SSCP Practice Exam 51 — 20 Questions

Question 1

Which THREE of the following are types of application security testing that should be included in a secure SDLC?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (A) is correct because it analyzes source code, bytecode, or binaries without executing the application, catching flaws like injection or hardcoded secrets early in the secure SDLC. Penetration testing (B) is correct because it simulates real attacker techniques against the running system to validate exploitable vulnerabilities and the effectiveness of controls. Dynamic application security testing (DAST) (D) is correct because it tests the application in its running state, exercising inputs and observing responses to find runtime issues such as authentication, session, and configuration flaws. User acceptance testing (C) is excluded because it verifies business requirements and usability, not security weaknesses, and load testing (E) is excluded because it measures performance, scalability, and stability under stress rather than identifying security defects.

Answer

User acceptance testing (UAT)

Answer

Load testing

Question 2

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Accepted Answer

Patching the vulnerability that was exploited. Patching the exploited vulnerability (Option A) is the most critical additional step because it removes the root cause of the infection. Without patching, the same attack vector (e.g., an unpatched SMB vulnerability like EternalBlue) remains open, allowing the malware to reinfect the system immediately after cleanup. Eradication is incomplete if the underlying flaw is not addressed, as the attacker can simply re-exploit the same weakness.

Answer

Running a full antivirus scan

Answer

Resetting all user passwords

Answer

Reimaging the system with a clean OS

Question 3

Which TWO of the following are functions of a network firewall?

Accepted Answer

Filtering traffic based on IP addresses and ports. A network firewall's primary function is to enforce access control policies by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (ports) information. This stateless or stateful inspection allows the firewall to permit or deny packets according to rules, such as allowing HTTP traffic (TCP port 80) from a specific source IP. This is a core security mechanism to segment networks and block unauthorized access.

Answer

Resolving domain names to IP addresses

Answer

Encrypting data at rest

Answer

Assigning IP addresses to hosts

Question 4

A network analyst reviews firewall logs and sees multiple SYN packets to various ports from the same external IP in a short time, with no subsequent ACK. What is the most likely cause?

Accepted Answer

Port scan using SYN scan technique. A SYN scan sends SYN packets to multiple ports; if a port is open, the target responds with SYN-ACK, but the scanner never completes the handshake (no ACK). The absence of ACK packets after the SYN packets indicates the scanner is not establishing connections, which is characteristic of a SYN scan, not a brute force or DDoS attack.

Answer

Brute force password attack on SSH

Answer

Distributed denial-of-service (DDoS) attack

Answer

ICMP ping sweep

Question 5

A security analyst notices that an employee's account has been sending large amounts of data to an external IP address during non-business hours. The analyst suspects the employee's credentials have been compromised. What is the FIRST step the analyst should take according to incident response procedures?

Accepted Answer

Disable the employee's user account.. Disabling the employee's user account immediately stops the unauthorized activity and prevents further data exfiltration, as per incident response procedures. Option A is wrong; blocking the external IP address may not stop the attacker if they have other methods or can change IPs. Option C is wrong; informing the manager is important but not the first action, as containment is the priority. Option D is wrong; contacting law enforcement is premature before containing the incident and gathering evidence.

Answer

Block the external IP address at the firewall.

Answer

Contact law enforcement.

Answer

Inform the employee's manager.

Question 6

A security administrator receives an alert about a potential SYN flood attack on a web server. At which OSI layer does this attack occur?

Accepted Answer

Layer 4 (Transport). A SYN flood attack exploits the TCP three-way handshake by sending a barrage of SYN packets without completing the handshake, exhausting server resources. This attack targets the Transport Layer (Layer 4), where TCP operates, as defined in RFC 793. The security administrator's alert specifically involves TCP SYN segments, which are Layer 4 protocol data units.

Answer

Layer 7 (Application)

Answer

Layer 3 (Network)

Answer

Layer 2 (Data Link)

Question 7

A company uses a SOAR platform for incident response. Which factor is most critical for effective automation?

Accepted Answer

High-quality playbooks. High-quality playbooks are the most critical factor because SOAR automation relies on predefined, tested, and context-rich workflows to orchestrate response actions. Without accurate playbooks that map to specific incident types, automated actions can misidentify threats, execute incorrect containment steps, or fail to adapt to evolving attack patterns, rendering integrations and feeds ineffective.

Answer

Integration with all security tools

Answer

Low false positive rate

Answer

Real-time threat intelligence feeds

Question 8

Which TWO of the following are appropriate actions when preserving digital evidence at a crime/incident scene?

Accepted Answer

Document all actions taken. Documenting all actions taken (Option A) is a fundamental principle of digital forensics, as it creates a verifiable chain of custody and ensures the integrity of evidence. This documentation includes timestamps, tools used, and any changes made to the system, which is critical for admissibility in legal proceedings. Without proper documentation, the evidence may be challenged as tampered or unreliable.

