SSCP Practice Test 42 — 15 Questions

Question 1

A system administrator is configuring a file encryption solution for a shared network drive. The solution must allow multiple users to read the files without sharing a single symmetric key. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypt the file with a symmetric key, then encrypt that key with each authorized user's public key. Describes hybrid encryption, which is the correct approach for this scenario. The file is encrypted with a random symmetric key (session key) for efficiency, and that symmetric key is then encrypted with each authorized user's public key. This allows multiple users to decrypt the symmetric key with their private key and then decrypt the file, without sharing a single symmetric key.

Answer

Use a different symmetric key for each user and re-encrypt the file for each user

Answer

Encrypt the file with each user's public key directly

Answer

Encrypt the file with a single symmetric key and share that key securely with all users

Question 2

A company implements mandatory access control (MAC) on its classified document system. A user with a security clearance of Secret attempts to read a document labeled Top Secret. What happens?

Accepted Answer

The access is denied by the system. In a mandatory access control (MAC) system, access decisions are based on comparing the user's security clearance (Secret) with the document's classification label (Top Secret). Since the clearance level is lower than the document's classification, the system automatically denies the read operation. This is a fundamental property of MAC, where the system enforces the Bell-LaPadula model's simple security property (no read up).

Answer

The user is prompted to request a temporary upgrade

Answer

The document is downgraded to Secret for the user

Answer

The user can read the document because they have a valid clearance

Question 3

A system administrator needs to assign permissions to a new employee who will be performing database backups. The employee should only be able to execute the backup command but not read or modify the data. Which access control principle should be applied?

Accepted Answer

Least privilege. The least privilege principle dictates that a user should be granted only the minimum permissions necessary to perform their job function. In this scenario, the employee needs only the ability to execute the backup command (e.g., using a tool like `pg_dump` or `mysqldump` with a read-only snapshot), not read or modify the underlying data files. Applying least privilege ensures the backup process can run without granting broader SELECT or FILE privileges that would allow data access or alteration.

Answer

Need to know

Answer

Separation of duties

Answer

Defense in depth

Question 4

A small business wants to implement an access control system where employees can access files based on their department (e.g., HR, Finance). They want simplicity and ease of administration. Which access control model is BEST suited?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is best suited because it maps access permissions directly to job functions (roles) such as HR or Finance, rather than to individual users. This simplifies administration: when an employee changes departments, the administrator simply updates their role assignment, and all associated permissions are automatically applied or revoked. RBAC is designed for environments where access decisions are based on organizational roles, providing a balance of security and ease of management.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Question 5

Which backup type copies all data that has changed since the last full backup, regardless of any incremental backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate incremental backups. This means each differential backup grows in size as it accumulates all changes made after the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Synthetic full backup

Answer

Full backup

Answer

Incremental backup

Question 6

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

Accepted Answer

Correlate high outbound DNS query volume with requests to newly registered or suspicious domains. DNS tunneling encodes data in DNS queries and responses, often generating a high volume of outbound queries to domains that are newly registered or otherwise suspicious. Correlating these two indicators—unusual query volume and suspicious domain characteristics—directly targets the behavior of DNS tunneling, making it the most effective rule for detecting this exfiltration technique.

Answer

Correlate multiple failed logins from a single IP

Answer

Alert on any single failed login attempt

Answer

Alert when a user accesses a file share after hours

Question 7

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Accepted Answer

A cloud storage bucket is configured with public read access. CSPM tools continuously scan cloud configurations against security benchmarks (CIS, NIST, PCI-DSS) and detect misconfigurations like publicly accessible storage buckets, overly permissive IAM policies, unencrypted volumes, and disabled logging. A publicly readable S3 bucket is a textbook CSPM finding.

Answer

An application running on a cloud VM has a memory leak causing performance degradation

Answer

A cloud-based database is experiencing slow query response times

Answer

An employee's credentials were used from an unusual geographic location

Question 8

Which of the following encryption protocols should be used to secure wireless traffic in an enterprise environment?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise is the correct choice because it provides the highest level of security for enterprise wireless networks, incorporating mandatory 192-bit Suite B cryptographic suites (AES-256 in GCM mode, HMAC-SHA384, and ECDHE key exchange) to protect against offline dictionary attacks, forward secrecy, and brute-force attempts. It also uses Simultaneous Authentication of Equals (SAE) for the handshake, replacing the vulnerable 4-way handshake of WPA2, and supports 802.1X/EAP authentication with RADIUS for centralized user management.

Answer

WEP

Answer

WPA3-PSK

Answer

WPA2-PSK

Answer

WPA2-Enterprise

Question 9

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 10

Which three of the following are best practices for securing a database? (Choose three.)

