SSCP Practice Test 4 — 10 Questions

Question 1

An IT administrator needs to deprovision a user who has been terminated. Which of the following actions should be performed first to ensure security?

Accepted Answer

Disable the user account. Immediately disabling the account prevents any further access. Evidence preservation can be done afterward, and deletion should be delayed until necessary.

Answer

Remove the user from all groups

Answer

Delete the user account

Answer

Change the user's password

Question 2

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In IaaS, the customer is responsible for securing the operating system, including patch management, because the provider only manages the hypervisor and physical infrastructure. Operating system security and patching is therefore a customer responsibility. The other options are provider responsibilities in IaaS.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 3

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.

Answer

MAC flooding

Answer

DHCP starvation

Answer

DNS poisoning

Question 4

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the memory dump immediately after capture establishes a verifiable baseline for integrity. Any subsequent modification — accidental or intentional — will change the hash, allowing the analyst to prove the evidence was not tampered with. This chain-of-custody practice is fundamental to forensic admissibility.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 5

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 6

What is the PRIMARY purpose of a lessons learned meeting after an incident?

Accepted Answer

To identify improvements in the incident response process. The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Answer

To assign blame for the incident

Answer

To satisfy regulatory compliance requirements

Answer

To calculate the financial cost of the incident

Question 7

An organization is hardening its Windows servers. Which built-in Windows feature can be used to enforce application whitelisting, ensuring only approved executables run?

Accepted Answer

AppLocker. AppLocker is a Windows built-in feature introduced in Windows 7 and Server 2008 R2 that allows administrators to create and enforce rules specifying which applications and files users can run. It uses a whitelisting model based on file attributes such as publisher, path, or hash, and can be configured via Group Policy or PowerShell cmdlets. By default, AppLocker blocks any executable not explicitly allowed, thus ensuring only approved executables run. This directly meets the requirement for application whitelisting on Windows servers.

Answer

BitLocker

Answer

Windows Defender Antivirus

Answer

User Account Control (UAC)

Question 8

Which of the following is a key principle of the 3-2-1 backup rule?

Accepted Answer

Three copies on two different media types with one offsite. The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

Answer

Two copies on three different media types with one onsite

Answer

One copy on two different media types with three offsite

Answer

Three copies on three different media types with two offsite

Question 9

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 10

A medium-sized e-commerce company uses a SIEM with correlation rules. During peak sales hours, the SIEM generates an alert: multiple failed login attempts from internal IP 172.16.10.50 followed by a successful login to a critical database server. The account used is 'dbadmin', which normally only authenticates from the IT department subnet. The user 'dbadmin' reports that they had to try several passwords because they forgot theirs earlier. The incident responder is under pressure to quickly restore normal operations. Which course of action should the responder take?

Accepted Answer

Investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP.. While the user's explanation seems plausible, the alert indicates a deviation from normal behavior (logins from an unexpected subnet). The responder should investigate the user's recent activity, check for abnormal logins, and look for lateral movement from the source IP to rule out a potential compromise. Option A (blocking the user's account immediately) could be disruptive if it's a false positive and may prevent legitimate access. Option B (resetting password and enabling MFA) is a good security measure but does not address the need to verify whether the account was actually compromised or if there is ongoing malicious activity. Option C (dismissing the alert as a false positive) is premature and ignores the possibility of credential stuffing or account takeover. Therefore, investigating further is the most appropriate course of action.

Answer

Block the user's account immediately to prevent any further access.

Answer

Reset the user's password and enable multi-factor authentication (MFA).

Answer

Dismiss the alert as a false positive since the user explained the failed attempts.