SSCP Practice Questions 2 — 50 Questions

Question 1

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Accepted Answer

Risk register. The risk register is the formal document used to track identified risks, their assessed likelihood and impact, and the chosen risk response. When a residual risk remains after controls are implemented, the risk register records that residual risk level and formally documents management's decision to accept it, including the rationale and approval. This ensures auditability and accountability for the accepted risk.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Security baseline

Question 2

A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?

Accepted Answer

An earlier deny rule matches the traffic before the permit rule. The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.

Answer

The firewall rule is disabled

Answer

The database server is down

Answer

The internal IP is on a blacklist

Question 3

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Accepted Answer

Create a SIEM correlation rule to alert on multiple failed logins from the same source. A SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.

Answer

Enable signature-based detection on the IDS

Answer

Implement a host-based IDS on the server

Answer

Increase log retention to 1 year

Question 4

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Accepted Answer

To provide a secure configuration standard for systems. A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.

Answer

To calculate annualized loss expectancy

Answer

To replace the need for vulnerability scanning

Answer

To detect intrusions in real-time

Question 5

Which of the following protocols operates on TCP port 443 and provides encrypted communication between a web browser and a web server?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) operates on TCP port 443 and provides encrypted communication between a web browser and a web server using TLS. It is the standard secure web protocol and the only option that matches both the port and the encryption requirement.

Answer

SMTP

Answer

SSH

Answer

HTTP

Question 6

During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

High. In a standard 3x3 qualitative risk matrix, likelihood and impact are each rated Low, Medium, or High, and the intersection of Medium likelihood with High impact yields a High overall risk rating. This is the conventional mapping used in most risk frameworks. The combination is serious enough to warrant prioritized treatment but does not reach the highest tier.

Answer

Medium

Answer

Low

Answer

Critical

Question 7

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. The best action is to remove Telnet and use SSH instead because Telnet transmits data, including credentials, in cleartext, making it inherently insecure. SSH provides encrypted communication, eliminating the vulnerability. Removing the service also reduces the attack surface.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 8

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

Accepted Answer

Classify the incident and determine if escalation is needed.. During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Answer

Immediately disconnect the user's workstation from the network.

Answer

Rebuild the user's workstation from a known-good image.

Answer

Ignore the event as it may be a false positive.

Question 9

A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?

Accepted Answer

Remote access policy. The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

Answer

Data handling policy

Answer

Password policy

Answer

Acceptable use policy (AUP)

Question 10

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 11

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the only model where access decisions are based on comparing the subject's security clearance with the object's classification label, as defined by a central authority. In MAC, the system enforces these labels and users cannot alter them, making it mandatory rather than discretionary. This matches the scenario of assigning permissions based on clearance and classification, which are core components of MAC (e.g., Bell-LaPadula or Biba models).

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 12

What is the primary purpose of establishing a chain of custody for digital evidence?

Accepted Answer

To maintain evidence integrity and track handling. The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Answer

To reduce the size of evidence for storage

Answer

To encrypt evidence for secure transmission

Answer

To prioritize which evidence to analyze first

Question 13

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.

Answer

Threat

Answer

Risk

Answer

Exploit

Question 14

A help desk technician receives multiple reports that users cannot access a critical web application. The application's error log shows repeated '403 Forbidden' errors. Which of the following is the most likely cause?

Accepted Answer

The web application firewall is blocking legitimate traffic.. A 403 Forbidden error indicates that the server understood the request but is refusing to authorize it. The most likely cause is the web application firewall (WAF) blocking legitimate traffic due to false positives or overly strict rules. Option B (expired SSL certificate) would cause SSL handshake errors, not 403. Option C (database connection pool exhausted) would result in 500-type errors. Option D (IP address change) would cause connection timeouts or DNS errors, not 403.

Answer

The SSL certificate has expired.

Answer

The application's database connection pool is exhausted.

Answer

The web server's IP address has changed.

Question 15

A security team is implementing Network Access Control (NAC) to enforce endpoint compliance before granting network access. Which technology allows port-based authentication on wired networks?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control that provides authentication to devices trying to connect to a wired or wireless network. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPOL) to encapsulate authentication messages between the supplicant (client) and the authenticator (switch or access point), which then relays them to an authentication server (typically RADIUS). This ensures that no traffic can pass through the port until the device is authenticated and authorized.

Answer

RADIUS

Answer

WPA2-Enterprise

Answer

MAC filtering

Question 16

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Accepted Answer

The ACCEPT rule matches before the DROP rule.. C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Answer

The DROP rule does not apply to SSH.

Answer

The DROP rule is misconfigured with wrong source.

Answer

The default policy allows traffic, overriding the DROP rule.

Question 17

A software developer wants to ensure the authenticity and integrity of an API request but does not require non-repudiation. Which cryptographic method should be used?

Accepted Answer

Hash-based message authentication code (HMAC). HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. This ensures both authenticity (the request came from a party knowing the key) and integrity (the data has not been altered) without providing non-repudiation, because the same key is shared between sender and receiver, so the receiver could also have generated the tag.

Answer

Digital signature using RSA

Answer

Symmetric encryption with CBC mode

Answer

Elliptic curve Diffie-Hellman (ECDH)

Question 18

What is the primary purpose of account deprovisioning in the account lifecycle?

Accepted Answer

To immediately disable accounts and preserve evidence. Deprovisioning is the formal process of removing a user's access when they leave or change roles. Its primary purpose is to immediately disable accounts to prevent unauthorized access while preserving the account and associated data as evidence for audits, investigations, or legal holds.

Answer

To modify user roles and permissions

Answer

To enforce password policies

Answer

To create new user accounts

Question 19

A user reports that their computer is displaying a fake antivirus warning that demands payment. This is an example of which type of attack?

Accepted Answer

Scareware. Scareware is a type of malware that uses social engineering to trick users into believing their system is infected, then demands payment for a fake removal tool. The fake antivirus warning is a classic scareware tactic, as it creates urgency and fear to coerce payment, unlike ransomware which encrypts files and demands a ransom for decryption.

Answer

Social engineering

Answer

Ransomware

Answer

Phishing

Question 20

A DevOps team implements a CI/CD pipeline for a web application. Which security control is BEST to ensure that only properly reviewed code reaches production?

Accepted Answer

Require a manual approval gate before deployment. Requiring a manual approval gate ensures a human has reviewed the code before deployment, which is the best way to ensure only properly reviewed code reaches production. Option A is wrong because SAST (static application security testing) is automated and may miss logic flaws or business logic issues that require human review. Option C is wrong because automated unit and integration tests verify functionality but do not constitute a code review; they can pass even if the code has logic errors or security issues not covered by tests. Option D is wrong because code signing ensures the integrity and authenticity of artifacts but does not involve reviewing the code content for correctness or security.

Answer

Run static application security testing (SAST) in the pipeline

Answer

Run automated unit tests and integration tests

Answer

Implement code signing for all artifacts