SSCP Practice Test 41 — 15 Questions

Question 1

A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.. The root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.

Answer

Publish a certificate revocation list (CRL) and wait for existing certificates to expire.

Answer

Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.

Answer

Enable OCSP stapling on all web servers to check revocation status in real time.

Question 2

A security awareness training program aims to reduce successful phishing attacks. Which metric is most appropriate for measuring the effectiveness of this training?

Accepted Answer

Percentage of employees who click simulated phishing links. The percentage of employees who click simulated phishing links is the most appropriate metric because it directly measures the behavior the training aims to change—whether employees can recognize and avoid phishing attempts. A decrease in click rate over time indicates improved awareness and reduced susceptibility. This is a direct, outcome-based measure of training effectiveness, unlike completion rates which only show participation.

Answer

Training completion rate

Answer

Number of reported phishing emails

Answer

Number of security incidents caused by phishing

Question 3

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 4

A security analyst notices unusual outbound traffic from a server. Which TWO actions should be taken immediately as part of the incident response process?

Accepted Answer

Isolate the affected system from the network.. Isolating the affected system (B) prevents further damage or data exfiltration. Capturing memory and network traffic (D) preserves volatile evidence for analysis. Conducting a vulnerability scan (A) is not immediate. Reimaging (C) is premature before investigation. Notifying law enforcement (E) is not an immediate step.

Answer

Conduct a full vulnerability scan on the system.

Answer

Reimage the system to remove any malware.

Answer

Notify law enforcement authorities.

Question 5

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Accepted Answer

Mount the /tmp and /var partitions with the 'nosuid' option.. Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.

Answer

Enable auditd to log all SUID executions.

Answer

Set the umask to 077 for all users.

Answer

Remove all SUID binaries from the system.

Question 6

An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the correct model because it allows data owners (the users who create or own the resource) to decide who can access their resources. In DAC, the owner sets permissions (e.g., read, write, execute) on objects like files or directories, typically using Access Control Lists (ACLs). This directly matches the requirement where data owners control access decisions.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 7

An organization wants to detect insider threats by identifying abnormal user behavior. Which technology is best suited for this purpose?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is specifically designed to detect insider threats by establishing a baseline of normal user activity and then identifying anomalous deviations, such as unusual login times, abnormal data access patterns, or atypical file transfers. Unlike other security tools that rely on known signatures or network traffic patterns, UBA applies machine learning and statistical modeling to user-centric data (e.g., authentication logs, file system events, and endpoint activity) to uncover subtle, non-signature-based indicators of malicious insider behavior.

Answer

Network-based IDS

Answer

Vulnerability scanner

Answer

Signature-based antivirus

Question 8

A security analyst is reviewing the organization's incident response plan and wants to ensure it includes the necessary elements for the preparation phase according to NIST SP 800-61. Which of the following should be included in the preparation phase? (Choose two.)

Accepted Answer

Developing an incident response policy that defines roles and responsibilities.. The preparation phase of the NIST SP 800-61 incident response lifecycle includes activities that establish the capability to respond to incidents. This includes creating an incident response policy that defines roles and responsibilities, and establishing a communication plan with stakeholders. These elements ensure the organization is ready to detect, analyze, and respond to incidents effectively.

Answer

Eradicating malware from infected systems.

Answer

Recovering data from backups.

Answer

Conducting a lessons learned meeting after an incident.

Question 9

In Linux, which command is used to change file permissions to restrict access so that only the owner can read and write, and the group and others have no access?

Accepted Answer

chmod 600 file.txt. chmod 600 file.txt sets permissions so the owner has read and write (6 = rw-), while group and others have no permissions (0 = ---). This matches the requirement that only the owner can read and write and no one else has access. The numeric (octal) mode 600 is the standard way to express owner rw, group none, others none.

Answer

chown 600 file.txt

Answer

umask 077 file.txt

Answer

setfacl -m u::rw file.txt

Question 10

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

Accepted Answer

Implement transparent data encryption (TDE) to minimize performance impact.. Transparent Data Encryption (TDE) encrypts data at rest at the storage layer, automatically encrypting data before it is written to disk and decrypting it when read into memory. This minimizes performance impact because encryption/decryption occurs outside the application logic and does not require schema changes, making it the best response to the DBA's concern while still meeting the policy requirement.

Answer

Remove the encryption requirement for databases.

Answer

Encrypt only the backup files, not the live database.

Answer

Use column-level encryption on sensitive columns only.

Question 11

Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?

Accepted Answer

Default outbound connections are set to Allow, potentially allowing malware to communicate out. The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface. Therefore, the default outbound allow (B) poses the greatest risk.

Answer

Inbound connections are set to Block by default

Answer

The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic

Answer

The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery

Question 12

An organization implements a policy that the same individual cannot both create a purchase order and approve it in the financial system. Which security principle does this control primarily enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from performing conflicting tasks, such as creating and approving a purchase order. By splitting these responsibilities, the organization reduces the risk of fraud, errors, and unauthorized transactions, ensuring that no single person has unchecked control over a critical financial process.

Answer

Job rotation

Answer

Least privilege

Answer

Need-to-know

Question 13

A security analyst reviews the exhibit. The internal IP 10.0.0.1 is a web server, and 203.0.113.5 is an external IP. What is the most likely issue?

Accepted Answer

The web server may be exfiltrating data to an external host. The exhibit shows a high volume of outbound traffic from internal IP 10.0.0.1 (the web server) to external IP 203.0.113.5 on port 443 (HTTPS). This pattern is consistent with data exfiltration, where a compromised web server sends sensitive data to an external command-and-control (C2) server. The traffic is initiated by the internal server, not inbound, which rules out scanning or DDoS attacks.

Answer

The external IP is scanning the web server for vulnerabilities

Answer

The web server is experiencing a DDoS attack from the external IP

Answer

An internal user is browsing a malicious website

Question 14

Which TWO of the following are essential components of a secure configuration baseline for a new server deployment?

Accepted Answer

Disable all unnecessary services and ports. Option A is correct because a secure configuration baseline must minimize the attack surface by disabling all unnecessary services and closing unused ports, following the principle of least functionality. Option B is correct because applying the latest security patches to the operating system remediates known vulnerabilities before the server is exposed to production traffic. Option C is incorrect because a secure baseline requires comprehensive audit logging, not just error logging, to support detection and forensic analysis. Option D is incorrect because assigning the same strong password to all local accounts violates the principle of unique credentials and enables lateral movement if one account is compromised. Option E is incorrect because default passwords for service accounts are publicly known and must be changed or replaced with strong, unique credentials.

Answer

Enable only error logging, not audit logging

Answer

Assign the same strong password to all local accounts

Answer

Use default passwords for all service accounts

Question 15

An organization's risk register shows a high risk for phishing attacks. Which controls are considered detective controls for this risk?

Accepted Answer

User reporting mechanism.. A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.

Answer

Security awareness training.

Answer

Email filtering.

Answer

Multi-factor authentication.