SSCP Practice Test 46 — 15 Questions

Question 1

In an OAuth 2.0 authorization flow, a client application receives an access token. This token is used to:

Accepted Answer

Authorize access to protected resources at the resource server. In OAuth 2.0, an access token is a credential that grants the client application delegated authorization to access specific protected resources on the resource server on behalf of the resource owner. It is presented to the resource server (typically as a Bearer token in the Authorization header) to prove the client has been authorized. The token does not authenticate the user to the authorization server, nor does it encrypt data — it authorizes API access.

Answer

Encrypt data between client and resource server

Answer

Identify the user across different applications

Answer

Authenticate the user to the authorization server

Question 2

Refer to the exhibit. An organization's incident response policy defines these actions. In what sequence should these phases be applied?

Accepted Answer

Isolate, reimage, restore from backup. The correct sequence is Isolate, reimage, restore from backup because containment (isolation) must occur first to prevent the incident from spreading, followed by eradication (reimaging) to remove the threat, and finally recovery (restoring from backup) to return the system to a known good state. This aligns with the NIST SP 800-61 incident response lifecycle, where containment, eradication, and recovery are performed in that order.

Answer

Reimage, isolate, restore

Answer

Restore, isolate, reimage

Answer

Isolate, restore, reimage

Question 3

An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?

Accepted Answer

Administrative control. This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.

Answer

Detective control

Answer

Technical control

Answer

Physical control

Question 4

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

Accepted Answer

Ticket-Granting Ticket (TGT). The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Answer

Session key

Answer

Service ticket

Answer

Authentication Server (AS) reply

Question 5

Which of the following best describes the purpose of a Hardware Security Module (HSM) in key management?

Accepted Answer

To store cryptographic keys in a secure, tamper-resistant environment. A Hardware Security Module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. By keeping keys within the HSM's physical and logical boundaries, it prevents unauthorized extraction even if the host system is compromised, which is the core purpose of an HSM in key management.

Answer

To replace public key infrastructure (PKI)

Answer

To accelerate network traffic encryption

Answer

To generate random numbers for non-cryptographic use

Question 6

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Accepted Answer

Ensure all data transmissions use TLS 1.2 or higher.. TLS 1.2 or higher is the standard protocol for encrypting data in transit over public networks, ensuring confidentiality and integrity between client and server. It is the most critical control because it directly protects data as it moves across the internet to the cloud, which is the primary risk in a migration scenario.

Answer

Enable server-side encryption for cloud storage.

Answer

Implement data classification labels.

Answer

Use IPsec VPNs for all cloud connections.

Question 7

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Accepted Answer

User behavior risk indicator. The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Answer

Technical vulnerability indicator

Answer

Error log indicator

Answer

Configuration drift indicator

Question 8

In a PKI, what is the role of the root Certificate Authority (CA)?

Accepted Answer

To be the trust anchor for the entire PKI hierarchy. The root Certificate Authority (CA) is the trust anchor in a Public Key Infrastructure (PKI) hierarchy. Its self-signed root certificate is the ultimate trust point from which all subordinate CA certificates and end-entity certificates derive their trust. Without a trusted root, the entire chain of trust collapses, as no certificate can be validated back to a trusted source.

Answer

To issue certificates directly to end users

Answer

To generate private keys for all users

Answer

To revoke certificates and publish CRLs

Question 9

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). The false rejection rate (FRR) is the metric that directly measures the proportion of legitimate users incorrectly rejected by a biometric system. A high number of false rejections is by definition a high FRR, so FRR is the metric most directly related to the reported issue. The other options describe different accuracy metrics or crossover points.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 10

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Accepted Answer

CVEs. C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Answer

Configuration weaknesses

Answer

Hardware failure

Answer

Design flaws

Question 11

An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?

