SSCP Practice Exam 51 — 20 Questions

Question 1

A security engineer is evaluating cloud security tools. Which TWO of the following are primarily used to protect cloud workloads? (Select two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). CWPP provides runtime security for cloud VMs and containers. WAF protects web applications from attacks like SQL injection and XSS. CSPM focuses on misconfiguration detection, not workload runtime. IAM manages identities. SIEM aggregates logs but is not workload-specific.

Answer

Identity and Access Management (IAM)

Answer

Cloud Security Posture Management (CSPM)

Answer

Security Information and Event Management (SIEM)

Question 2

During a security assessment, you discover that a Windows server has the Telnet service running. Which of the following is the BEST action to harden the server against this finding?

Accepted Answer

Remove the Telnet service and use SSH instead. Telnet is an unencrypted protocol that transmits credentials in cleartext. Removing unnecessary services reduces the attack surface; disabling Telnet eliminates a known vulnerability.

Answer

Configure a host-based firewall to allow Telnet only from specific IPs

Answer

Enable encryption on Telnet

Answer

Audit Telnet connections in Event Viewer

Question 3

A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?

Accepted Answer

Use Windows Event Forwarding to a central event collector. Centralized logging with a SIEM (or similar) aggregates logs from multiple sources. Forwarding events to a central collector ensures logs are preserved even if a server is compromised.

Answer

Store logs only on the local server and back them up weekly

Answer

Configure Event Viewer on each server to overwrite events as needed

Answer

Enable auditing of account logon events

Question 4

According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?

Accepted Answer

Data classification and access controls. In SaaS, the customer is responsible for securing their data, including classification, access controls, and encryption of data at rest and in transit.

Answer

Physical security of data centers

Answer

Securing the application code

Answer

Managing the underlying operating system

Question 5

During a security assessment, a penetration tester successfully performs a DHCP starvation attack followed by a DHCP spoofing attack. Which TWO outcomes are the most likely consequences of this combined attack?

Accepted Answer

Clients' default gateway and DNS servers are set to attacker-controlled addresses. DHCP starvation exhausts the IP pool, forcing clients to accept offers from a rogue DHCP server. The rogue server provides malicious gateway and DNS, enabling traffic interception and redirection.

Answer

The attacker can perform ARP spoofing on the network

Answer

The attacker gains administrative access to domain controllers

Answer

All network traffic is encrypted using TLS

Question 6

A cloud security architect is designing a solution to protect workloads running in a public cloud. Which THREE of the following are key security controls that should be implemented?

Accepted Answer

Deploy a Cloud Security Posture Management (CSPM) tool. IAM roles control permissions for cloud resources. CSPM detects misconfigurations. CWPP provides runtime protection for workloads.

Answer

Store encryption keys in the same cloud region as the data

Answer

Disable multi-factor authentication for service accounts

Question 7

Which of the following tools would best help a security team detect misconfigurations in a cloud environment, such as open storage buckets or overly permissive IAM roles?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM tools are specifically designed to identify cloud misconfigurations, including storage bucket permissions and IAM roles, and often provide remediation guidance.

Answer

Web Application Firewall (WAF)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Event Viewer

Question 8

A company is deploying virtual machines (VMs) in a private cloud environment. To prevent VM escape attacks, which of the following is the most critical security control?

Accepted Answer

Regularly patching the hypervisor software. VM escape attacks exploit vulnerabilities in the hypervisor to break out of a VM. Keeping the hypervisor patched is the primary defense against known vulnerabilities.

Answer

Using a separate management network for the hypervisor

Answer

Disabling unnecessary VM guest tools

Answer

Implementing a host-based firewall on each VM

Question 9

A company wants to implement multi-factor authentication (MFA) for remote access. Which THREE of the following are examples of different authentication factors? (Choose THREE.)

Accepted Answer

Hardware token and fingerprint. Multi-factor authentication requires two or more distinct factors from different categories: knowledge, possession, and inherence. Option A combines a hardware token (possession) and a fingerprint (inherence) - two different factors. Option C combines a smart card (possession) and a PIN (knowledge) - two different factors. Option E combines a password (knowledge) and a one-time passcode from a token (possession) - also two different factors. Options B and D each use factors from the same category: B uses two inherence factors, and D uses two knowledge factors. Therefore, the three correct answers are A, C, and E.

