SSCP Practice Test 40 — 15 Questions

Question 1

An organization uses a SIEM to correlate events. The SIEM receives Windows Security Event ID 4625 (failed login) and 4776 (credential validation). An analyst wants to detect a brute-force attack against a service account. Which correlation rule is most effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Alert on multiple failed logins for the same account from different source IPs in 10 minutes. A brute-force attack against a service account typically involves multiple failed login attempts from different source IPs, as attackers often distribute their attempts to evade IP-based blocking. Correlating Event ID 4625 (failed login) and 4776 (credential validation) across multiple source IPs for the same account within a short time window (e.g., 10 minutes) directly identifies this distributed brute-force pattern, which a single-IP threshold would miss.

Answer

Alert on more than 10 failed logins from a single IP in 5 minutes

Answer

Alert on successful logins after multiple failures

Answer

Alert on any Event ID 4625 or 4776 with severity high

Question 2

Which of the following best describes the difference between HMAC and a simple hash function like SHA-256 when used for message authentication?

Accepted Answer

HMAC provides integrity and authentication; SHA-256 provides only integrity. HMAC incorporates a secret key into the hash process, providing authentication that a simple hash cannot.

Answer

HMAC is faster than SHA-256

Answer

SHA-256 produces a larger digest than HMAC

Answer

HMAC is used for encryption, not hashing

Question 3

A security team uses a risk matrix with likelihood (Low, Medium, High) and impact (Low, Medium, High). A vulnerability scan finds a buffer overflow in a customer-facing web application. The application is not critical but has high availability requirements. The likelihood of exploitation is considered Medium due to internal network segmentation. What is the risk level?

Accepted Answer

High. The risk level is High because the likelihood is Medium (due to internal network segmentation reducing but not eliminating the chance of exploitation) and the impact is High (the application has high availability requirements, so a buffer overflow could cause a denial of service or code execution, severely affecting availability). In a standard 3x3 risk matrix, Medium likelihood combined with High impact yields a High risk rating.

Answer

Medium

Answer

Extreme

Answer

Low

Question 4

During a post-incident review, the incident response team identifies several areas for improvement. According to NIST SP 800-61, which THREE activities are typically part of the post-incident activity phase?

Accepted Answer

Update the incident response plan based on findings. NIST SP 800-61 explicitly states that the post-incident activity phase includes updating the incident response plan based on lessons learned and findings from the incident. This ensures the plan evolves to address gaps and improve future response effectiveness.

Answer

Patch all systems in the organization as a precaution

Answer

Replace all affected hardware immediately

Question 5

An organization experiences a ransomware attack that encrypts file servers. The annualized loss expectancy (ALE) for this risk is calculated as $150,000. The single loss expectancy (SLE) is $30,000. What is the annualized rate of occurrence (ARO)?

Accepted Answer

5. The annualized rate of occurrence (ARO) is calculated by dividing the annualized loss expectancy (ALE) by the single loss expectancy (SLE): ARO = ALE / SLE = $150,000 / $30,000 = 5. This means the ransomware attack is expected to occur five times per year, which is a key metric in quantitative risk analysis for prioritizing security controls.

Answer

0.2

Answer

4.5

Answer

0.5

Question 6

A small business wants to implement an access control system where employees can access files based on their department (e.g., HR, Finance). They want simplicity and ease of administration. Which access control model is BEST suited?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is best suited because it maps access permissions directly to job functions (roles) such as HR or Finance, rather than to individual users. This simplifies administration: when an employee changes departments, the administrator simply updates their role assignment, and all associated permissions are automatically applied or revoked. RBAC is designed for environments where access decisions are based on organizational roles, providing a balance of security and ease of management.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Question 7

Match each authentication factor to its category.

Accepted Answer

Something you know: Password. Authentication factors are categorized into knowledge (something you know), possession (something you have), inherence (something you are), and location (somewhere you are). Common confusions include mixing knowledge with possession or inherence.

Answer

Something you know: Fingerprint

Answer

Something you have: Password

Question 8

During a risk assessment, a team identifies that the annualized loss expectancy (ALE) for a critical asset is $50,000. A proposed control costs $15,000 per year and will reduce the annualized rate of occurrence (ARO) from 5 to 1. The single loss expectancy (SLE) is unchanged at $10,000. What is the net benefit of implementing the control?

Accepted Answer

$25,000. The current ALE is $50,000 (ARO of 5 × SLE of $10,000). With the control, ARO drops to 1, so the new ALE is $10,000 (1 × $10,000). The reduction in ALE is $40,000. Subtracting the annual control cost of $15,000 gives a net benefit of $25,000. This aligns with the formula: Net Benefit = (Old ALE – New ALE) – Annual Control Cost.

