SSCP Practice Test 4 — 10 Questions

Question 1

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 2

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software

Question 3

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

Accepted Answer

Assess the exploitability and impact to determine remediation priority. The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Answer

Apply the patch immediately to reduce risk

Answer

Re-scan the server to confirm the vulnerability

Answer

Ignore the vulnerability because the patch is available

Question 4

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 5

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 6

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 7

A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.

Answer

SSH (Secure Shell)

Answer

SSL 3.0

Answer

IPsec in transport mode

Question 8

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Something you have (smart card) plus something you are (fingerprint) constitutes MFA using two different factors.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 9

A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?

Accepted Answer

Detect and remediate cloud misconfigurations. CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.

Answer

Manage user identities and access

Answer

Protect workloads from runtime threats

Answer

Encrypt data at rest

Question 10

An organization is implementing a new remote access VPN for employees using IPsec. Which TWO of the following are best practices for securing the IPsec VPN?

Accepted Answer

Use AES encryption with a minimum key size of 128 bits. AES encryption with a minimum key size of 128 bits is a best practice for IPsec VPNs because it provides strong, symmetric encryption that is resistant to known cryptographic attacks. AES-128 is approved by NIST and widely considered secure for protecting sensitive data over untrusted networks like the internet.

Answer

Use pre-shared keys for authentication

Answer

Disable anti-replay protection to improve performance

Answer

Allow all IP protocols through the VPN tunnel