SSCP Practice Test 5 — 10 Questions

Question 1

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers

Question 2

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. The Clean Desk Policy is violated because it requires employees to keep their workspaces free of sensitive information, including passwords, when not in use. Writing passwords on sticky notes and attaching them to monitors leaves credentials exposed, directly contravening this policy. The Clean Desk Policy aims to reduce the risk of unauthorized access to information.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 3

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 4

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). TOTP (Time-based One-Time Password, RFC 6238) generates a one-time password derived from a shared secret and the current time step (typically 30 seconds), so the code is valid only within a short time window. This time-bound validity is exactly what the question describes.

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password

Question 5

A PKI administrator needs to check the revocation status of a digital certificate without requiring the client to download the entire CRL. Which method is designed for online, real-time certificate status checking?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) is designed for online, real-time certificate status checking. It allows a client to query an OCSP responder for the revocation status of a specific certificate without downloading the entire CRL.

Answer

OCSP stapling

Answer

CRL

Answer

Certificate transparency

Question 6

What is the primary purpose of a baseline configuration in configuration management?

Accepted Answer

To provide a consistent, secure starting point for systems. A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

Answer

To store configuration items in the CMDB

Answer

To detect malware infections

Answer

To track software licenses

Question 7

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 8

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Accepted Answer

Backup, Overwrite, Verify, Destroy, Document. The proper order for disposing of a hard drive with sensitive data is: first, backup any data that needs to be retained; second, overwrite the entire drive to sanitize it; third, verify that the overwrite was successful using a tool; fourth, physically destroy the drive (e.g., shredding or crushing); and finally, document the process for audit trails and compliance. This sequence ensures data confidentiality and availability of necessary data.

Answer

Overwrite, Verify, Backup, Destroy, Document

Answer

Destroy, Backup, Overwrite, Verify, Document

Answer

Backup, Verify, Overwrite, Destroy, Document

Question 9

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity

Question 10

Which Windows feature allows an administrator to define security policies such as password complexity and account lockout across multiple systems in a domain?

Accepted Answer

Group Policy. Group Policy is the correct answer because it is a centralized management feature in Windows Active Directory that allows administrators to define and enforce security policies—such as password complexity, account lockout thresholds, and audit settings—across multiple systems in a domain. Group Policy Objects (GPOs) are linked to sites, domains, or organizational units (OUs) and are applied to computers and users at logon or startup, ensuring consistent policy enforcement. This centralized approach is essential for enterprise environments where local settings would be impractical to manage individually.

Answer

Local Security Policy

Answer

Security Audit Policies

Answer

User Account Control (UAC)