Answer

$40,000

Answer

$10,000

Answer

$35,000

Question 9

Which THREE of the following are common use cases for public key infrastructure (PKI)? (Select exactly three.)

Accepted Answer

Digital signatures. Digital signatures are a core use case for PKI because they rely on asymmetric cryptography where a private key signs data and the corresponding public key, bound to an identity via a digital certificate issued by a Certificate Authority (CA), verifies the signature. This ensures authenticity, integrity, and non-repudiation of the signed message or document.

Answer

Password hashing

Answer

Symmetric key exchange

Question 10

Which TWO of the following are required properties of a cryptographically secure hash function? (Select exactly 2.)

Accepted Answer

Collision resistance. Collision resistance (B) is a required property because it ensures that it is computationally infeasible to find two distinct inputs that produce the same hash output. Without this property, an attacker could substitute a legitimate message with a fraudulent one that yields an identical hash, breaking the integrity guarantees of the hash function. This is a fundamental requirement for digital signatures and message authentication codes (MACs) in cryptographic protocols.

Answer

Deterministic output

Answer

High speed for large inputs

Answer

Low output entropy

Question 11

A security auditor reviews a system that uses HMAC-SHA256 for message authentication. Which property does HMAC provide that a simple hash of the message does not?

Accepted Answer

Integrity and authentication using a shared secret. HMAC-SHA256 uses a shared secret key combined with the message before hashing, which provides both integrity (detecting tampering) and authentication (verifying the sender knows the secret). A simple hash of the message alone offers integrity but no authentication, because anyone can compute the same hash without a secret. Thus, HMAC adds authentication via the shared secret, making option C correct.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Forward secrecy

Question 12

A financial services organization deploys a new web application that allows customers to check account balances and transfer funds. The application uses a RESTful API with JSON payloads. Shortly after deployment, the security team notices unusual traffic patterns: many requests contain excessively long JSON strings in the 'amount' field, and some of these requests return 500 Internal Server Errors. The application logs show that these requests cause high CPU usage on the application server. The developers confirm that the input validation only checks for negative numbers and characters. Which type of attack is most likely occurring, and what is the best immediate mitigation?

Accepted Answer

The attack is a Denial of Service using large payloads; implement input size limits and validation.. The symptoms indicate a Denial of Service attack via large payloads that consume server resources. Excessive JSON string length in the 'amount' field causes high CPU usage during parsing and processing, leading to 500 errors. The best immediate mitigation is to implement input size limits and strict validation to reject oversized payloads. Option A is incorrect because brute-force attacks typically involve repeated attempts with different values, not large payloads causing CPU exhaustion; rate limiting would not address the root cause. Option B is incorrect because cross-site scripting (XSS) targets client-side script execution in the browser, not server-side CPU spikes. Option D is incorrect because SQL injection would likely return database error messages or cause data manipulation, not high CPU from JSON parsing.

Answer

The attack is a brute-force attempt on the amount field; implement rate limiting.

Answer

The attack is cross-site scripting; sanitize output.

Answer

The attack is SQL injection; use parameterized queries.

Question 13

Refer to the exhibit. A network administrator implements this ACL on a border router. What is the effect?

Accepted Answer

SSH to 192.168.1.100 is permitted from any source. The ACL explicitly permits TCP traffic sourced from any IP address destined to 192.168.1.100 on port 22, which is the default port for SSH. Since the ACL is applied inbound on the border router's external interface, it allows SSH connections from any external source to reach the internal host 192.168.1.100, while implicitly denying all other traffic.

Answer

SSH is completely blocked

Answer

All traffic to 192.168.1.100 is permitted

Answer

Only SSH from external networks is blocked

Question 14

Which TWO protocols are used to secure email communication at the message level?

Accepted Answer

PGP. PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) are the two primary protocols that secure email at the message level. They encrypt the entire email body and attachments, ensuring end-to-end confidentiality and integrity regardless of the transport path. PGP uses a web of trust model, while S/MIME relies on a hierarchical public key infrastructure (PKI) with X.509 certificates.

Answer

IPsec

Answer

SSL/TLS

Answer

SSH

Question 15

Which wireless security standard introduced the Simultaneous Authentication of Equals (SAE) handshake to replace the pre-shared key (PSK) method?

Accepted Answer

WPA3. WPA3 replaced WPA2's PSK with SAE, which provides forward secrecy and is resistant to offline dictionary attacks.

Answer

802.11i

Answer

WEP

Answer

WPA2