SSCP Practice Test 43 — 15 Questions

Question 1

Which of the following protocols is used to securely transfer files over SSH and is considered a replacement for FTP?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) provides secure file transfer over SSH.

Answer

IPsec

Answer

HTTPS

Answer

SMTPS

Question 2

Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP allows querying the CA's responder for the status of a specific certificate in real-time.

Answer

Certificate Revocation List (CRL)

Answer

Self-signed certificate validation

Answer

Certificate Transparency (CT)

Question 3

An organization is migrating a legacy application to a PaaS cloud environment. According to the shared responsibility model, which security control is the organization still responsible for?

Accepted Answer

Securing the application code against SQL injection. In PaaS, the provider manages the runtime, middleware, and OS; the customer is responsible for application-level security, including code and data.

Answer

Configuring the network firewall at the cloud perimeter

Answer

Patching the underlying operating system

Answer

Managing the hypervisor and virtualization layer

Question 4

An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?

Accepted Answer

Operating system security and patch management. In the IaaS shared responsibility model, the cloud provider manages the physical infrastructure, while the customer is responsible for securing the operating system, applications, and data.

Answer

Network infrastructure security

Answer

Hypervisor security and patching

Answer

Physical security of the data center

Question 5

A system administrator is applying CIS Benchmarks to a Windows server. Which TWO hardening measures are typically recommended by CIS? (Select TWO.)

Accepted Answer

Enforce strong password policies. CIS benchmarks recommend disabling unnecessary services and enforcing password policies.

Answer

Enable all Windows features by default

Answer

Disable audit logging

Answer

Allow anonymous enumeration of SAM accounts

Question 6

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Accepted Answer

Flood. Flood (C) is an environmental threat source because it originates from natural or physical conditions outside the organization's control, such as weather or geographic location. Power outage (D) is also an environmental threat source as it stems from utility infrastructure failures or natural events, not from human or system actions. Both are classified under environmental threats in risk assessment frameworks like NIST SP 800-30.

Answer

Hardware failure

Answer

Software bug

Answer

Phishing attack

Question 7

Which TWO of the following are common weaknesses in cryptographic implementations that an SSCP should be aware of? (Select exactly 2.)

Accepted Answer

Weak random number generation. Weak random number generation is a critical flaw because cryptographic keys, nonces, and initialization vectors rely on unpredictability. If an attacker can predict or reproduce the random values (e.g., due to a low-entropy source or a flawed PRNG like a linear congruential generator), they can derive secret keys or break session security. This undermines the entire cryptographic system regardless of the algorithm strength.

Answer

Frequent rekeying

Answer

Using proven encryption algorithms like AES

Answer

Following NIST guidelines

Question 8

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

Accepted Answer

Implement automated configuration scanning in the staging environment. Configuration management includes automated scanning (e.g., SCAP) to detect deviations. Implementing such scans in the staging environment would catch deviations before production.

Answer

Increase the number of testers

Answer

Require CAB approval for all future changes

Answer

Use a different change management process

Question 9

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based test where key personnel walk through a disaster scenario without affecting live systems. It involves no actual failover, data replication, or production traffic, so the risk to operations is zero. This makes it a safe, low-cost method to validate plans and roles.

Answer

Simulation test

Answer

Parallel test

Answer

Full interruption test

Question 10

A security analyst discovers that an attacker has set up a fake wireless access point with the same SSID as the corporate network. Users are unknowingly connecting to it. What is this attack called?

Accepted Answer

Evil twin. An evil twin is a rogue AP that impersonates a legitimate SSID to capture credentials and traffic.

Answer

KRACK

Answer

Rogue AP

Answer

PMKID attack

Question 11

A security administrator needs to store sensitive customer data in a database. To protect the data at rest, which encryption method should be used?

Accepted Answer

AES-256 in CBC mode. AES-256 in CBC mode is the correct choice because it is a strong, widely accepted symmetric encryption algorithm that provides confidentiality for data at rest. AES-256 uses a 256-bit key, making it resistant to brute-force attacks, and CBC mode adds an initialization vector (IV) to ensure that identical plaintext blocks produce different ciphertext, preventing pattern leakage. This combination is recommended by standards such as NIST SP 800-38A for protecting sensitive stored data.

Answer

RSA-2048

Answer

Blowfish in CTR mode

Answer

DES in ECB mode

Question 12

In a forensic investigation, a hash of a suspect file is computed. Which of the following is the primary purpose of hashing in this context?

Accepted Answer

To verify file integrity. In forensic investigations, hashing (using algorithms like SHA-256 or MD5) produces a unique fixed-size digest of the file's contents. The primary purpose is to verify file integrity by comparing the hash before and after analysis, ensuring the evidence has not been altered. This provides a cryptographic chain of custody, as any change to the file results in a completely different hash value.

Answer

To compress the file

Answer

To decrypt the file

Answer

To identify the file owner

Question 13

A software developer wants to ensure the authenticity and integrity of an API request but does not require non-repudiation. Which cryptographic method should be used?

Accepted Answer

Hash-based message authentication code (HMAC). HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. This ensures both authenticity (the request came from a party knowing the key) and integrity (the data has not been altered) without providing non-repudiation, because the same key is shared between sender and receiver, so the receiver could also have generated the tag.

Answer

Digital signature using RSA

Answer

Symmetric encryption with CBC mode

Answer

Elliptic curve Diffie-Hellman (ECDH)

Question 14

A company is implementing a new access control system for its data center. Which physical security control is best for preventing tailgating?

Accepted Answer

Mantrap. A mantrap is specifically designed to prevent tailgating by using a small vestibule with two interlocking doors. Only one door can open at a time, and the system typically requires authentication (e.g., badge or biometric) to proceed, ensuring that only one authorized person enters per cycle. This physical barrier directly blocks unauthorized individuals from following an authorized user through a single entry point.

Answer

Biometric reader

Answer

Security guard

Answer

CCTV cameras

Question 15

Refer to the exhibit. A security analyst reviews the log and determines that the system was under a brute force attack. However, the analyst notices that the attack stopped after 5 minutes, and the IP address was not blocked. Which of the following is the MOST likely reason the attack stopped?

Accepted Answer

The SSH server's MaxAuthTries limit was exceeded.. The SSH server's MaxAuthTries limit (default 6 in OpenSSH) causes the server to terminate the connection after a threshold of failed authentication attempts. This stops the attack on that specific TCP session, but does not block the IP address, which explains why the attack ceased after 5 minutes without any persistent block.

Answer

The system's account lockout policy prevented further attempts.

Answer

The attacker achieved successful login.

Answer

The system's firewall dropped the traffic.