SSCP Practice Test 44 — 15 Questions

Question 1

An organization is migrating from on-premises servers to a cloud IaaS model. The security team must ensure that virtual machine (VM) images are hardened before deployment. Which of the following is the MOST effective control to ensure consistency and compliance with security baselines?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a golden image that is hardened and approved for use, and deploy VMs from that image. Creating a golden image that is hardened and approved for use ensures that every VM deployed from it inherits a consistent, pre-configured security baseline. This approach eliminates configuration drift and manual errors by baking security controls into the image before deployment, making it the most effective control for consistency and compliance.

Answer

Perform vulnerability scans on each VM after deployment

Answer

Apply the latest OS patches to each VM immediately after deployment

Answer

Train administrators on hardening procedures and rely on manual configuration

Question 2

Which TWO of the following are key components of an incident response plan (IRP) according to NIST SP 800-61?

Accepted Answer

Communication plan. NIST SP 800-61 (Computer Security Incident Handling Guide) explicitly identifies the communication plan and testing the plan as key components of an incident response plan. The communication plan ensures all stakeholders (internal teams, legal, PR, external partners) are notified and coordinated during an incident, while testing validates the plan's effectiveness through exercises like tabletop or functional drills.

Answer

Acquisition of forensic tools

Answer

Hardware inventory

Answer

Annual budget

Question 3

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Accepted Answer

A warm site has environmental controls (power, cooling) already in place.. A warm site is partially configured with environmental controls such as power, cooling, and network connectivity already in place. This distinguishes it from a cold site, which lacks these infrastructure components and requires significant setup time. The presence of environmental controls is a key differentiator that allows a warm site to become operational faster than a cold site, though it still requires data restoration from backups before full recovery.

Answer

A warm site is typically ready to operate within hours.

Answer

A warm site has live data replication from the primary site.

Question 4

Which THREE of the following are data loss prevention (DLP) controls that can be implemented to protect sensitive data?

Accepted Answer

Encrypt sensitive data both at rest and in transit. The correct answers are B, C, and D. Encrypting sensitive data at rest and in transit (B) directly prevents unauthorized disclosure. Deploying endpoint DLP agents (C) monitors and blocks unauthorized data transfers. Classifying data based on sensitivity and applying appropriate labels (D) enables targeted protection. Option A (strong passwords) is an authentication control, not a DLP control. Option E (network firewalls) controls traffic but does not inspect content for data loss prevention.

Answer

Require strong passwords for all user accounts

Answer

Implement network firewalls to block all outbound traffic

Question 5

A company uses AWS for critical workloads. An analyst notices unauthorized API calls from an IP address outside the company. The logs show that the attacker used stolen access keys belonging to an IAM user with administrative privileges. The incident response team must contain the breach as quickly as possible. The analyst has access to the AWS Management Console and can use the CLI. The team is following the incident response plan. Which action should be taken FIRST to prevent further unauthorized actions?

Accepted Answer

Disable the compromised access keys using the IAM dashboard or CLI.. The immediate priority in an access key compromise is to invalidate the stolen credentials to stop the attacker from making further API calls. Disabling the compromised access keys via the IAM dashboard or CLI (using `aws iam update-access-key --status Inactive`) is the fastest containment action that directly revokes the attacker's authentication token without disrupting other legitimate users or services.

Answer

Create a new security group to block the attacker's source IP at the network level.

Answer

Delete the compromised IAM user immediately.

Answer

Rotate all IAM user access keys across the entire AWS account.

Question 6

During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?

Accepted Answer

Just-in-time (JIT) provisioning of the service account. Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively. The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.

Answer

Password vaulting with automatic rotation

Answer

Requiring multi-factor authentication for the service account

Answer

Session recording and monitoring

Question 7

A security analyst is reviewing the configuration of an enterprise wireless network. Which TWO of the following are best practices for securing the wireless network against unauthorized access and eavesdropping?

