SSCP Practice Test 49 — 15 Questions

Question 1

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Delegation of Control wizard to assign the 'Reset user passwords and force password change at next logon' permission.. The Delegation of Control wizard allows granular assignment of specific Active Directory permissions, such as 'Reset user passwords and force password change at next logon', without granting broader administrative rights. This follows the principle of least privilege by limiting the delegated personnel to only the necessary task. Option C is correct because it directly addresses the requirement with a built-in, secure delegation mechanism.

Answer

Place the personnel in the Account Operators group.

Answer

Add the personnel to the Domain Admins group.

Answer

Give the personnel physical access to the domain controller.

Question 2

An organization is migrating from on-premises servers to a cloud IaaS model. The security team must ensure that virtual machine (VM) images are hardened before deployment. Which of the following is the MOST effective control to ensure consistency and compliance with security baselines?

Accepted Answer

Create a golden image that is hardened and approved for use, and deploy VMs from that image. Creating a golden image that is hardened and approved for use ensures that every VM deployed from it inherits a consistent, pre-configured security baseline. This approach eliminates configuration drift and manual errors by baking security controls into the image before deployment, making it the most effective control for consistency and compliance.

Answer

Perform vulnerability scans on each VM after deployment

Answer

Apply the latest OS patches to each VM immediately after deployment

Answer

Train administrators on hardening procedures and rely on manual configuration

Question 3

A security analyst is reviewing the access control policy and notices that some users have been granted 'write' access to a directory that contains sensitive financial reports. Which principle of information security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting 'write' access to a directory containing sensitive financial reports to users who do not require that level of access violates this principle, as it introduces unnecessary risk of unauthorized modification or data leakage.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 4

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Accepted Answer

DES. DES (B) is insecure because its 56-bit key is far too short and can be brute-forced in hours with modern hardware, so it must be avoided. 3DES (C) is deprecated because its 64-bit block size enables Sweet32-style birthday attacks and its effective key strength is reduced, making it unsuitable for new deployments. MD5 (E) is a broken hash function with practical collision attacks, so it must not be used for integrity or signature purposes. RSA-2048 (A) and AES-256 (D) are not marked correct because they remain strong, currently recommended algorithms when implemented properly.

Answer

RSA-2048

Answer

AES-256

Question 5

A company's disaster recovery plan includes offsite tape backups. During a test, it is discovered that the tapes are stored at a location that shares the same power grid as the primary site. Which risk does this pose?

Accepted Answer

The tapes may be inaccessible during a power outage. If the offsite tape storage shares the same power grid as the primary site, a regional power outage could simultaneously take down both the primary site and the tape storage facility, making the tapes physically inaccessible when they're needed for recovery. This defeats the geographic separation principle of disaster recovery, where the offsite location must be independent of the primary site's infrastructure and utility dependencies.

Answer

The tapes may degrade over time

Answer

The tapes are not encrypted

Answer

The recovery time may exceed the RTO

Question 6

Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based federated identity protocol that uses assertions to convey authentication and authorization information between identity providers and service providers. It enables single sign-on across different security domains by allowing a user authenticated at one domain to access resources in another without re-authenticating.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 7

A company experiences a security breach where an attacker gained access to the network through a compromised vendor account. Which of the following controls would have BEST prevented this attack?

Accepted Answer

Enable multi-factor authentication for vendor accounts.. Multi-factor authentication (MFA) for vendor accounts is the best preventive control because it adds an additional layer of security beyond just a password. Even if the attacker compromises the vendor's credentials, MFA requires a second factor (e.g., a one-time code from a token or biometric) to authenticate, effectively blocking unauthorized access. This directly addresses the attack vector of credential theft, which was the root cause of the breach.

Answer

Install a network-based intrusion detection system.

Answer

Require vendors to sign an NDA.

Answer

Create a separate VLAN for vendor access.

Question 8

Which THREE activities are part of the post-incident phase?

