SSCP Practice Test 45 — 15 Questions

Question 1

An organization has suffered a sophisticated attack where the attacker compromised a domain controller and used it to move laterally to several file servers. The incident response team has isolated the domain controller and some file servers, but they suspect that the attacker may have created hidden accounts and modified permissions to maintain access. The team needs to ensure that the attacker's access is entirely removed before restoring operations. The organization has a large number of users and complex Active Directory structure. The incident response plan outlines containment, eradication, recovery, and post-incident analysis. The team has forensic imaging of the domain controller and file servers. What is the MOST comprehensive approach to eradicate the attacker's presence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a forensic analysis of the domain controller to identify all backdoors, hidden accounts, and unauthorized permission changes.. The most comprehensive approach to eradicate an attacker's presence after a domain controller compromise is to perform a forensic analysis of the domain controller. This analysis can identify all backdoors, hidden accounts (e.g., accounts with the 'ACCOUNTDISABLE' flag removed or created via 'net user' with hidden attributes), unauthorized permission changes (e.g., modified ACLs on AD objects), and other persistence mechanisms like scheduled tasks or service principal name (SPN) modifications. Without this deep analysis, the attacker's access may persist even after password resets or server rebuilds.

Answer

Reset all domain user passwords and force a password change at next logon.

Answer

Use a tool to scan for hidden accounts and reset permissions on all file servers.

Answer

Rebuild the domain controller from a known good backup and reset all service account passwords.

Question 2

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and taking no further action beyond existing controls. Compensating controls do not eliminate the risk; they reduce it to an acceptable level, which is still acceptance.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 3

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Accepted Answer

High probability and high impact. In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.

Answer

Low probability and low impact

Answer

High probability and low impact

Answer

Low probability and high impact

Question 4

A security engineer is hardening a Windows workstation. Which TWO configurations reduce the attack surface by limiting execution of unauthorized code? (Select TWO.)

Accepted Answer

Configure AppLocker rules. AppLocker whitelists allowed applications; Windows Defender Application Control blocks unsigned drivers and applications.

Answer

Enable Windows Firewall with Advanced Security

Answer

Enable BitLocker full-disk encryption

Answer

Disable AutoPlay

Question 5

A healthcare organization uses an electronic health records (EHR) system that stores patient data in a relational database. The system is accessed by doctors and nurses via tablet devices on a wireless network. The security team has detected that some patient records were accessed outside of normal business hours from an IP address not belonging to the organization. The database logs show that the queries originated from the application server. The application logs indicate that the access was performed using a legitimate user account that had been disabled due to employee departure two weeks earlier. Which of the following is the most effective step to prevent recurrence?

Accepted Answer

Implement a process to disable user accounts within one hour of employee termination.. The most effective step to prevent recurrence is option C: implement a process to disable user accounts within one hour of employee termination. The root cause was that the former employee's account remained active, allowing unauthorized access. Option A (MFA for remote access) is not preventive because the access used a legitimate account and MFA does not prevent use of an active enabled account; also, the access may have been from within the network. Option B (audit logging) is detective, not preventive. Option D (network segregation) does not address the account being active. Therefore, prompt account disabling is the most effective preventive measure.

Answer

Require multi-factor authentication for all remote access.

Answer

Enable audit logging on all database transactions.

Answer

Segregate the wireless network from the internal network.

Question 6

A company uses a hub-and-spoke VPN topology with a central site and multiple branch offices. The central site's firewall is being upgraded. Which technology can provide link redundancy with automatic failover for the VPN connections?

Accepted Answer

BGP. BGP is correct because it supports dynamic routing and can be configured with multiple paths to provide automatic failover for VPN connections in a hub-and-spoke topology. When the central site's firewall is upgraded, BGP can reroute traffic through alternate paths without manual intervention, ensuring link redundancy. This is achieved through BGP's path selection algorithm and the ability to advertise multiple routes via different VPN tunnels.

Answer

STP

Answer

VRRP

Answer

OSPF

Question 7

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

Accepted Answer

WPA2-PSK with AES (CCMP). WPA2-PSK with AES (CCMP) is correct because it provides the highest security level compatible with legacy devices that only support WPA2-PSK. AES-CCMP is the mandatory encryption protocol for WPA2, offering strong data confidentiality and integrity, whereas TKIP is deprecated due to known vulnerabilities. This configuration avoids the need for a RADIUS server (required by WPA2-Enterprise) and does not force an upgrade to WPA3, which legacy devices cannot support.

