SSCP Practice Test 42 — 15 Questions

Question 1

A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Report the issue to the CAB and request a revised change. The change should be halted and the CAB reconvened to reassess the change given the new information.

Answer

Reject the change request and close it permanently

Answer

Implement the change but have a rollback plan ready

Answer

Proceed with the change and resolve the issue after implementation

Question 2

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

Accepted Answer

Assess the risk and implement compensating controls if possible. The first step is to assess the risk and prioritise based on exploitability and asset criticality. A CVSS 9.8 vulnerability is critical, so immediate action is needed, but the administrator should evaluate compensating controls before applying the patch.

Answer

Schedule the patch for the next maintenance window without further analysis

Answer

Apply the patch immediately during business hours

Answer

Document the exception and ignore the vulnerability

Question 3

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. A clean desk policy requires that sensitive information, including passwords, be secured and not left visible.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 4

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

Accepted Answer

Implement transparent data encryption (TDE) to minimize performance impact.. Transparent Data Encryption (TDE) encrypts data at rest at the storage layer, automatically encrypting data before it is written to disk and decrypting it when read into memory. This minimizes performance impact because encryption/decryption occurs outside the application logic and does not require schema changes, making it the best response to the DBA's concern while still meeting the policy requirement.

Answer

Remove the encryption requirement for databases.

Answer

Encrypt only the backup files, not the live database.

Answer

Use column-level encryption on sensitive columns only.

Question 5

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

Accepted Answer

Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.. Forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Answer

Boot the suspect system and use imaging software to copy data.

Answer

Remove the drive and place it in anti-static bag, then ship to lab.

Answer

Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.

Question 6

A large e-commerce company has a disaster recovery (DR) plan that requires Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour for its customer database. The database runs on a clustered SQL server with synchronous replication to a standby server in a different data center. During a recent test, the IT team found that failover took 3 hours, but due to a replication lag of 45 minutes, some transactions were lost. The team needs to meet both RTO and RPO. Which of the following changes should the team implement FIRST?

Accepted Answer

Shorten the synchronization interval from 45 minutes to 15 minutes. The primary issue is that the database has a Recovery Point Objective (RPO) of 1 hour, but the current replication lag of 45 minutes puts the organization at risk of losing up to 45 minutes of transactions. Shortening the synchronization interval to 15 minutes reduces the maximum potential data loss to 15 minutes, well within the RPO requirement. While automating failover (option D) could improve the Recovery Time Objective (RTO), the RTO is already being met (3 hours < 4 hours), so the immediate priority is addressing the RPO gap. Options A (asynchronous replication) would increase data loss, and B (increased bandwidth) may not directly reduce the lag if it is due to batch processing intervals rather than network constraints. Therefore, option C is the first change to implement.

Answer

Implement asynchronous replication to a third site

Answer

Increase the bandwidth between data centers

Answer

Automate the failover process with orchestration scripts to reduce manual steps

Question 7

A company is implementing a PKI for internal use. What is the primary purpose of a Certificate Revocation List (CRL)?

Accepted Answer

To publish revoked certificates. The primary purpose of a Certificate Revocation List (CRL) is to publish a list of certificates that have been revoked by the Certificate Authority (CA) before their scheduled expiration. This allows relying parties to verify that a certificate is still valid and has not been compromised, ensuring trust in the PKI.

Answer

To validate certificate chains

Answer

To encrypt certificate requests

Answer

To store all issued certificates

Question 8

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Accepted Answer

CMDB. A Configuration Management Database (CMDB) stores details about hardware assets and their relationships.

Answer

Patch management tool

Answer

Vulnerability database

Answer

SIEM

Question 9

Which two of the following measures ensure the integrity of backup data? (Choose two.)

Accepted Answer

Keeping backups offline and immutable. Regular backup testing verifies that backups are restorable. Keeping backups offline and immutable prevents tampering. Storing on the same drive risks loss. Encryption protects confidentiality, not necessarily integrity.

Answer

Storing backups on the same drive as original data

Answer

Using encryption for backup media

Answer

Setting backups to overwrite each month

Question 10

A security analyst is reviewing logs and notices that an application log shows an error message indicating 'unhandled exception' followed by a stack trace. This log is most likely categorized as which type?

Accepted Answer

Application log. Application logs are generated by software applications and record application-specific events, including errors like 'unhandled exception' and stack traces. Since the log entry originates from an application and contains a stack trace (a developer-oriented diagnostic), it is categorized as an application log, not a system, security, or audit log.

Answer

System log

Answer

Security log

Answer

Audit log

Question 11

Which THREE are effective controls against internal network threats?

Accepted Answer

Network segmentation. Network segmentation (A) is effective because it divides the network into isolated segments, limiting lateral movement of threats. By using VLANs or firewalls, an attacker who compromises one segment cannot easily access other critical systems, reducing the blast radius of an internal breach.

Answer

Intrusion detection system (IDS)

Answer

Single sign-on (SSO)

Question 12

A company runs containerized applications in a Kubernetes cluster. They need to ensure that containers run with the least privilege and cannot escalate privileges. Which configuration change is MOST effective?

Accepted Answer

Drop all Linux capabilities from the container. Dropping all Linux capabilities from the container directly removes the ability to perform privileged operations, including privilege escalation. This is the most effective measure for preventing privilege escalation. Option A is incorrect because running as non-root does not prevent privilege escalation if the container retains capabilities. Option C is incorrect because mounting root as read-only does not prevent privilege escalation via kernel exploits or mounted volumes. Option D is incorrect because SELinux enforcing mode adds MAC but is not the most direct way to prevent privilege escalation within the container.

Answer

Set the container to run as non-root user

Answer

Mount the container root filesystem as read-only

Answer

Enable SELinux enforcing mode on the host

Question 13

A security engineer is designing a federated identity solution for cross-domain authentication. Which THREE of the following technologies are commonly used?

Accepted Answer

OpenID Connect (OIDC). Federated identity relies on standards like SAML, OAuth/OIDC, and Active Directory forest trusts to enable authentication across domains.

Answer

Kerberos

Answer

Lightweight Directory Access Protocol (LDAP)

Question 14

A security administrator is configuring a system to enforce separation of duties. In which access control model is this principle most directly implemented?

Accepted Answer

RBAC. RBAC commonly enforces separation of duties by ensuring that conflicting roles are not assigned to the same user.

Answer

MAC

Answer

ABAC

Answer

DAC

Question 15

What is the primary risk associated with service accounts in an enterprise?

Accepted Answer

They often have excessive privileges and infrequent password changes. Service accounts often have high privileges and are rarely changed, making them prime targets for attackers if compromised.

Answer

They are used by multiple users simultaneously

Answer

They are difficult to create

Answer

They are always tied to a specific user