SSCP Practice Test 50 — 15 Questions

Question 1

Which TWO of the following are essential steps in a security incident response process according to the SSCP common body of knowledge? (Select the two best answers.)

Accepted Answer

Eradication. According to the SSCP common body of knowledge, the incident response process includes the phases of identification, containment, eradication, recovery, and lessons learned. Option D (Identification) is correct because it is the phase in which the incident is detected, validated, and scoped, determining whether an event is truly a security incident before further action is taken. Option C (Eradication) is correct because it is the phase in which the root cause and malicious artifacts (malware, compromised accounts, backdoors) are removed to prevent the incident from recurring. Vulnerability scanning (A) and penetration testing (B) are proactive security assessment activities performed before incidents occur, not phases of incident response, and risk assessment (E) is a risk management activity used to evaluate and prioritize risk, not a step in the incident response lifecycle.

Answer

Vulnerability scanning

Answer

Penetration testing

Answer

Risk assessment

Question 2

A company is designing a network with multiple security zones. Which TWO of the following are best practices for network segmentation? (Select TWO)

Accepted Answer

Place a firewall between each security zone to enforce traffic filtering.. Option A is correct because placing a firewall between each security zone enforces traffic filtering and access control at zone boundaries, which is the core principle of defense-in-depth segmentation — inter-zone traffic should be inspected and permitted only per policy rather than flowing freely. Option C is correct because VLANs (IEEE 802.1Q) logically separate traffic at Layer 2 within a switch, limiting broadcast domains and isolating hosts even when they share physical infrastructure, which is a standard segmentation technique. Option B is wrong because a single flat network removes all segmentation boundaries, allowing unrestricted lateral movement and broadcast propagation. Option D is wrong because disabling logging on inter-zone firewalls destroys the audit trail and visibility needed to detect and investigate policy violations. Option E is wrong because putting all servers in one broadcast domain increases attack surface and broadcast traffic, directly contradicting segmentation best practices.

Answer

Use a single flat network to reduce complexity.

Answer

Disable logging on inter-zone firewalls to improve performance.

Answer

Place all servers in the same broadcast domain for easier management.

Question 3

Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)

Accepted Answer

Supports endpoint security posture checks. Option B is correct because SSL/TLS VPNs (such as Cisco AnyConnect or Fortinet SSL VPN) commonly integrate host-scanning or posture-assessment modules that verify antivirus, patch level, and firewall status on the endpoint before granting access. Option C is correct because SSL/TLS VPN clients can be configured for split tunneling, allowing only traffic destined for corporate subnets to go through the tunnel while other traffic (e.g., internet browsing) goes directly out the local gateway. Option D is correct because SSL/TLS VPNs typically operate over TCP port 443 (HTTPS), which is almost universally permitted through firewalls and proxies, whereas IPsec requires UDP 500/4500 and ESP (protocol 50), which are frequently blocked. Option A is incorrect because UDP port 500 is used by IKE for IPsec, not by SSL/TLS VPNs. Option E is incorrect because SSL/TLS VPNs authenticate users via certificates, RADIUS, LDAP, or SAML, and pre-shared keys are characteristic of IPsec, not SSL/TLS VPNs.

Answer

Typically uses UDP port 500

Answer

Requires pre-shared keys for authentication

Question 4

A security analyst is reviewing a TLS 1.3 deployment. Which THREE of the following are features of TLS 1.3?

Accepted Answer

Mandatory forward secrecy. Option B is correct because TLS 1.3 mandates forward secrecy by eliminating static RSA and static Diffie-Hellman key exchange, requiring ephemeral key exchanges (ECDHE or DHE) so that compromise of long-term keys cannot decrypt past sessions. Option C is correct because TLS 1.3 introduces a 0-RTT (early data) mode using PSK resumption, allowing the client to send application data in the first flight, though it carries replay risk. Option D is correct because TLS 1.3 removes all legacy cipher suites based on RC4, DES/3DES, CBC-mode, and MD5/SHA-1, restricting the protocol to AEAD ciphers such as AES-GCM, ChaCha20-Poly1305, and AES-CCM. Option A is not correct because static RSA key exchange was explicitly removed in TLS 1.3, since it lacks forward secrecy. Option E is not correct because TLS 1.3 does not support SSL 3.0 compatibility; SSL 3.0 was already deprecated and TLS 1.3 removed backward compatibility with such legacy protocols.

