SSCP Practice Test 41 — 15 Questions

Question 1

A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?

Accepted Answer

Mount the /tmp and /var partitions with the 'nosuid' option.. Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.

Answer

Enable auditd to log all SUID executions.

Answer

Set the umask to 077 for all users.

Answer

Remove all SUID binaries from the system.

Question 2

An organization wants to ensure that only authorized devices can connect to its internal network. Which of the following should be implemented?

Accepted Answer

Network access control (NAC). Network Access Control (NAC) is the correct choice because it enforces security policy by evaluating the identity, posture, and compliance of devices before granting network access. NAC solutions (e.g., Cisco ISE, Aruba ClearPass) can authenticate devices via 802.1X, check for antivirus updates or patch levels, and quarantine non-compliant endpoints, ensuring only authorized and healthy devices connect to the internal network.

Answer

Intrusion detection system

Answer

Port security on switches

Answer

Virtual private network

Question 3

An e-commerce company runs its web application on a Windows Server 2019 with IIS 10. The security team runs a vulnerability scan and discovers that the server supports TLS 1.0 and several CBC-mode cipher suites, which are prohibited by the company's security policy. The policy requires disabling all versions of TLS below 1.2 and all cipher suites that do not use GCM mode. The administrator needs to implement the required changes without affecting the application's functionality, as it still needs to support a small number of legacy clients that require TLS 1.2 but not CBC. Which action should the administrator take?

Accepted Answer

Disable TLS 1.0 via the registry and configure the cipher suite order in IIS to prefer GCM-based ciphers.. The administrator can disable TLS 1.0 via the Windows registry (e.g., by creating the 'Enabled' DWORD under 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' and setting it to 0) and then configure the cipher suite order in IIS using the 'SchUseStrongCrypto' registry key or the 'Cipher Suites' group policy to prioritize GCM-based ciphers (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). This directly enforces the policy—disabling TLS below 1.2 and non-GCM ciphers—while still allowing legacy clients that support TLS 1.2 with GCM to connect without breaking functionality.

Answer

Upgrade the server to Windows Server 2022, which automatically disables TLS 1.0.

Answer

Implement a reverse proxy with strong TLS configuration and route all traffic through it.

Answer

Apply a hotfix from Microsoft that removes TLS 1.0 support.

Question 4

An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?

Accepted Answer

Administrative control. This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.

Answer

Detective control

Answer

Technical control

Answer

Physical control

Question 5

Match each incident response phase to its activity.

Accepted Answer

Preparation: Establishing procedures and training the team.. The incident response phases include Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. Common confusions are mixing preparation with containment and detection with recovery.

Answer

Preparation: Containing the incident to prevent further damage.

Answer

Detection and Analysis: Restoring normal operations after the incident.

Question 6

You are the security administrator for a mid-sized financial company that processes credit card transactions. The company has a mix of on-premises servers and cloud-based services. Recently, the company experienced a data breach where an attacker exfiltrated customer data from a database server. The investigation reveals that the attacker used compromised credentials of a database administrator (DBA) account. The DBA account had been used by multiple administrators without proper auditing. The company wants to implement a solution to prevent such incidents in the future. The solution must: 1) ensure that each administrator has a unique account for database access, 2) require approval for privileged actions, 3) provide a full audit trail of all privileged activities, and 4) be cost-effective. Which of the following is the best course of action?

Accepted Answer

Implement a privileged access management (PAM) solution that provides just-in-time access and session recording.. A privileged access management (PAM) solution provides just-in-time access, approval workflows, and session recording, meeting all requirements. Shared accounts violate uniqueness; MFA alone doesn't provide approval or audit; database auditing software logs activities but does not enforce approval.

Answer

Enforce the use of a shared DBA account with a complex password that is changed monthly.

Answer

Require multi-factor authentication for all database access without any additional controls.

Answer

Install a database activity monitoring (DAM) solution that logs all SQL queries.

Question 7

A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?

Accepted Answer

Email gateway logs. Email gateway logs capture metadata and content of outbound emails, including sender, recipient, subject, and attachments, enabling detection of anomalous data transfers. Data Loss Prevention (DLP) logs provide detailed policy violation alerts when sensitive data patterns (e.g., credit card numbers, classified text) are matched in email content, directly identifying exfiltration attempts.

