SSCP Practice Test 50 — 15 Questions

Question 1

Which THREE of the following are considered cryptographic best practices for key management? (Select exactly 3.)

Accepted Answer

Separate keys used for encryption and digital signatures. Using separate keys for encryption and digital signatures ensures that compromising one key does not affect the other. This separation aligns with the principle of key usage restrictions, as defined in NIST SP 800-57, which mandates distinct keys for different cryptographic operations to prevent misuse and maintain non-repudiation.

Answer

Publish symmetric keys on the company website for transparency

Answer

Store keys with the encrypted data for convenience

Question 2

A security analyst is investigating a potential ARP spoofing attack on a local network segment. Which TWO network security controls would be most effective in preventing or detecting such an attack at Layer 2?

Accepted Answer

Implement Port Security with MAC address binding. Dynamic ARP Inspection (DAI) validates ARP packets on trusted ports and drops invalid ones. Port Security with MAC address binding limits the number of MAC addresses per port, reducing the effectiveness of ARP spoofing.

Answer

Configure DHCP snooping on switches

Answer

Use IPsec transport mode between hosts

Answer

Deploy a network-based IDS monitoring ARP traffic

Question 3

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

Accepted Answer

At least two different media types. The 3-2-1 rule requires at least two different media types (e.g., tape and disk, or disk and cloud) to mitigate the risk of a single media failure or vulnerability. This ensures that if one media type becomes corrupted or obsolete, the other remains viable for recovery.

Answer

Daily full backups

Answer

Encryption of all backups

Question 4

Which THREE are required components of a core role-based access control (RBAC) system according to NIST? (Choose three.)

Accepted Answer

Users. (Users) is correct because in NIST's RBAC model (INCITS 359-2012), users are the human actors who are assigned to roles. The core components of RBAC are users, roles, and permissions; users are the subjects that ultimately receive permissions through their role membership. Without users, there is no entity to which roles and permissions can be assigned.

Answer

Constraints

Answer

Sessions

Question 5

Refer to the exhibit. An analyst sees these logs and is concerned about a potential attack. What is the most likely scenario?

Accepted Answer

Successful RDP connection. The log shows a successful RDP connection (source IP 10.0.0.5, destination port 3389, with 'Session established' or similar success indicator). RDP is a common target for lateral movement after initial compromise, and a single successful connection from an external IP to an internal host is a strong indicator of an attacker gaining remote access, not a brute force attempt (which would show multiple failures) or a scan (which would show many ports).

Answer

Denial of service (DoS)

Answer

SSH brute force

Answer

Port scan

Question 6

A company deploys a new web application and wants to ensure that session tokens are not vulnerable to session hijacking. Which of the following controls is most effective?

Accepted Answer

Set the Secure and HttpOnly flags on session cookies.. Setting the Secure and HttpOnly flags ensures cookies are only sent over HTTPS and not accessible via JavaScript, preventing interception and XSS-based theft. Option A (bind to IP) can cause issues with mobility; Option B (short timeout) helps reduce exposure but does not prevent hijacking; Option C (encrypt token) is redundant if HTTPS is used; Option D (regenerate after each request) is impractical and not necessary.

Answer

Bind the session token to the user's IP address.

Answer

Set a short session timeout (e.g., 5 minutes).

Answer

Encrypt the session token using AES.

Answer

Regenerate the session ID after every request.

Question 7

A network administrator needs to ensure that internal users can access only approved external websites. Which technology should be implemented?

Accepted Answer

Web Proxy with content filtering. A web proxy with content filtering intercepts HTTP/HTTPS requests from internal users and applies policy rules (e.g., URL whitelists, category blocking) to allow only approved external websites. This technology operates at the application layer, inspecting the full URL and content, making it the correct choice for granular access control.

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Answer

Network Address Translation (NAT)

Question 8

A company wants to implement a policy where no single individual can approve a purchase order and also receive the goods. Which access control principle does this enforce?

Accepted Answer

Separation of duties. This policy enforces separation of duties by ensuring that no single individual has the authority to both approve a purchase order and receive the goods. This control prevents fraud and errors by requiring two different people to complete related but conflicting tasks, which is a fundamental access control principle in financial and operational systems.

Answer

Rotation of duties

Answer

Need to know

Answer

Least privilege

Question 9

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 10

A company uses multiple virtual machines on a single hypervisor. To prevent a VM from escaping its virtualized environment and compromising the hypervisor, which of the following should be implemented?

Accepted Answer

Apply hypervisor security patches and disable unnecessary VM guest tools. VM escape attacks exploit vulnerabilities in the hypervisor. Keeping the hypervisor patched and disabling unnecessary VM guest tools reduces attack surface.

Answer

Use a separate network for VM management traffic

Answer

Deploy a host-based firewall on each VM

Answer

Enable VM snapshots to restore in case of compromise

Question 11

A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?

Accepted Answer

Establishing a process to add approved applications to the whitelist. Application whitelisting requires a process for updating the whitelist when new legitimate software is needed; otherwise, users may be blocked from necessary applications.

Answer

Ensuring that all users have local administrator rights

Answer

Deploying a host-based firewall on each endpoint

Answer

Disabling Windows Defender Antivirus to reduce resource usage

Question 12

A system administrator is hardening a Linux server. After installing the OS, which of the following steps should be taken to ensure that only authorized users can execute commands with elevated privileges?

Accepted Answer

Edit the /etc/sudoers file to restrict sudo access. The /etc/sudoers file controls which users can run commands as root via sudo. Proper configuration is essential for privilege escalation control.

Answer

Enable auditd to log all commands

Answer

Configure PAM to enforce password complexity

Answer

Set the setuid bit on critical binaries

Question 13

A Linux server is being hardened. The security team wants to enforce mandatory access control policies that confine processes to limited access to files and resources. Which technology should be implemented?

Accepted Answer

SELinux. SELinux enforces mandatory access control (MAC) policies, confining processes.

Answer

PAM

Answer

iptables

Answer

auditd

Question 14

A company deploys a web application and wants to protect against SQL injection and XSS attacks. Which security control is specifically designed to inspect HTTP traffic and block such attacks?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) filters and monitors HTTP traffic between a web application and the Internet, commonly used to block OWASP Top 10 attacks like SQL injection and XSS.

Answer

Intrusion Detection System (IDS)

Answer

Network segmentation

Answer

Host-based firewall

Question 15

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

Accepted Answer

Risk monitoring. The analyst is actively monitoring the VPN gateway for security events (failed logins) and then adjusting controls (lockout threshold, geo-IP blocking) in response to observed threats. This continuous observation and adjustment is the essence of risk monitoring, which is the ongoing process of tracking identified risks and evaluating the effectiveness of controls. The actions taken are not about identifying new risks, assessing their likelihood/impact, or formally reporting them, but rather about reacting to real-time data to maintain an acceptable risk posture.

Answer

Risk identification

Answer

Risk assessment

Answer

Risk reporting