Answer

Connect to the internet to check online resources

Answer

Use the system to check files

Answer

Power off the system immediately

Question 9

Based on the exhibit, which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The exhibit shows a URL parameter containing SQL injection syntax (DROP TABLE users;). The %22%3B%20 sequence decodes to "; " which is used to break out of a SQL query. The destination is an internal host (10.0.0.100), likely a web application server. A status code of 500 indicates a server error, possibly due to the malicious input. Thus, SQL injection (Option D) is correct. The other options do not match the pattern.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

Buffer overflow

Question 10

Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks and their treatment. The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Answer

To record all security incidents after they occur

Answer

To track changes made to system configurations

Answer

To automatically detect vulnerabilities in the network

Question 11

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Accepted Answer

Run a full antivirus and anti-malware scan on the restored systems. Option C is correct because running a full antivirus and anti-malware scan on the restored systems is a direct verification step that checks the restored data and OS for any residual malware, ransomware payloads, or infected files before the systems are trusted again. Option E is correct because monitoring the restored systems for reinfection or anomalous behavior over a period of time provides ongoing validation that no dormant persistence mechanisms, scheduled tasks, or command-and-control callbacks survived the recovery process. Option A is not a verification action; restoring from the most recent backup is a recovery step, and that backup itself may contain the ransomware or an earlier compromise. Option B does not verify system cleanliness; changing user passwords is a containment/credential-hygiene measure and does nothing to detect malware on the restored hosts. Option D is also not a verification step; applying OS security patches remediates known vulnerabilities but does not confirm that the restored systems are free of the ransomware or other malware.

Answer

Restore the systems from the most recent backup

Answer

Change all user passwords associated with the systems

Answer

Apply all security patches to the operating system

Question 12

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database by monitoring DHCP traffic on untrusted ports. By enabling DHCP snooping on the switch, only DHCP servers connected to trusted ports can assign IP addresses, preventing rogue DHCP server attacks.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 13

An organization wants to allow secure remote access for employees. Which protocol is most appropriate for a site-to-site VPN?

Accepted Answer

IPsec. IPsec is the correct choice for a site-to-site VPN because it operates at the network layer (Layer 3), providing encryption and authentication for all IP traffic between two entire networks. It supports both tunnel and transport modes, and uses protocols like ESP (Encapsulating Security Payload) and AH (Authentication Header) to ensure confidentiality, integrity, and origin authentication, making it the standard for permanent site-to-site connections.

Answer

PPTP

Answer

SSL/TLS

Answer

SSH

Answer

L2TP

Question 14

Which TWO of the following are primary purposes of a risk register?

Accepted Answer

Track the status of risk treatment plans. A risk register is a living document used to track the status of risk treatment plans, including whether controls have been implemented, are in progress, or are overdue. This ensures that risk owners are accountable and that residual risk is managed over time. Option B is correct because the primary function of a risk register is to document identified risks along with their characteristics, such as probability, impact, risk score, and owner. These two functions are core to the risk management process as defined by frameworks like NIST SP 800-37 and ISO 31000.

Answer

Record network traffic logs

Answer

Store vulnerability scan results

Answer

Provide a checklist for compliance audits

Question 15

Which of the following is a secure alternative to RC4 for stream ciphers?

Accepted Answer

ChaCha20. ChaCha20 is a modern, high-speed stream cipher designed by Daniel J. Bernstein as a secure alternative to RC4, which has known vulnerabilities such as biases in its keystream and susceptibility to attacks like the Fluhrer-Mantin-Shamir attack. ChaCha20 is standardized in RFC 8439 and is widely used in TLS 1.3 and SSH, offering strong security and performance without the weaknesses of RC4.

Answer

MD5

Answer

AES in ECB mode

Answer

3DES

Question 16

An organization has detected a ransomware infection on a critical file server. The incident response team has been activated. Which TWO actions should be performed FIRST during the initial response phase?

Accepted Answer

Immediately disconnect the file server from the network. Immediately disconnecting the file server from the network is a critical containment action that stops the ransomware from encrypting additional files on the server and prevents lateral movement to other systems. This aligns with the first priority in incident response: containment before eradication or recovery. Disconnecting at the switch port or disabling the network interface card (NIC) is preferred over a graceful shutdown to avoid triggering any persistence mechanisms.

Answer

Determine the type of ransomware variant

Answer

Reimage the file server using a known good backup

Answer

Notify law enforcement authorities

Question 17

Which TWO of the following are examples of vulnerability sources? (Choose TWO.)

Accepted Answer

Configuration weaknesses. The SSCP exam distinguishes threat sources from vulnerability sources. A vulnerability source is the origin or category from which a weakness arises, such as configuration weaknesses or software flaws. CVE entries are a standardized reference/dictionary of publicly disclosed vulnerabilities, not a source category of vulnerabilities themselves. Environmental disaster, intentional human attack, and hardware failure are threat sources or threat events, not vulnerability sources. Therefore the only valid vulnerability source among the options is Configuration weaknesses (E).

Answer

Environmental disaster

Answer

CVE entries

Answer

Intentional human attack

Answer

Hardware failure

Question 18

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

Accepted Answer

Implement a break-glass procedure for emergency access.. A break-glass procedure provides a predefined, auditable method for granting emergency privileged access without requiring real-time manager approval. This balances security with operational continuity, allowing analysts to perform critical changes outside business hours while maintaining accountability through post-event review and logging.

Answer

Extend manager on-call hours to cover all times.

Answer

Remove the approval requirement for privileged access.

Answer

Require analysts to call a manager for approval each time.

Question 19

Which metric is used to measure the potential loss from a single occurrence of a risk?

Accepted Answer

Single Loss Expectancy (SLE). The Single Loss Expectancy (SLE) is the metric used to measure the potential loss from a single occurrence of a risk. It is calculated as Asset Value (AV) multiplied by the Exposure Factor (EF), providing a dollar value for one incident. This directly answers the question of loss per single event.

Answer

Exposure Factor (EF)

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 20

An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?

Accepted Answer

End-entity certificate, intermediate CA certificate, and root CA certificate. In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.

Answer

Only the root CA certificate

Answer

Only the end-entity certificate and the root CA certificate

Answer

Only the end-entity certificate and the intermediate CA certificate