Answer

Use of static RSA key exchange

Answer

Support for SSL 3.0 compatibility

Question 5

A security engineer is designing a key management system for a large enterprise. Which two of the following practices are essential for securing cryptographic keys throughout their lifecycle?

Accepted Answer

Store keys in dedicated hardware security modules (HSMs).. Option A is correct because dedicated hardware security modules (HSMs) provide tamper-resistant, FIPS 140-2/140-3 validated storage and cryptographic processing, ensuring keys are generated, used, and stored in a protected boundary and never exposed in plaintext on general-purpose systems. Option E is correct because regular key rotation limits the amount of data protected by any single key (cryptoperiod) and reduces the blast radius of a compromise, while rotation upon suspected or confirmed compromise ensures the exposed key is retired and replaced immediately. Options B, C, and D are not appropriate: reusing one key across encryption, digital signatures, and key exchange violates key-separation principles and increases the impact of any single key compromise; emailing keys exposes them to interception and unauthorized access; and storing keys alongside the encrypted data means a single database breach compromises both the ciphertext and the key needed to decrypt it.

Answer

Use the same key for encryption, digital signatures, and key exchange.

Answer

Email keys to authorized users for convenience.

Answer

Store keys in the same database as encrypted data.

Question 6

An organization wants to implement separation of duties to reduce the risk of fraud. Which THREE of the following are common techniques used to enforce separation of duties?

Accepted Answer

Audit logging and monitoring of privileged actions. Option A (audit logging and monitoring of privileged actions) is correct because separation of duties requires accountability: recording and reviewing who did what (e.g., via SIEM, Windows Event Log, or syslog) deters and detects fraud by ensuring no single actor can act unobserved. Option B (role-based access control with mutually exclusive roles) is correct because RBAC assigns permissions to roles rather than individuals, and defining mutually exclusive roles (e.g., a user cannot hold both 'accounts payable' and 'accounts receivable' roles) technically prevents one person from controlling an entire transaction lifecycle. Option E (requiring two or more people to approve a transaction) is correct because dual control / two-person integrity (also called the four-eyes principle) splits a critical action across multiple parties, so no single individual can authorize a fraudulent transaction alone. Option C (enforcing complex password policies) is not a separation-of-duties technique; it strengthens authentication against guessing/brute-force but does nothing to divide duties among people. Option D (using biometric authentication) is also not a separation-of-duties control; it improves identity assurance for a single user but does not prevent that user from holding conflicting responsibilities.

Answer

Enforcing complex password policies

Answer

Using biometric authentication

Question 7

A security engineer is hardening a Windows server. Which TWO actions should be taken to reduce the attack surface? (Select TWO.)

Accepted Answer

Disable unnecessary services and accounts. Option C is correct because disabling unnecessary services and accounts directly shrinks the attack surface by removing exploitable entry points, listening ports, and credentials that attackers could abuse for privilege escalation or lateral movement. Option D is correct because applying the latest security patches remediates known vulnerabilities (e.g., remote code execution flaws) that malware and threat actors actively exploit, which is a foundational hardening step. Option A is wrong because creating more active user accounts expands the attack surface and increases credential-management risk rather than reducing it. Option B is wrong because enabling AutoRun for removable media facilitates malware propagation via USB drives and should typically be disabled. Option E is wrong because installing additional third-party software adds new code, services, and potential vulnerabilities, enlarging rather than reducing the attack surface.

