SSCP Practice Test 48 — 15 Questions

Question 1

After implementing a new IDS, the security team receives numerous alerts about legitimate traffic being flagged as malicious. This phenomenon is known as:

Accepted Answer

False positives. A false positive occurs when the IDS incorrectly classifies legitimate traffic as malicious, generating an alert for benign activity. This is a common issue after deploying a new IDS with default or overly sensitive signature sets, leading to alert fatigue. The core reasoning is that the IDS's detection logic (e.g., pattern matching or anomaly thresholds) misidentifies normal behavior as an attack.

Answer

Noise

Answer

False negatives

Answer

True positives

Question 2

A company implements a DMZ to host public services. Which of the following is the best practice for securing the DMZ?

Accepted Answer

Use separate firewall rules for inbound and outbound traffic. DMZ security relies on strict separation of inbound and outbound traffic rules. Inbound rules should permit only necessary traffic (e.g., HTTP/HTTPS to web servers) from the internet to the DMZ, while outbound rules should restrict DMZ-initiated connections to the internal network, typically allowing only established sessions or specific protocols. This prevents an attacker who compromises a DMZ host from using it as a pivot to access internal resources.

Answer

Allow all traffic from the internet to the DMZ

Answer

Disable logging on DMZ firewalls

Answer

Place the DMZ behind the internal firewall

Answer

Use the same subnet for DMZ and internal network

Question 3

A security analyst detects a workstation communicating with a known command-and-control server. The workstation is running critical applications. What should be the analyst's first step according to the NIST incident response lifecycle?

Accepted Answer

Isolate the workstation from the network while preserving volatile data.. According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Answer

Power off the workstation immediately to stop the communication.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify management and wait for instructions.

Question 4

Which TWO of the following are key components of a data classification policy? (Select the two best answers.)

Accepted Answer

Classification labels. A data classification policy must define the classification labels (e.g., Public, Internal, Confidential, Restricted) that are applied to data so that handling requirements can be tied to each level, making option C correct. It must also assign data custodian responsibilities, since custodians are the roles accountable for implementing the handling, storage, and protection controls mandated for each classification level, making option D correct. Encryption algorithm selection (A) is a technical control chosen during implementation, not a defining component of the classification policy itself. Firewall rules (B) are network security controls unrelated to how data is categorized. Backup schedules (E) are operational procedures typically documented in a backup or business continuity policy, not in the data classification policy.

Answer

Encryption algorithm selection

Answer

Firewall rules

Answer

Backup schedules

Question 5

A security analyst reviews a firewall log showing an internal IP attempting outbound connections to multiple external IPs on port 443. The analyst suspects command and control. Which additional data source would be MOST useful for confirmation?

Accepted Answer

DNS logs. DNS logs are the most useful additional data source because C2 traffic often uses domain generation algorithms (DGAs) or connects to known malicious domains. By correlating the outbound connections on port 443 with DNS queries, the analyst can identify suspicious domain lookups that precede the connections, revealing the C2 infrastructure. Unlike NetFlow or system logs, DNS logs directly show the domain names being resolved, which is a key indicator of C2 activity.

Answer

NetFlow data

Answer

System event logs

Answer

Antivirus logs

Question 6

During a vulnerability scan, a tool reports a critical vulnerability on a web server. The system owner claims it is a false positive because the server is not accessible from the internet. However, the server is accessible from the internal network. What is the best course of action?

Accepted Answer

Verify the vulnerability manually and if confirmed, remediate according to internal risk. A vulnerability that is exploitable from the internal network still poses a significant risk, as internal threats (e.g., compromised endpoints, malicious insiders) can leverage it. The system owner’s claim that the server is not internet-facing does not negate the need for verification and remediation; internal attack surfaces must be managed according to the organization’s risk appetite. Manual verification ensures the scanner’s report is accurate, and if confirmed, remediation should follow internal risk-based prioritization.

Answer

Accept the risk and close the finding

Answer

Ignore the finding as the vulnerability scanner is known for false positives

Answer

Remove the server from the network to eliminate the risk

Question 7

A company is migrating to a cloud-based SaaS application and wants to implement federated identity. Users will authenticate using their existing corporate Active Directory credentials. Which THREE components are essential for a SAML-based federation? (Select THREE.)

Accepted Answer

Identity Provider (IdP). In a SAML-based federation, the Identity Provider (IdP) is essential because it is the entity that authenticates users against the corporate Active Directory and issues signed SAML assertions containing authentication and attribute statements (Option A). The Service Provider (SP) is equally essential as the SaaS application that consumes those SAML assertions to grant access, making it the relying party in the federation (Option E). A trust relationship between the IdP and SP is also required, since the SP must trust the IdP's signing certificate and the two parties exchange metadata (entityID, ACS URL, SSO URL, X.509 certificate) to validate assertions and establish the federation (Option B). Option C is incorrect because a Ticket Granting Ticket is a Kerberos construct issued by a Key Distribution Center, not a SAML federation component. Option D is incorrect because an Attribute Authority is a separate SAML role that issues attribute assertions and is not one of the three essential components for basic SAML federation between an IdP and SP.