Accepted Answer

License type and number of licenses. Option A (License type and number of licenses) is correct because software inventory management must track licensing entitlements—such as perpetual, subscription, or concurrent-user licenses and the quantity purchased—to ensure license compliance, avoid over-deployment penalties, and support audits. Option C (Version and patch level) is correct because knowing the exact version and patch level of each installed application is essential for vulnerability management, patch remediation, and confirming supportability. Option B is not a standard inventory attribute for software assets; physical location is typically tracked for hardware assets, not installed software. Option D is unnecessary because installation media serial numbers are not meaningful inventory data for deployed software. Option E is not required for inventory purposes; the installing user does not determine licensing, versioning, or compliance status.

Answer

Physical location of the installed software

Answer

Serial number of the installation media

Answer

Name of the user who installed it

Question 12

A security analyst is configuring a SIEM to detect potential data exfiltration. Which TWO log sources are most critical for detecting large outbound data transfers?

Accepted Answer

Network flow logs (e.g., NetFlow). Network flow logs (Option A) are critical because NetFlow/IPFIX records capture byte and packet counts per flow, letting the SIEM baseline normal egress volumes and alert on anomalously large outbound transfers to external IPs. Proxy logs (Option C) are equally critical because they record HTTP/HTTPS requests with URLs, destination hosts, and often response/request sizes, exposing web-based exfiltration such as large uploads to cloud storage or file-sharing sites. Together these two sources give both volumetric (flow) and content-context (proxy) visibility into outbound data movement. DNS logs (B) mainly reveal tunneling or beaconing via query patterns and payload sizes, not bulk data transfer volumes. System event logs (D) and application error logs (E) are host-local and generally lack the outbound network volume and destination detail needed to detect large data exfiltration.

Answer

DNS logs

Answer

System event logs

Answer

Application error logs

Question 13

A security analyst is investigating a phishing incident that led to credential theft. Which TWO actions are appropriate during the containment phase? (Select TWO)

Accepted Answer

Reset the compromised user's password. Option A is correct because resetting the compromised user's password immediately invalidates the stolen credentials, preventing the attacker from continuing to use the phished account during containment. Option E is correct because blocking the phishing domain at the email gateway stops further phishing emails from that domain reaching other users, limiting the spread of the incident. Option B is not a containment action; updating the incident response plan is a post-incident improvement activity. Option C is also post-incident, as lessons learned meetings occur after eradication and recovery to improve future response. Option D is a recovery action, since restoring from backup is used to return systems to normal operation after the threat is contained and removed.

Answer

Update the incident response plan

Answer

Conduct a lessons learned meeting

Answer

Restore the user's machine from backup

Question 14

A company is deploying a VPN for remote employees. They require strong encryption and authentication, and the solution must be compatible with native OS clients without additional software. Which VPN protocol is most appropriate?

Accepted Answer

IPsec with IKEv2. IPsec with IKEv2 is a modern VPN protocol that provides strong encryption and authentication, and it is natively supported by most operating systems (Windows, macOS, iOS, Android) without requiring additional client software. It supports flexible authentication methods including certificates and EAP, making it suitable for remote access.

Answer

PPTP

Answer

SSL VPN with proprietary client

Answer

L2TP/IPsec with pre-shared keys

Question 15

Which TWO of the following are common techniques used in quantitative risk analysis?

Accepted Answer

Exposure Factor (EF). Options A and B are correct because quantitative risk analysis relies on numeric monetary values: the Exposure Factor (EF) is the percentage of an asset's value that would be lost in a given incident, and the Asset Value (AV) is the monetary worth of the asset, both of which feed the Single Loss Expectancy (SLE = AV × EF) and Annualized Loss Expectancy (ALE = SLE × ARO) calculations. These are core measurable inputs that make the analysis truly quantitative. Options C, D, and E do not belong: a High/Medium/Low risk rating is qualitative, the probability and impact matrix is a qualitative technique that maps likelihood against consequence, and the Delphi technique is a qualitative expert-consensus method for estimating risk.

Answer

Risk rating (High/Medium/Low)

Answer

Probability and impact matrix

Answer

Delphi technique