Answer

Physical access logs

Answer

Firewall logs

Answer

DNS logs

Question 8

Which THREE of the following are examples of detective controls?

Accepted Answer

Intrusion detection system (IDS). An intrusion detection system (IDS) is a detective control because it passively monitors network traffic or system activity for signs of malicious behavior or policy violations, generating alerts when suspicious patterns are detected. Unlike a preventive control, an IDS does not block traffic; it only identifies and reports incidents after they occur or in real-time, making it a classic example of a detective security measure.

Answer

Data encryption at rest

Answer

Firewall with default-deny rule

Question 9

A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)

Accepted Answer

Average time to patch critical vulnerabilities. Average time to patch critical vulnerabilities (Mean Time to Patch, MTTP) directly measures the speed of remediation, which is a key indicator of patching effectiveness. Patch compliance rate quantifies the percentage of systems that have the required patches installed, reflecting coverage and adherence to policy. Both metrics provide actionable data on the patching process's efficiency and completeness.

Answer

Help desk ticket volume

Answer

Number of security incidents

Answer

Number of users trained

Question 10

Which THREE of the following are valid methods for authenticating users in a web application? (Choose three.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is a valid method for authenticating users in a web application because it is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables single sign-on (SSO) by allowing the SP to trust the IdP's assertion of the user's identity, making it a widely adopted federated authentication protocol.

Answer

IP address whitelisting

Answer

LDAP

Question 11

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

Accepted Answer

Use Delegation of Control wizard to assign the 'Reset user passwords and force password change at next logon' permission.. The Delegation of Control wizard allows granular assignment of specific Active Directory permissions, such as 'Reset user passwords and force password change at next logon', without granting broader administrative rights. This follows the principle of least privilege by limiting the delegated personnel to only the necessary task. Option C is correct because it directly addresses the requirement with a built-in, secure delegation mechanism.

Answer

Place the personnel in the Account Operators group.

Answer

Add the personnel to the Domain Admins group.

Answer

Give the personnel physical access to the domain controller.

Question 12

During a risk assessment, a company identifies that a legacy system has a known CVE with a CVSS score of 9.8. The system is critical but cannot be patched immediately. The management decides to implement strict network segmentation and monitor the system continuously. This risk response is best described as:

Accepted Answer

Risk mitigation. Risk mitigation, because the company is implementing strict network segmentation and continuous monitoring to reduce the likelihood and impact of the vulnerability being exploited. This reduces the risk without eliminating it entirely, which is the essence of mitigation. The CVSS score of 9.8 indicates critical severity, and the controls (e.g., ACLs, VLANs, IDS/IPS) directly address the attack surface.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 13

Which THREE of the following are common methods for implementing multifactor authentication (MFA)?

Accepted Answer

Password and SMS code. It combines something you know (password) with something you have (SMS code sent to a registered device). This satisfies the MFA requirement of using at least two distinct authentication factors, making it significantly more secure than single-factor password-only authentication.

Answer

Retina scan and facial recognition

Answer

Password and security question

Question 14

Which of the following encryption protocols should be used to secure wireless traffic in an enterprise environment?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise is the correct choice because it provides the highest level of security for enterprise wireless networks, incorporating mandatory 192-bit Suite B cryptographic suites (AES-256 in GCM mode, HMAC-SHA384, and ECDHE key exchange) to protect against offline dictionary attacks, forward secrecy, and brute-force attempts. It also uses Simultaneous Authentication of Equals (SAE) for the handshake, replacing the vulnerable 4-way handshake of WPA2, and supports 802.1X/EAP authentication with RADIUS for centralized user management.

Answer

WEP

Answer

WPA3-PSK

Answer

WPA2-PSK

Answer

WPA2-Enterprise

Question 15

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

Accepted Answer

Sanitise the hard drive and then dispose or reassign. Media handling policies require that portable media be sanitised before disposal to prevent data leakage. Hard drives should be wiped or destroyed.

Answer

Keep the hardware in storage indefinitely

Answer

Recycle the hardware without any data removal

Answer

Reassign the hardware to a new employee without wiping