Answer

Ticket Granting Ticket (TGT)

Answer

Attribute Authority (AA)

Question 8

An organization wants to implement multi-factor authentication (MFA) for remote access. Which combination represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. A smart card is a physical token the user possesses (something you have), and a fingerprint is a biometric trait inherent to the user (something you are). Combining them satisfies the requirement for two different MFA factor categories. This is a classic possession-plus-inherence pairing used in high-assurance environments.

Answer

Password and security question

Answer

Smart card and PIN

Answer

Password and one-time passcode (OTP)

Question 9

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

Accepted Answer

To reduce the risk of data breaches. A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

Answer

To lower office cleaning costs

Answer

To comply with fire safety regulations

Answer

To improve employee productivity

Question 10

During a security audit, it is discovered that network devices are using Telnet for management. Which of the following is the most secure replacement to ensure encrypted remote access?

Accepted Answer

SSH with public key authentication. SSH (Secure Shell) provides encrypted remote access and authentication, replacing the insecure Telnet protocol. Public key authentication adds a second factor (the private key) and is resistant to brute-force password attacks, making it the most secure option for managing network devices.

Answer

SNMPv3 with authentication and encryption

Answer

HTTPS with self-signed certificate

Answer

SSH with password authentication

Question 11

Which TWO of the following are valid reasons to deny a change request during the CAB approval process?

Accepted Answer

The change request lacks a rollback plan. Option B is correct because a change request without a rollback plan presents an unacceptable risk: if the change fails in production, the organization has no defined, tested way to revert to the prior known-good state, so the CAB should deny it until a rollback (backout) plan is documented. Option D is correct because untested changes have unverified behavior and unknown failure modes; the CAB should deny approval until the change has been validated in a staging environment that mirrors production, satisfying change validation and testing requirements. Option A is not a valid denial reason in itself, since budget is a financial approval matter handled separately from CAB risk assessment, and a change can still be technically sound. Option C is not valid because low priority affects scheduling and sequencing, not approval; a low-priority change can still be approved and deferred. Option E is not valid because the requester's seniority is irrelevant — the CAB evaluates the change's risk, impact, and readiness, not who submitted it.

Answer

The change is outside the approved budget

Answer

The change has a low priority

Answer

The change was requested by a junior staff member

Question 12

An organization uses attribute-based access control (ABAC) for its cloud storage. The policy states that a user can read a document only if the user’s department attribute matches the document’s department attribute AND the current time is within business hours (9AM-5PM). A user from Engineering tries to read a document classified for Engineering at 8:55 AM. What is the expected result?

Accepted Answer

Access denied because the time is outside business hours. The ABAC policy requires both conditions to be true: department match AND time within business hours (9AM-5PM). At 8:55 AM, the time condition is false, so access is denied regardless of the department match. This is a classic example of a conjunctive (AND) policy in ABAC where all attributes must satisfy the rules.

Answer

Access granted because the department matches

Answer

Access denied because the department does not match

Answer

Access granted because the user is in Engineering

Question 13

A network administrator is tasked with segmenting the network to isolate a DMZ containing public-facing web servers from the internal corporate network. Which device should be placed between the DMZ and internal network, and what type of traffic should it allow?

Accepted Answer

Firewall; allow only specific traffic from internal to DMZ and block DMZ-initiated connections to internal.. A firewall is the correct segmentation control between a DMZ and the internal network because it enforces stateful policy that permits only specific, necessary flows (typically internal-initiated sessions to DMZ services) while blocking DMZ-initiated connections inbound to the internal network. This prevents a compromised public-facing web server from pivoting into the corporate LAN. The directional rule set is the key security property being tested.

Answer

Router; allow all traffic but use NAT.

Answer

IDS; monitor traffic but do not block.

Answer

Switch; allow all traffic between DMZ and internal network.

Question 14

Which TWO of the following cryptographic algorithms are considered secure for modern use?

Accepted Answer

ChaCha20. ChaCha20 (B) is a modern stream cipher designed by Daniel J. Bernstein that remains secure and is widely deployed in TLS 1.3, WireGuard, and OpenSSH, offering strong resistance to cryptanalysis with no practical attacks against its full 20-round design. AES-256 (C) is a symmetric block cipher standardized by NIST that, with its 256-bit key, provides a very high security margin and is approved for protecting classified information up to Top Secret. In contrast, MD5 (A) is a hash function broken by practical collision attacks since 2004 and is unsuitable for security purposes. RC4 (D) is a stream cipher with well-known biases in its keystream (e.g., the RC4 biases exploited in WEP and TLS attacks) and has been prohibited in TLS by RFC 7465. DES (E) uses only a 56-bit effective key and is trivially brute-forced with modern hardware, so it is obsolete.

Answer

MD5 (Message Digest 5)

Answer

RC4 (Rivest Cipher 4)

Answer

DES (Data Encryption Standard)

Question 15

During a quantitative risk analysis, the asset value is $500,000, the exposure factor is 40%, and the annual rate of occurrence is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). SLE is asset value ($500,000) times exposure factor (40%) = $200,000. ALE = $200,000 × 0.5 = $100,000. This is the standard quantitative risk analysis formula per NIST SP 800-30.

Answer

$200,000

Answer

$500,000

Answer

$250,000