Answer

Increase the number of active user accounts for auditing

Answer

Enable auto-run for removable media to improve user convenience

Answer

Install additional third-party software for monitoring

Question 8

A security analyst is reviewing a web application for OWASP Top 10 vulnerabilities. Which THREE of the following are examples of injection flaws?

Accepted Answer

SQL injection. SQL injection (A) is a classic injection flaw where untrusted input is concatenated into SQL statements, allowing an attacker to alter query logic and manipulate the database. LDAP injection (B) is also an injection flaw because unsanitized input inserted into LDAP filters or queries can modify directory lookups and bypass authentication or expose directory data. OS command injection (D) occurs when user input is passed to a shell or system call, letting an attacker execute arbitrary operating-system commands on the server. Broken authentication (C) is a separate OWASP category involving weaknesses in session management, credential handling, or authentication logic, not an injection flaw. Cross-Site Scripting (E) is typically classified under injection-like client-side flaws or its own category, but in the OWASP Top 10 it is not grouped as an injection flaw in the same sense as SQL, LDAP, or OS command injection.

Answer

Broken authentication

Answer

Cross-Site Scripting (XSS)

Question 9

An organization uses Linux servers and wants to implement mandatory access control (MAC) to enhance security. Which TWO technologies can be used? (Select TWO.)

Accepted Answer

SELinux. SELinux (A) is correct because it is a Linux kernel security module that enforces mandatory access control by applying type enforcement, role-based access control, and multi-level security policies that confine processes and users regardless of their discretionary permissions. AppArmor (C) is also correct because it implements MAC through per-program profiles that restrict an application's file, network, and capability access using path-based rules loaded into the kernel. iptables (B) is incorrect because it is a packet-filtering firewall tool for network traffic, not a MAC framework for constraining process privileges. auditd (D) is incorrect because it is the Linux auditing daemon that logs security-relevant events, providing accountability rather than access enforcement. PAM (E) is incorrect because it is an authentication framework that handles login and credential checks, not a mandatory access control mechanism.

Answer

iptables

Answer

auditd

Answer

PAM (Pluggable Authentication Modules)

Question 10

Refer to the exhibit. The analyst sees this IDS alert. What is the most likely outcome if the target web application is vulnerable?

Accepted Answer

Authentication bypass or data extraction. The IDS alert indicates a SQL injection attempt (e.g., '1=1' or similar pattern). If the web application is vulnerable, the attacker can manipulate SQL queries to bypass authentication (e.g., logging in without valid credentials) or extract data from the database (e.g., dumping user tables). This is the most direct outcome of a successful SQL injection.

Answer

Buffer overflow and remote code execution

Answer

Cross-site scripting (XSS) attack

Answer

Privilege escalation on the database server

Question 11

A company is implementing single sign-on (SSO) for its internal applications. Which TWO of the following protocols are commonly used for SSO?

Accepted Answer

Kerberos. Kerberos (A) is a network authentication protocol that uses ticket-granting tickets (TGTs) and service tickets issued by a Key Distribution Center (KDC), enabling transparent single sign-on within a Windows/Active Directory domain environment. SAML (E) is an XML-based federation standard in which an identity provider (IdP) issues signed assertions to a service provider (SP), which is the classic browser-based SSO mechanism for internal and cloud applications. OAuth (B) is an authorization delegation framework (access tokens for APIs), not an authentication/SSO protocol by itself, so it does not fit the SSO requirement here. LDAP (C) is a directory access protocol used to query and authenticate against a directory, but it does not provide cross-application SSO. RADIUS (D) is an AAA protocol for network access (VPN, Wi-Fi, 802.1X), not for application-level SSO.

Answer

OAuth

Answer

LDAP

Answer

RADIUS

Question 12

Which TWO of the following are effective measures to prevent buffer overflow attacks in a custom-developed application?