Accepted Answer

Configure a dedicated guest network on a separate VLAN. WPA2-Enterprise with RADIUS provides strong per-user authentication and encryption, mitigating unauthorized access. Placing guest traffic on a separate VLAN segments network traffic and reduces exposure of internal resources. WPA2-PSK with a complex passphrase is acceptable for small networks but not enterprise-grade. Disabling SSID broadcast is not a security control as it can be easily discovered. WPS is known to have severe vulnerabilities and should be disabled.

Answer

Activate WPS for simplified client setup

Answer

Enable WPA2-PSK with a complex passphrase

Answer

Disable SSID broadcast to hide the network

Question 8

A security analyst is investigating a potential data exfiltration incident. The logs show a large number of outbound DNS queries to a domain that resolves to an IP address in a foreign country. The queries contain encoded strings in the subdomain. Which type of attack is MOST likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses to bypass network security controls. The large volume of outbound queries to a foreign IP, combined with encoded subdomain strings, is the classic signature of data exfiltration via DNS tunneling, as the protocol is often allowed through firewalls.

Answer

DNS poisoning

Answer

DNS amplification attack

Answer

DNS rebinding

Question 9

An organization is designing a secure email system using S/MIME. Which of the following are essential components of the PKI that must be in place? (Select THREE)

Accepted Answer

X.509 digital certificates for each user. S/MIME relies on a PKI where each user possesses an X.509 digital certificate that binds their identity to a public key. This certificate is essential for signing and encrypting emails, as it allows recipients to verify the sender's identity and encrypt messages using the sender's public key.

Answer

A symmetric key distribution center (KDC)

Answer

A timestamp authority (TSA)

Question 10

Which TWO of the following are key components of the risk identification process?

Accepted Answer

Identifying assets and their value. Identifying assets and their value is a foundational step in the risk identification process. Without knowing what assets exist and their relative importance, you cannot determine which threats and vulnerabilities pose the greatest risk. This step ensures that risk assessment efforts are focused on the most critical resources.

Answer

Prioritizing risks based on impact

Answer

Selecting risk treatment options

Answer

Calculating the annualized loss expectancy

Question 11

A company wants to implement a security baseline for its Windows servers. Which of the following frameworks is most commonly used for this purpose?

Accepted Answer

CIS Benchmarks. CIS Benchmarks are widely adopted security configuration guidelines for various systems, including Windows servers. They provide Level 1 (basic) and Level 2 (defense-in-depth) recommendations.

Answer

ISO 27001

Answer

ITIL

Answer

COBIT

Question 12

A financial institution uses a risk management framework based on ISO 31000. During a quarterly risk review, the risk manager identifies that the residual risk for a critical trading application remains high despite multiple controls. The application's risk score has not decreased after implementing two-factor authentication and encryption. The risk appetite statement says 'no high residual risk for systems processing transactions over $10M.' What should the risk manager do next?

Accepted Answer

Escalate to senior management for a decision on additional controls or risk acceptance.. When residual risk exceeds the organization's risk appetite, standard risk management frameworks (like ISO 31000) require escalation to senior management to decide on additional controls or formal risk acceptance. Option A is incorrect because disabling non-essential features may not sufficiently reduce the risk to within appetite and could harm business operations. Option B is incorrect because cyber insurance transfers financial loss but does not reduce the residual risk itself; the risk appetite statement addresses residual risk, not just financial impact. Option D is incorrect because the risk appetite explicitly prohibits high residual risk for this system, so acceptance would violate policy.

Answer

Reduce the risk by disabling non-essential features of the application.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Accept the risk because controls are already in place.

Question 13

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Accepted Answer

The vulnerability is a false positive. False positives are common; the scanner may incorrectly flag the vulnerability even after patching.

Answer

The patch was not applied correctly

Answer

The remediation SLA was not met

Answer

The server was not rebooted after patching

Question 14

Which type of disaster recovery test involves running the DR systems alongside the production systems to validate functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery systems concurrently with the production systems to verify that the DR environment can handle the workload without disrupting live operations. This approach validates data replication, application functionality, and failover readiness while keeping production untouched, making it the correct choice for non-disruptive validation.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop exercise

Question 15

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

Accepted Answer

Incident count. The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Answer

Patch compliance

Answer

Training completion

Answer

Mean time to detect (MTTD)