Accepted Answer

Lessons learned meeting. The post-incident phase focuses on reviewing what happened and improving future response, so A (Lessons learned meeting) is correct because it formally gathers the incident response team to review the timeline, decisions, and outcomes after containment and recovery are complete. B (Conduct root cause analysis) is correct because determining the underlying cause—often via techniques like the 5 Whys or fishbone analysis—happens after the incident is resolved and feeds directly into preventive actions. E (Update incident response plan) is correct because the post-incident phase produces documented improvements, such as revised playbooks, contact lists, and detection rules, based on lessons learned and root cause findings. C (Notify affected customers) and D (Reimage infected computers) belong to earlier phases—notification typically occurs during detection/containment or as required by breach-notification obligations, and reimaging is a containment/eradication/recovery activity—so neither is part of the post-incident phase.

Answer

Notify affected customers

Answer

Reimage infected computers

Question 9

A security analyst is reviewing Linux audit logs with auditd. Which TWO events would be of greatest concern for a server that should not have interactive logins? (Select TWO.)

Accepted Answer

Successful root login via SSH. Option A (Successful root login via SSH) is correct because a server that should not permit interactive logins should never show a successful root SSH session; this indicates either a policy violation or compromised credentials granting direct privileged interactive access. Option C (Multiple failed su attempts) is correct because repeated su failures signal an active attempt to escalate to another account (often root) interactively, which is a strong indicator of brute-force or unauthorized privilege-escalation activity on a host that should have no interactive users. Option B (System reboot logs) is not inherently concerning, as reboots are routine operational events and do not by themselves indicate interactive login or compromise. Option D (Successful cron job execution) is normal scheduled behavior and does not represent an interactive login. Option E (File permission changes by a non-root user) may be worth reviewing, but a non-root user changing permissions on files they own is not as directly indicative of unauthorized interactive access as a successful root SSH login or repeated su failures.

Answer

System reboot logs

Answer

Successful cron job execution

Answer

File permission changes by a non-root user

Question 10

An organization is deploying a network-based intrusion detection system (NIDS). The security team must decide on placement and configuration. Which THREE considerations are critical for effective NIDS deployment?

Accepted Answer

Using a network tap or SPAN port to monitor traffic without introducing latency. Option A is correct because a NIDS is a passive monitoring technology, so it must receive a copy of traffic via a network TAP or a switch SPAN/mirror port; this preserves the monitored link's performance and avoids introducing latency or a failure point. Option D is correct because placing the NIDS behind the firewall on internal segments lets it inspect east-west traffic and detect insider threats or compromised hosts that perimeter filtering would miss. Option E is correct because signature tuning is essential: enabling only signatures relevant to the environment's OS, applications, and protocols reduces false positives and alert fatigue, keeping the IDS effective. Option B is not correct because inline placement is characteristic of an intrusion prevention system (IPS), not a NIDS, and it adds a potential latency and availability risk. Option C is not correct because dropping packets is an IPS blocking action; a NIDS only detects and alerts and cannot drop traffic.

Answer

Placing the NIDS inline to block malicious traffic immediately

Answer

Configuring the NIDS to drop packets that match attack signatures

Question 11

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

Accepted Answer

Least privilege. Option B (Least privilege) is correct because users and processes should be granted only the minimum access rights necessary to perform their assigned tasks, reducing the attack surface and limiting damage from compromised accounts. Option C (Need-to-know) is correct because access to specific information should be restricted to individuals who require it to fulfill their job responsibilities, which is a foundational access control principle closely tied to least privilege. Option D (Separation of duties) is correct because splitting critical tasks among multiple users prevents any single person from having enough control to commit fraud or cause significant harm without detection, a core principle in access control policy design. Option A (Fail-open) is not a fundamental access control principle; fail-open means a system defaults to allowing access when it fails, which is generally a security weakness rather than a policy principle. Option E (Defense in depth) is a valid security architecture concept involving layered controls, but it is not one of the three fundamental access control principles being asked for here.

Answer

Fail-open

Answer

Defense in depth

Question 12

A cloud security architect is designing a solution to protect workloads running in a public cloud. Which THREE of the following are key security controls that should be implemented?

