SSCP Practice Test 43 — 15 Questions

Question 1

An organization is planning to implement ECC for digital signatures. Which key size provides a security level equivalent to a 3072-bit RSA key?

Accepted Answer

256-bit ECC. The National Institute of Standards and Technology (NIST) recommends that a 256-bit elliptic curve (e.g., P-256) provides a security strength of 128 bits, which is equivalent to a 3072-bit RSA key. This equivalence is based on the computational difficulty of the discrete logarithm problem in elliptic curve groups versus integer factorization, where ECC requires significantly smaller key sizes for the same security level.

Answer

192-bit ECC

Answer

1024-bit ECC

Answer

384-bit ECC

Question 2

An organization experiences malware that injects code into legitimate processes. Which security feature should be enabled to prevent code execution in memory pages?

Accepted Answer

Data Execution Prevention (DEP). Data Execution Prevention (DEP) is a hardware and software security feature that marks memory pages as non-executable unless they explicitly contain executable code. By preventing code execution in data-only memory regions (such as the heap and stack), DEP stops malware that attempts to inject and run shellcode within legitimate processes, even if the process is compromised.

Answer

Encrypted File System (EFS)

Answer

Address Space Layout Randomization (ASLR)

Answer

Mandatory Access Control (MAC)

Question 3

Which access control model enforces security based on classification labels assigned to subjects and objects, commonly used for confidentiality?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is a mandatory access control (MAC) model designed for confidentiality. It enforces the 'no read up, no write down' rules: a subject cannot read an object at a higher classification level, and cannot write to an object at a lower level. This prevents unauthorized disclosure of classified information and is widely used in government and military systems.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 4

Drag and drop the steps for establishing a VPN using IPsec in tunnel mode into the correct order.

Accepted Answer

IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA, then Apply IPsec SA to traffic. IPsec tunnel setup: IKE phase 1 (management SA), IKE phase 2 (IPsec SA), then apply to traffic.

Answer

IKE Phase 2: Establish IPsec SA, then IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic

Answer

Apply IPsec SA to traffic, then IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA

Answer

IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic, then IKE Phase 2: Establish IPsec SA

Question 5

An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?

Accepted Answer

Just-in-Time (JIT) provisioning with session recording. Just-in-Time (JIT) provisioning grants privileged access only when needed and for a limited time, and session recording captures all activities for audit. Together, they directly satisfy the requirement that privileged accounts are used only when needed and all activities are recorded. JIT eliminates standing privileges, reducing the attack surface, while session recording provides non-repudiation and forensic evidence.

Answer

Password vaulting

Answer

Role-based access control

Answer

Multi-factor authentication

Question 6

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

Accepted Answer

Minimum 12 characters, complexity required, lockout after 5 attempts, history of 10. The strongest brute-force protection combines a long minimum length (12 characters), complexity requirements, a tight lockout threshold (5 attempts), and a deep password history (10) to prevent reuse. Length exponentially increases the search space, complexity widens the character set, lockout throttles online guessing, and history blocks cycling back to old passwords.

Answer

Minimum 10 characters, no complexity, lockout after 3 attempts, history of 1

Answer

Minimum 6 characters, complexity required, lockout after 10 attempts, history of 5

Answer

Minimum 8 characters, no complexity, no lockout, password history of 3

Question 7

A network administrator wants to block all inbound traffic except for web and email services. Which firewall rule configuration would achieve this?

Accepted Answer

Default-deny with allow rules for HTTP, HTTPS, and SMTP. A default-deny with allow rules for HTTP, HTTPS, and SMTP is the correct approach because it blocks all inbound traffic except the specified services. This follows the principle of least privilege and ensures only necessary traffic is permitted.

Answer

Stateful inspection without default policy

Answer

Stateless packet filtering with a rule per service

Answer

Default-allow with deny rules for unwanted services

Question 8

Which of the following is a common defense against ARP spoofing attacks on a local area network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets on a per-port basis by comparing IP-to-MAC bindings against a trusted DHCP snooping database, dropping ARP packets with invalid bindings. This directly prevents ARP spoofing/poisoning attacks by ensuring only legitimate ARP replies are accepted on untrusted ports.