Accepted Answer

Encrypt sensitive data at rest. Option A is correct because encrypting sensitive data at rest (e.g., using Transparent Data Encryption or column-level encryption) protects the data even if the underlying storage media or backups are compromised. Option C is correct because row-level security restricts which rows a user can access based on their identity or role, enforcing fine-grained access control within a shared table. Option D is correct because applying the principle of least privilege ensures database users and applications receive only the minimum permissions needed, reducing the attack surface and limiting damage from compromised accounts. Option B is not a best practice because default passwords are widely known and easily exploited; they should be changed immediately. Option E is not a best practice because enabling public access exposes the database to unauthorized internet-based attacks and should be restricted via firewalls, private endpoints, or VPC controls.

Answer

Use default passwords for database accounts

Answer

Enable public access to the database

Question 11

A company wants to implement a key management system. They need to generate cryptographic keys that are unpredictable. Which source of randomness should be used?

Accepted Answer

Hardware random number generator (HRNG). A hardware random number generator (HRNG) is the correct choice because it derives randomness from physical processes (e.g., thermal noise, quantum effects) that are inherently unpredictable and non-deterministic. Cryptographic key generation requires true entropy to resist brute-force and prediction attacks, which software-based deterministic methods cannot guarantee.

Answer

Random numbers from a website

Answer

Linear congruential generator (LCG)

Answer

Pseudorandom number generator (PRNG) seeded with current timestamp

Question 12

A company is migrating from 3DES to a modern encryption algorithm. Which of the following are acceptable choices? (Select TWO)

Accepted Answer

ChaCha20. Option B (ChaCha20) is correct because it is a modern, secure stream cipher standardized by the IETF in RFC 8439, offering strong 256-bit security and excellent performance in software without hardware acceleration. Option C (AES) is correct because it is the current NIST-approved symmetric block cipher, available in 128-, 192-, and 256-bit key sizes, and is the standard replacement for deprecated algorithms like 3DES. Option A (DES) is not acceptable because its 56-bit key is trivially brute-forced and it has been obsolete for decades. Option D (RC4) is not acceptable because it is a broken stream cipher with well-known biases (e.g., in WEP/TLS) and is prohibited by RFC 7465. Option E (Blowfish) is not acceptable as a modern choice because its 64-bit block size makes it vulnerable to birthday attacks (e.g., SWEET32) and it has been superseded by Twofish/AES.

Answer

DES

Answer

RC4

Answer

Blowfish

Question 13

A company needs to ensure that when an employee leaves the organization, their accounts are disabled promptly to prevent unauthorized access. Which approach is MOST effective for timely account deactivation?

Accepted Answer

Automatically synchronize with the HR system to disable accounts upon termination.. Automatically synchronizing with the HR system ensures that account deactivation occurs immediately upon termination, eliminating human delay or error. This approach leverages identity lifecycle management (ILM) to enforce the principle of least privilege and prevent unauthorized access through orphaned accounts.

Answer

Conduct quarterly access reviews to identify and disable unused accounts.

Answer

Require managers to report departures via a ticketing system.

Answer

Implement a self-service password reset system to empower users.

Question 14

Which TWO of the following are methods to defend against SYN flood attacks? (Select TWO)

Accepted Answer

Increasing the SYN backlog queue size. Option C (Increasing the SYN backlog queue size) is correct because a SYN flood exhausts the backlog of half-open connections; enlarging the backlog lets the server hold more pending SYNs so legitimate clients can still complete the three-way handshake before the queue overflows. Option D (SYN cookies) is correct because it eliminates the need to store half-open state: the server encodes connection parameters into the SYN-ACK sequence number and only allocates resources when the final ACK returns, so spoofed SYNs cannot exhaust memory. Option A (Enabling IP routing) is unrelated to SYN flood mitigation and would only forward packets between interfaces, potentially worsening exposure. Option B (Using UDP instead of TCP) is not a defense—SYN floods are specific to TCP's handshake, and switching protocols changes the application entirely rather than protecting it. Option E (Disabling TCP timestamps) has no effect on SYN flood resistance; timestamps are an optional TCP extension for RTT measurement and PAWS, not a resource-exhaustion control.

Answer

Enabling IP routing

Answer

Using UDP instead of TCP

Answer

Disabling TCP timestamps

Question 15

A security team is conducting a qualitative risk assessment for a new cloud application. They want to prioritize risks based on likelihood and impact. Which method should they use to combine these factors?

Accepted Answer

Risk matrix (heat map). A risk matrix (heat map) is the correct method because it combines qualitative assessments of likelihood and impact into a single visual grid, allowing the team to prioritize risks by their position in the matrix. This approach is standard for qualitative risk assessments where numerical data is unavailable, as it maps ordinal ratings (e.g., low, medium, high) to a color-coded priority level.

Answer

SWOT analysis

Answer

Annualized loss expectancy (ALE)

Answer

Business Impact Analysis (BIA)