Accepted Answer

Deploy a Cloud Security Posture Management (CSPM) tool. Option B is correct because a Cloud Security Posture Management (CSPM) tool continuously monitors the cloud environment for misconfigurations, compliance violations, and policy drift, which is a foundational control for protecting public cloud workloads. Option D is correct because a Cloud Workload Protection Platform (CWPP) secures the actual workloads (VMs, containers, serverless functions) at runtime, providing vulnerability scanning, threat detection, and workload-level hardening. Option E is correct because implementing IAM roles with least privilege limits each identity to only the permissions required for its function, reducing the blast radius of compromised credentials and enforcing zero-trust access control. Option A is not a key control because storing encryption keys in the same region as the data does not improve security and may actually reduce resilience; key management should follow a dedicated KMS/HSM strategy with appropriate separation and replication. Option C is not a key control because disabling multi-factor authentication for service accounts weakens security and violates best practices; MFA or strong credential management should be enforced, not removed.

Answer

Store encryption keys in the same cloud region as the data

Answer

Disable multi-factor authentication for service accounts

Question 13

A security engineer is designing a DMZ to host public-facing services. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Use a screened subnet with two firewalls. Option D is correct because a screened subnet architecture with two firewalls (an external firewall facing the internet and an internal firewall facing the trusted network) creates defense in depth, so if a DMZ host is compromised the attacker still must breach a second firewall to reach internal systems. Option E is correct because DMZ hosts should be reachable only on the specific ports their public services require (for example TCP 443 for HTTPS), enforcing least privilege and minimizing the attack surface exposed to the internet. Option A is wrong because applying the same rule set to the DMZ and internal network defeats segmentation and would let DMZ compromises pivot freely into the internal LAN. Option B is wrong because placing public-facing web servers on the internal network exposes trusted systems directly to internet-facing risk instead of isolating them in the DMZ. Option C is wrong because full mesh connectivity between DMZ hosts enables lateral movement after a single host is compromised, whereas DMZ hosts should be isolated from one another unless a specific service dependency requires otherwise.

Answer

Use the same firewall rule set for DMZ and internal network

Answer

Place web servers on the internal network

Answer

Enable full mesh connectivity between DMZ hosts

Question 14

A security analyst reviews a cryptographic implementation and notices that the same initialization vector (IV) is used repeatedly with the same key in CBC mode. What is the primary risk?

Accepted Answer

Loss of confidentiality. In CBC (Cipher Block Chaining) mode, the initialization vector (IV) is XORed with the first plaintext block before encryption. Reusing the same IV with the same key means that identical plaintext blocks will produce identical ciphertext blocks, revealing patterns in the data. This directly breaks confidentiality, as an attacker can detect repeated plaintext segments, infer message structure, or even recover plaintext through known-plaintext attacks.

Answer

Loss of authentication

Answer

Non-repudiation is compromised

Answer

Loss of integrity

Question 15

Which TWO of the following are best practices for securing an application programming interface (API)?

Accepted Answer

Implement rate limiting to control the number of requests.. Option A is correct because implementing rate limiting controls the number of requests a client can make within a given time window, which mitigates abuse such as brute-force attacks, credential stuffing, and denial-of-service attempts against the API. Option B is correct because validating and sanitizing all input to the API defends against injection attacks (such as SQL injection and cross-site scripting) and ensures that malformed or malicious data cannot reach backend logic or data stores. Option C is not a best practice because detailed error messages can leak stack traces, internal paths, database schema details, or version information that aid attackers; generic error responses with server-side logging are preferred. Option D is incorrect because disabling encryption exposes API traffic to eavesdropping and tampering, and performance should be addressed through other means such as TLS optimization rather than removing transport security. Option E is incorrect because HTTP Basic Authentication transmits credentials in Base64 (effectively cleartext) and is only safe when combined with HTTPS, so using it without HTTPS exposes credentials to interception.

Answer

Return detailed error messages to help clients debug.

Answer

Disable encryption to improve performance.

Answer

Use HTTP Basic Authentication without HTTPS.