SSCP Practice Test 46 — 15 Questions

Question 1

A company is upgrading its legacy systems to use modern cryptographic standards. Which two of the following algorithms should be avoided due to known weaknesses or deprecation?

Accepted Answer

MD5 for hashing. MD5 and 3DES are considered weak: MD5 has collision vulnerabilities, and 3DES is deprecated due to small block size and performance issues. SHA-256, AES-256, and ECDH are modern and secure.

Answer

SHA-256 for hashing

Answer

AES-256 for encryption

Answer

ECDH for key exchange

Question 2

Refer to the exhibit. What is the purpose of the 'group 14' parameter in the IKEv2 proposal?

Accepted Answer

Sets the Diffie-Hellman group for key exchange. In IKEv2 proposals, the 'group 14' parameter specifies the Diffie-Hellman (DH) group used for the key exchange process. DH group 14 corresponds to a 2048-bit modular exponentiation group, which provides the cryptographic strength for establishing a shared secret over an insecure channel. This is distinct from encryption, integrity, or authentication parameters.

Answer

Defines the integrity checking method

Answer

Specifies the encryption algorithm

Answer

Indicates the authentication method

Question 3

Which TWO of the following are considered secure cryptographic hash functions as of current standards? (Select TWO.)

Accepted Answer

SHA-3. SHA-256 and SHA-3 are currently secure. MD5 and SHA-1 are broken or deprecated.

Answer

RC4

Answer

SHA-1

Answer

MD5

Question 4

A company is selecting a cryptographic algorithm for digital signatures. Which THREE of the following algorithms can be used for digital signatures? (Select THREE.)

Accepted Answer

DSA. RSA, ECDSA, and DSA are all capable of digital signatures. AES is symmetric and not for signatures; SHA-256 is a hash function.

Answer

SHA-256

Answer

AES

Question 5

Which protocol is used to securely transfer files between a client and server, typically over TCP port 22?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted file transfer capabilities via SCP or SFTP, using port 22.

Answer

SMTP

Answer

TFTP

Answer

FTP

Question 6

A security professional is designing a key management system and needs to ensure that keys are generated using a truly random source. Which of the following is the most appropriate method for generating cryptographic keys?

Accepted Answer

Hardware random number generator. Hardware random number generators (HRNGs) provide true randomness, while CSPRNGs are deterministic. For key generation, a hardware RNG is best.

Answer

Cryptographically secure PRNG seeded with a static password

Answer

Pseudorandom number generator (PRNG) seeded with current timestamp

Answer

User-memorized passphrase

Question 7

An organization is implementing a digital signature solution to ensure non-repudiation and integrity of documents. Which three of the following are true regarding digital signatures?

Accepted Answer

The receiver verifies the signature using the sender's public key.. Digital signatures involve signing the hash of the message with the sender's private key. They provide non-repudiation because only the sender has the private key. Verification uses the sender's public key.

Answer

The receiver uses the sender's private key to verify the signature.

Answer

The sender encrypts the entire document with their public key to create a signature.

Question 8

A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?

Accepted Answer

Isolate the affected system from the network.. The immediate priority in a suspected data exfiltration incident is to contain the threat and prevent further data loss. Isolating the affected system from the network stops ongoing communication with the external IP address, preserving the system state for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Notify senior management of the incident.

Answer

Block the external IP address at the firewall.

Answer

Analyze the data transfer logs to determine the scope.

Question 9

A network administrator is unable to ping the server at 10.2.2.100 from a host on the 192.168.1.0/24 network. Based on the exhibit, what is the most likely cause?

Accepted Answer

The OSPF neighbor relationship may be unstable, causing intermittent route flapping.. The exhibit shows that the host on 192.168.1.0/24 cannot reach 10.2.2.100, but the routing table includes both a static route to 10.3.3.0 and an OSPF route to 10.2.2.0. Option D is correct because the symptom of intermittent reachability (sometimes ping works, sometimes not) combined with a known OSPF neighbor relationship points to route flapping, where the OSPF route for 10.2.2.0 is repeatedly added and removed due to an unstable neighbor adjacency, causing the ping to fail when the route is absent.

Answer

The static route to 10.3.3.0 is misconfigured.

Answer

The gateway of last resort is missing.

Answer

The OSPF route for 10.2.2.0 is not in the routing table.

Question 10

A company's vulnerability scanner reports a critical vulnerability in a third-party library. The remediation SLA for critical vulnerabilities is 48 hours. However, the patch is not yet available from the vendor. Which of the following is the most appropriate immediate action?

Accepted Answer

Implement compensating controls to mitigate the vulnerability. When a patch is unavailable, implementing compensating controls (e.g., network segmentation, WAF rules, disabling unused features) is the immediate action to reduce risk exposure while awaiting an official fix. This aligns with the NIST SP 800-40 risk mitigation framework, which prioritizes compensating controls when patching is not feasible. Simply removing the software (A) may break business operations, extending the SLA (B) violates policy, and accepting risk (C) ignores the need for active mitigation.

Answer

Remove the vulnerable software immediately

Answer

Extend the SLA to 30 days

Answer

Accept the risk because the vendor has not released a patch

Question 11

In IPsec VPNs, which protocol provides authentication and encryption of the entire IP packet, including the IP header, in tunnel mode?

Accepted Answer

ESP. ESP (Encapsulating Security Payload) in tunnel mode encrypts and authenticates the entire original IP packet, adding a new IP header. AH (Authentication Header) does not provide encryption.

Answer

L2TP

Answer

IKE

Answer

AH

Question 12

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests with the victim's spoofed source IP to the broadcast address, causing all hosts to reply to the victim, amplifying traffic.

Answer

Ping of death

Answer

SYN flood

Answer

DNS amplification

Question 13

A security administrator is configuring a VPN between two branch offices. The requirement is to encrypt the entire original IP packet and add a new IP header for routing over the internet. Which IPsec mode should be used?

Accepted Answer

Tunnel mode. In tunnel mode, the entire original IP packet is encapsulated and encrypted, with a new IP header added, suitable for site-to-site VPNs.

Answer

Aggressive mode

Answer

Transport mode

Answer

Main mode

Question 14

Which protocol and port combination is commonly used for secure remote administration of a server?

Accepted Answer

SSH on TCP 22. SSH operates on TCP port 22 and provides encrypted remote administration, while Telnet (port 23) is unencrypted. HTTPS (443) is for web traffic, and RDP (3389) is for remote desktop but not primarily for command-line administration.

Answer

HTTPS on TCP 443

Answer

Telnet on TCP 23

Answer

RDP on TCP 3389

Question 15

A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?

Accepted Answer

Stateful firewall. Stateful firewalls maintain a state table and track the state of connections, allowing them to make more intelligent filtering decisions compared to stateless packet filters.

Answer

Stateless packet filter

Answer

Application proxy firewall

Answer

Next-generation firewall