Answer

DHCP snooping

Answer

Port security

Answer

MAC filtering

Question 9

A security administrator is configuring a new system and wants to enforce a mandatory access control model to ensure confidentiality of classified data. Which access control model should the administrator implement?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model designed to enforce confidentiality using the 'no read up, no write down' rules (simple security property and *-property). It assigns security labels to subjects and objects and prevents lower-cleared subjects from reading higher-classified data, directly meeting the requirement to protect classified information.

Answer

Discretionary Access Control (DAC)

Answer

Biba

Answer

Role-Based Access Control (RBAC)

Question 10

Which UDP port is used by the Simple Network Management Protocol (SNMP) for receiving traps?

Accepted Answer

UDP 162. SNMP agents listen for requests on UDP port 161, but SNMP traps (and inform requests) are sent by the agent to the manager on UDP port 162. The manager must listen on UDP 162 to receive unsolicited notifications. This separation of ports lets the manager distinguish inbound trap traffic from its own outbound polling.

Answer

UDP 161

Answer

UDP 123

Answer

UDP 514

Question 11

An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?

Accepted Answer

Kerberos. Kerberos is the correct choice because it is a ticket-based authentication protocol that provides single sign-on (SSO) capabilities. It uses a trusted third-party Key Distribution Center (KDC) to issue time-limited tickets, allowing users to authenticate once and access multiple services without re-entering credentials.

Answer

LDAP

Answer

SAML

Answer

RADIUS

Question 12

Which UDP port is used by the Dynamic Host Configuration Protocol (DHCP) for server communication?

Accepted Answer

67. DHCP servers listen on UDP port 67 for client requests, while clients use UDP port 68. When a client broadcasts a DHCPDISCOVER message, it is sent from source port 68 to destination port 67. The server responds with a DHCPOFFER from port 67 to port 68. Therefore, port 67 is the correct answer for server communication.

Answer

161

Answer

69

Answer

53

Question 13

A company is migrating from WPA2-PSK to WPA3 for its wireless network. Which THREE benefits does WPA3 provide compared to WPA2?

Accepted Answer

Mandatory use of Protected Management Frames (PMF). Option A is correct because WPA3 mandates Protected Management Frames (PMF, defined in 802.11w), which cryptographically protects management frames such as deauthentication and disassociation, preventing spoofing and denial-of-service attacks that remain possible under WPA2 where PMF is optional. Option C is correct because WPA3-Enterprise offers an optional 192-bit security mode based on CNSA Suite algorithms (GCMP-256, HMAC-SHA-384, ECDHE and ECDSA with 384-bit curves), providing stronger cryptographic protection than the standard WPA2-Enterprise 128-bit suite. Option D is correct because WPA3 replaces the WPA2-PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks by requiring live interaction with the AP for each guess. Option B is incorrect because TKIP is a deprecated, legacy encryption protocol; WPA3 requires CCMP-128 at minimum and does not mandate TKIP. Option E is incorrect because WPA3 does not provide backward compatibility with WEP devices, which use the obsolete RC4-based WEP cipher and cannot negotiate WPA3 security.

Answer

Use of TKIP as the mandatory encryption protocol

Answer

Backward compatibility with WEP devices

Question 14

Which network security control can enforce that only authorized devices with current antivirus and patches can connect to the network?

Accepted Answer

Network Access Control. Network Access Control (NAC) is designed to enforce endpoint compliance before granting network access. It checks devices for up-to-date antivirus, patches, and other security posture requirements, and can quarantine or deny access if they fail. This matches the requirement of ensuring only authorized devices with current antivirus and patches can connect.

Answer

Firewall rules

Answer

Intrusion Prevention System

Answer

Port security

Question 15

Which THREE are appropriate controls to prevent unauthorized access to a data center? (Choose three.)

Accepted Answer

Biometric scanner. A biometric scanner is a physical access control that authenticates individuals based on unique physiological characteristics (e.g., fingerprints, iris patterns). It directly prevents unauthorized entry by verifying identity at the data center perimeter, making it an appropriate control for physical security.

Answer

Firewall

Answer

Encryption