Answer

WPA2-Enterprise with RADIUS

Answer

WPA3-SAE only

Answer

WPA2-PSK with TKIP

Question 8

Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?

Accepted Answer

Capture a RAM dump using a tool like Magnet RAM Capture or WinPmem. Volatile evidence is collected starting with the most volatile (memory) to preserve data that can be lost when the system is powered down. RAM dump must be done first.

Answer

Disconnect the system from the network

Answer

Run antivirus scans to identify malware

Answer

Create a forensic image of the hard drive

Question 9

During the containment phase of incident response, a security analyst identifies malware on a critical server. Which TWO actions should be taken FIRST to contain the threat and preserve evidence? (Choose two.)

Accepted Answer

Disconnect the network cable from the server.. The immediate priority is to isolate the affected server from the network to prevent lateral movement and to capture volatile evidence (RAM) before it is lost. Disconnecting the network cable stops network-level spread, and capturing RAM preserves critical volatile data for forensic analysis.

Answer

Capture a forensic image of the hard drive.

Answer

Reboot the server to clear the malware from memory.

Answer

Run a full antivirus scan on the server.

Question 10

A security analyst receives an alert from the EDR system indicating that a workstation has been communicating with a known malicious IP address. The analyst confirms the alert and notes that the user is still logged in. Which immediate containment action should the analyst take FIRST?

Accepted Answer

Isolate the workstation using the EDR agent's network isolation capability. The first priority is to contain the incident by isolating the endpoint to prevent further communication. EDR agents often have a feature to isolate the host from the network immediately.

Answer

Create a full forensic image of the hard drive

Answer

Disable the user's Active Directory account

Answer

Block the malicious IP address at the firewall

Question 11

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The root CA is not trusted. The error 'The root CA is not trusted' occurs because the client device does not have the root CA certificate installed in its trusted root store. When a server presents a certificate chain, the client must be able to validate the chain up to a trusted root CA; if the root CA is missing or not trusted, the certificate chain is considered invalid, and the connection is rejected.

Answer

The certificate has been revoked

Answer

The certificate is expired

Answer

The certificate uses weak encryption

Question 12

Refer to the exhibit. User bob, a member of the projectdev group, attempts to create a new file in /data/project but gets 'Permission denied'. What is the most likely reason?

Accepted Answer

The group permission (r-x) and the mask (rwx) combine to limit bob to read and execute only. The directory /data/project has group permissions set to r-x (read and execute) for the projectdev group, and the umask is set to rwx (000), meaning no bits are masked. However, the group permission explicitly denies write access. Since bob is a member of projectdev, his effective permissions are limited to read and execute, preventing file creation.

Answer

Bob is not the owner of the directory

Answer

Bob's effective permissions are limited by the user:alice entry

Answer

The 'other' permission is '---', blocking all access for users not in the file's user or group

Question 13

A security analyst is evaluating the cryptographic settings for a new application that requires both confidentiality and integrity for data in transit. The analyst needs to choose a symmetric cipher that provides authenticated encryption. Which of the following is the best choice?

Accepted Answer

AES in GCM mode. AES in GCM mode provides both encryption and authentication, making it the preferred choice for authenticated encryption. ECB lacks diffusion and is insecure, CBC provides only encryption, and RC4 is a broken stream cipher.

Answer

RC4 stream cipher

Answer

AES in ECB mode

Answer

AES in CBC mode

Question 14

In X.509 certificate format, which field is used to specify the fully qualified domain name(s) for which the certificate is valid?

Accepted Answer

Subject Alternative Name. The Subject Alternative Name (SAN) extension allows specifying multiple hostnames.

Answer

Key Usage

Answer

Issuer

Answer

Subject

Question 15

A PKI administrator needs to check the revocation status of a digital certificate without requiring the client to download the entire CRL. Which method is designed for online, real-time certificate status checking?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) allows real-time checking of a certificate's revocation status without downloading the full CRL.

Answer

OCSP stapling

Answer

CRL

Answer

Certificate transparency