SSCP Practice Test 47 — 15 Questions

Question 1

A security engineer is designing a network segmentation strategy to isolate a DMZ containing public-facing web servers from the internal corporate network. Which TWO controls should be implemented? (Select two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Separate VLANs for DMZ and internal networks. A firewall with rules restricting traffic between DMZ and internal networks, and separate VLANs for DMZ and internal networks, are key segmentation controls. IDS/IPS are detection, not segmentation. NAC controls access, not segmentation. DMZ subnet is a concept, not a control.

Answer

Network Access Control (NAC) on all endpoints

Answer

A separate IP subnet for the DMZ

Answer

An intrusion detection system (IDS) monitoring traffic between segments

Question 2

Which wireless security standard replaces WPA2 and mandates Protected Management Frames (PMF) to prevent certain types of attacks?

Accepted Answer

WPA3. WPA3 mandates PMF, making it resistant to offline dictionary attacks and key recovery attacks like KRACK.

Answer

802.1X

Answer

WEP

Answer

WPA2

Question 3

A network administrator wants to block all inbound traffic except for web and email services. Which firewall rule configuration would achieve this?

Accepted Answer

Default-deny with allow rules for HTTP, HTTPS, and SMTP. A default-deny rule blocks all traffic by default, and then explicit allow rules for specific services (HTTP, HTTPS, SMTP) permit desired inbound traffic.

Answer

Stateful inspection without default policy

Answer

Stateless packet filtering with a rule per service

Answer

Default-allow with deny rules for unwanted services

Question 4

A company is deploying a VPN for remote employees. They require strong encryption and authentication, and the solution must be compatible with native OS clients without additional software. Which VPN protocol is most appropriate?

Accepted Answer

IPsec with IKEv2. IKEv2 with IPsec is widely supported natively on major operating systems, provides strong security, and is suitable for remote access VPNs.

Answer

PPTP

Answer

SSL VPN with proprietary client

Answer

L2TP/IPsec with pre-shared keys

Question 5

Which of the following is a common defense against ARP spoofing attacks on a local area network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets against a trusted database (DHCP snooping binding), preventing spoofed ARP messages.

Answer

DHCP snooping

Answer

Port security

Answer

MAC filtering

Question 6

An organization wants to deploy a firewall that can inspect the payload of application-layer protocols such as HTTP and FTP, and make access decisions based on application data. Which type of firewall best meets this requirement?

Accepted Answer

Application proxy firewall. An application proxy firewall (or application-layer gateway) performs deep inspection of application payloads, unlike stateless or stateful packet filters.

Answer

Stateless packet filter

Answer

Next-generation firewall

Answer

Stateful packet filter

Question 7

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing involves sending forged ARP replies to associate the attacker's MAC with the victim's IP, enabling man-in-the-middle attacks at Layer 2.

Answer

SYN flood

Answer

DNS poisoning

Answer

DHCP starvation

Question 8

Which protocol is used to securely transfer files over a network and operates on TCP port 22?

Accepted Answer

SSH. SSH (Secure Shell) is used for secure remote login and file transfer, and it operates on TCP port 22. FTP uses ports 20-21, Telnet uses port 23, and SFTP (which runs over SSH) also uses port 22.

Answer

Telnet

Answer

SFTP

Answer

FTP

Question 9

A security analyst is investigating a network incident. Which TWO of the following are indicators of a man-in-the-middle attack using ARP spoofing? (Select TWO)

Accepted Answer

An ARP entry for the default gateway points to an unknown MAC address.. Duplicate MAC addresses for the same IP (since attacker claims the IP) and an entry matching the attacker's MAC with the gateway IP indicate ARP spoofing.

Answer

High number of TCP retransmissions from a single host.

Answer

The switch's CAM table has multiple MAC entries on the same port.

Answer

Multiple IP addresses resolve to the same MAC address in the ARP cache.

Question 10

Which UDP port is used by the Simple Network Management Protocol (SNMP) for receiving traps?

Accepted Answer

UDP 162. SNMP traps are sent from agents to managers on UDP port 162, while SNMP queries typically use port 161.

Answer

UDP 161

Answer

UDP 123

Answer

UDP 514

Question 11

An organization is planning to deploy a remote access VPN for employees. The solution must support strong encryption, mutual authentication, and work through firewalls without requiring additional ports. Which technology is most suitable?

Accepted Answer

SSL/TLS VPN. SSL/TLS VPNs (e.g., Cisco AnyConnect) operate over port 443 (HTTPS), which is commonly allowed through firewalls, and provide strong encryption and authentication.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec tunnel mode

Question 12

What does this log entry most likely indicate?

Accepted Answer

An attacker is attempting to gain access by guessing usernames. The log shows a failed SSH authentication for an 'invalid user' (i.e., a username that does not exist on the system). This is typical of a brute-force or reconnaissance attack where the attacker tries common usernames. Option C correctly identifies this as an attacker attempting to guess usernames. Option A is incorrect because the log does not indicate misconfiguration. Option B is incorrect because it is not a mistyped password for a valid user; the user does not exist. Option D is incorrect because the user 'admin' does not exist, not just disabled.

Answer

The SSH service is misconfigured

Answer

A user mistyped their password

Answer

The user account 'admin' has been disabled

Question 13

During a security audit, a penetration tester successfully extracts the PMKID from a wireless beacon. What information can be derived from this attack?

Accepted Answer

The ability to crack the passphrase offline. The PMKID attack allows offline brute-forcing of the WPA2-PSK passphrase by computing the PMKID locally and comparing it to the captured value.

Answer

The PMK (pairwise master key) directly

Answer

The encryption keys used in the session

Answer

The PSK (pre-shared key) directly

Question 14

Which of the following network protocols operates on TCP port 22 and provides secure remote administration of network devices?

Accepted Answer

SSH. SSH (Secure Shell) uses TCP port 22 for encrypted remote administration, replacing insecure Telnet.

Answer

Telnet

Answer

RDP

Answer

FTP

Question 15

Which term describes the risk that remains after implementing risk mitigation controls?

Accepted Answer

Residual risk. Residual risk is the risk that remains after all risk mitigation controls have been applied. It represents the portion of the original risk that cannot be eliminated or reduced further, and it must be accepted by management if it falls within the organization's risk appetite.

Answer

Accepted risk

Answer

Inherent risk

Answer

Control risk