Accepted Answer

Input validation. Input validation (A) is correct because strictly checking length, type, and format of all user-supplied data before it is copied into fixed-size buffers prevents the oversized or malformed input that triggers a buffer overflow. Stack canaries (E) are correct because a compiler-inserted canary value placed between local variables and the saved return address is checked on function return, so an overflow that overwrites the return address is detected and the process is aborted before the attacker's code can execute. Running with least privilege (C) is not marked correct because it only limits the damage after a successful exploit rather than preventing the overflow itself. Using unpatched third-party libraries (B) is wrong because it increases exposure to known memory-corruption vulnerabilities, and disabling ASLR (D) is wrong because ASLR is a memory-randomization defense whose removal makes exploitation easier, not harder.

Answer

Using unpatched third-party libraries

Answer

Running the application with least privilege

Answer

Disabling ASLR

Question 13

A security engineer is hardening a Windows workstation. Which TWO configurations reduce the attack surface by limiting execution of unauthorized code? (Select TWO.)

Accepted Answer

Configure AppLocker rules. AppLocker (A) is correct because it uses allow/deny rules based on publisher, path, or file hash to control which executables, scripts, and installers users can run, directly restricting unauthorized code execution. Windows Defender Application Control (D) is also correct because WDAC enforces code integrity policies at the kernel level, allowing only trusted, signed binaries to execute and blocking unauthorized or tampered code. Windows Firewall with Advanced Security (B) filters network traffic by port, protocol, and profile but does not govern local code execution, so it does not meet the requirement. BitLocker (C) provides full-disk encryption for data-at-rest confidentiality and does not prevent execution of unauthorized programs. Disabling AutoPlay (E) reduces a minor vector for automatic execution from removable media but is not a general code-execution control like AppLocker or WDAC.

Answer

Enable Windows Firewall with Advanced Security

Answer

Enable BitLocker full-disk encryption

Answer

Disable AutoPlay

Question 14

During the containment phase of incident response, a security analyst identifies malware on a critical server. Which TWO actions should be taken FIRST to contain the threat and preserve evidence? (Choose two.)

Accepted Answer

Disconnect the network cable from the server.. Option C is correct because physically disconnecting the network cable from the server immediately isolates the host, preventing lateral movement, command-and-control callbacks, and data exfiltration while the incident is being contained. Option E is correct because capturing RAM with a tool like WinPmem preserves volatile evidence such as running processes, network connections, injected code, and encryption keys that would be lost on shutdown or reboot, and it should be done before any power state change. Option A is not among the first actions because a full forensic disk image is time-consuming and is typically acquired after volatile memory is preserved and the host is isolated. Option B is wrong because rebooting destroys volatile memory evidence and may allow malware to re-infect the system or trigger destructive payloads. Option D is wrong because running a full antivirus scan alters system state, can quarantine or delete files, and does not isolate the server from the network, thereby contaminating evidence and leaving the threat active.

Answer

Capture a forensic image of the hard drive.

Answer

Reboot the server to clear the malware from memory.

Answer

Run a full antivirus scan on the server.

Question 15

A financial institution uses a risk management framework based on ISO 31000. During a quarterly risk review, the risk manager identifies that the residual risk for a critical trading application remains high despite multiple controls. The application's risk score has not decreased after implementing two-factor authentication and encryption. The risk appetite statement says 'no high residual risk for systems processing transactions over $10M.' What should the risk manager do next?

Accepted Answer

Escalate to senior management for a decision on additional controls or risk acceptance.. When residual risk exceeds the organization's risk appetite, standard risk management frameworks (like ISO 31000) require escalation to senior management to decide on additional controls or formal risk acceptance. Option A is incorrect because disabling non-essential features may not sufficiently reduce the risk to within appetite and could harm business operations. Option B is incorrect because cyber insurance transfers financial loss but does not reduce the residual risk itself; the risk appetite statement addresses residual risk, not just financial impact. Option D is incorrect because the risk appetite explicitly prohibits high residual risk for this system, so acceptance would violate policy.

Answer

Reduce the risk by disabling non-essential features of the application.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Accept the risk because controls are already in place.