SSCP Practice Questions 2 — 50 Questions

Question 1

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

Accepted Answer

Recognizing phishing attempts. Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

Answer

Proper use of social media

Answer

Physical security procedures

Answer

Data backup procedures

Question 2

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise

Question 3

A financial services company has recently deployed a new customer-facing web application on port 443. The application is essential for client transactions. Within the first week, the security team's monitoring system detected thousands of failed login attempts originating from a wide range of IP addresses across multiple countries. The attempts are using common usernames and passwords, indicating a coordinated brute-force attack. The company's perimeter firewall is configured with a default allow rule for inbound TCP traffic on port 443 to the web server's public IP address. The company operates with a small IT team and has a limited security budget. The web application is custom-developed and cannot be modified quickly. The security analyst must recommend a solution to mitigate the attack while maintaining availability for legitimate users. Which of the following is the most effective first step?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with rate limiting and CAPTCHA challenges. Deploying a Web Application Firewall (WAF) with rate limiting and CAPTCHA is the most effective solution because it can identify and block malicious traffic patterns without requiring application changes. It operates at the application layer and can enforce policies such as rate limiting per IP, geolocation blocking, and CAPTCHA challenges, which directly mitigate brute-force attacks while minimizing impact on legitimate users. Other options are less effective: IP blacklisting is reactive and cannot handle distributed attacks; changing ports only provides obscurity; enabling SSH does not address the web application attack.

Answer

Implement IP blacklisting by manually adding offending IP addresses to the firewall's deny list

Answer

Change the web server port from 443 to a non-standard high port

Answer

Enable SSH access to the web server for administrative purposes

Question 4

Drag and drop the steps for configuring a Windows Firewall rule to allow inbound RDP traffic into the correct order.

Accepted Answer

Create inbound rule for port 3389 → Allow connection → Select profiles → Name it. Windows Firewall: create inbound rule for port 3389, allow connection, select profiles, name it.

Answer

Create inbound rule for port 3389 → Select profiles → Allow connection → Name it

Answer

Allow connection → Create inbound rule for port 3389 → Select profiles → Name it

Answer

Name it → Create inbound rule for port 3389 → Allow connection → Select profiles

Question 5

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 6

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Accepted Answer

Perform memory forensics before disconnecting. Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Answer

Block the C2 IP at the perimeter

Answer

Shut down the host

Answer

Disconnect the host from the network immediately

Question 7

During a quantitative risk analysis, the asset value is $500,000, the exposure factor is 40%, and the annual rate of occurrence is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). SLE is asset value ($500,000) times exposure factor (40%) = $200,000. ALE = $200,000 × 0.5 = $100,000. This is the standard quantitative risk analysis formula per NIST SP 800-30.

Answer

$200,000

Answer

$500,000

Answer

$250,000

Question 8

A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?

Accepted Answer

Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.. Replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.

Answer

Continue using RC4 and accept the risk, since the network is isolated.

Answer

Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.

Answer

Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.

Question 9

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 10

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 11

Which of the following hash algorithms is considered cryptographically broken and should be avoided due to collision attacks?

Accepted Answer

MD5. MD5 is known to have collision vulnerabilities and is no longer considered secure.

Answer

SHA-3

Answer

SHA-256

Answer

HMAC-SHA256

Question 12

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 13

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 14

A system administrator needs to implement a control that ensures users can only access files necessary for their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege ensures that users are granted only the permissions necessary to perform their job functions, minimizing the attack surface and potential damage from accidental or malicious actions. In this scenario, restricting file access to only what is needed for job duties directly implements least privilege, as it limits access rights to the minimum required. This is distinct from need-to-know, which focuses on information disclosure rather than access permissions.

Answer

Need-to-know

Answer

Separation of duties

Answer

Job rotation

Question 15

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Accepted Answer

The user does not have the 'Allow log on through Remote Desktop Services' user right. The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer

The user account is locked out

Answer

The server is not a member of the domain

Answer

The user's Kerberos ticket has expired

Question 16

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 17

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Accepted Answer

Clients will receive a certificate warning or be unable to connect.. When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.

Answer

The server will automatically obtain a new certificate.

Answer

Clients will connect but with reduced cipher strength.

Answer

Clients will be able to connect without any warning.

Question 18

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 19

A security analyst notices an increase in failed login attempts from a single IP address. What is the best immediate action?

Accepted Answer

Check the SIEM for correlated events.. Checking the SIEM for correlated events (Option D) is the best immediate action because it allows the analyst to gather context around the failed login attempts—such as whether they target multiple accounts, originate from a known malicious IP, or coincide with other suspicious activity—before taking a potentially disruptive or irreversible step. This aligns with the incident response principle of 'verify before you act,' ensuring the response is proportional and informed by correlated data from multiple sources.

Answer

Run an antivirus scan.

Answer

Disable the user accounts.

Answer

Block the IP at the firewall.

Question 20

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration