstation name or source network address confirms the attempts originated remotely, not from the console. This indicates a remote attacker is systematically trying to guess the Administrator password.

Answer

A local user typed wrong password at the console

Answer

An attacker used a nonexistent account

Answer

The Administrator account is locked out

Question 12

Based on the exhibit, what is the most appropriate immediate action?

Accepted Answer

Apply the vendor patch to the host as soon as possible. The exhibit shows a critical remote code execution vulnerability with a CVSS score of 9.8, which poses an immediate threat to the host. Applying the vendor patch as soon as possible is the most appropriate action because it directly eliminates the risk without delay, aligning with the principle of timely remediation for high-severity vulnerabilities.

Answer

Schedule patching during the next change window in 30 days

Answer

Run another vulnerability scan to confirm the finding

Answer

Ignore the vulnerability because it's a false positive

Question 13

Refer to the exhibit. An AWS S3 bucket policy is defined as shown. Which statement about this policy is TRUE?

Accepted Answer

Any user can read objects in the company-public bucket. The policy includes an Allow statement that grants the s3:GetObject action to principal "*" on the company-public bucket, making objects publicly readable. The Deny statement only applies to the company-private bucket, not to company-public. Therefore, any user can read objects in company-public. Option A is incorrect because the policy does make the company-public bucket objects publicly accessible. Option B is incorrect because the Deny statement only denies access to company-private, not all access to both buckets. Option D is incorrect because the policy specifies resource ARNs for particular buckets, not all buckets.

Answer

The company-public bucket objects are completely private

Answer

The Deny statement prevents all access to both buckets

Answer

The policy applies to all buckets in the account

Question 14

You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?

Accepted Answer

Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration. It implements compensating controls to reduce the risk of the unpatched remote code execution vulnerability while maintaining business continuity. By deploying an application-layer firewall (e.g., a WAF or host-based IPS), disabling unnecessary services, restricting outbound traffic to only the payment processor's IP via strict egress ACLs, enabling detailed logging for monitoring, and accelerating the migration to a supported system, you align with PCI DSS Requirement 6.2 (timely patching) and Requirement 11.5 (change detection) without causing an outage. This layered defense mitigates the active exploit risk until the legacy server can be decommissioned in six months.

Answer

Immediately decommission the server and migrate to the new payment system, accepting a temporary outage

Answer

Apply the vendor's hotfix from an unofficial source to patch the vulnerability

Answer

Accept the risk and purchase additional cyber insurance to cover potential losses

Question 15

A company is deploying a web application and wants to protect against OWASP Top 10 attacks. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Web Application Firewall (WAF). Web Application Firewall (WAF) blocks common attacks like injection and XSS. Input validation prevents injection. Code signing ensures software integrity. Disabling auto-run is unrelated.

Answer

Disable auto-run on user workstations

Answer

Use a host-based intrusion detection system on the database server