Answer

Retina scan and iris scan

Answer

Password and security question

Question 10

A system administrator is configuring a Linux server to ensure that only authorized users can execute commands with superuser privileges. Which file should be edited to control sudo access?

Accepted Answer

/etc/sudoers. The /etc/sudoers file defines which users can run commands with elevated privileges.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 11

A company's incident response plan includes a step to preserve evidence. Which action BEST ensures the integrity of forensic evidence?

Accepted Answer

Create a forensic image with write blocker and hash. Creating a forensic image with a write blocker ensures that the original data is not altered during acquisition, and hashing (e.g., SHA-256) provides a cryptographic integrity check that can later verify the image is an exact bit-for-bit copy. This preserves the chain of custody and admissibility of evidence in legal proceedings.

Answer

Turn off the system immediately

Answer

Copy files to a network share

Answer

Run a checksum on the live system

Question 12

During a vulnerability scan, a security team discovers that several virtual machine snapshots contain outdated software with known vulnerabilities. Which risk is most directly associated with this scenario?

Accepted Answer

Vulnerability reintroduction. VM snapshots, if left inactive and not patched, can reintroduce vulnerabilities when the snapshot is used to provision new VMs, as the software is outdated.

Answer

Resource exhaustion

Answer

VM sprawl

Answer

VM escape

Question 13

A security analyst is reviewing Linux audit logs with auditd. Which TWO events would be of greatest concern for a server that should not have interactive logins? (Select TWO.)

Accepted Answer

Successful root login via SSH. Failed login attempts indicate brute force; successful root login indicates unauthorized access.

Answer

System reboot logs

Answer

Successful cron job execution

Answer

File permission changes by a non-root user

Question 14

A security analyst is reviewing application security and identifies risks related to the OWASP Top 10. Which THREE are examples of OWASP Top 10 vulnerabilities? (Select THREE.)

Accepted Answer

Security Misconfiguration. Injection, XSS, and Security Misconfiguration are classic OWASP Top 10 categories.

Answer

Man-in-the-Middle (MitM)

Answer

Buffer overflow

Question 15

A security auditor is reviewing the configuration of a remote access VPN. Which TWO features are considered best practices for securing the VPN connection?

Accepted Answer

Implementing multi-factor authentication (MFA). Multi-factor authentication (MFA) adds an extra layer of security beyond passwords, reducing the risk of unauthorized access. TLS 1.3 with mandatory forward secrecy ensures that session keys are not compromised even if the server's private key is later exposed, providing strong encryption. Both are established best practices for securing remote access VPNs.

Answer

Using IKEv2 with pre-shared keys only

Answer

Disabling encryption to reduce latency

Answer

Enabling split tunneling for all traffic to improve performance

Question 16

Refer to the exhibit. A security administrator notices repeated events with the same failure reason for the Administrator account. What is the MOST likely type of attack?

Accepted Answer

Brute force. (Brute force) is correct because repeated failed logins for a single account (Administrator) indicate an attacker systematically trying different passwords. Option A (Spear phishing) is wrong; it involves targeted deceptive messages, not repeated login attempts. Option B (Password spraying) is wrong; it uses a few common passwords across many accounts, not many attempts on one account. Option D (Denial of service) is wrong; it aims to disrupt service, not gain access.

Answer

Spear phishing

Answer

Password spraying

Answer

Denial of service

Question 17

An organization has implemented a SIEM solution and wants to reduce false positives. Which of the following is the most effective approach?

Accepted Answer

Tune correlation rules to exclude known benign activities. The most effective because tuning correlation rules to exclude known benign activities directly reduces false positives by filtering out events that are known to be non-threatening. Option B is not effective because adding more log sources can increase the volume of data and potentially introduce more noise, exacerbating the false positive problem. Option C (raising thresholds) may reduce alerts but can also cause true threats to be missed, and it does not target known false positive patterns. Option D is inefficient and does not reduce false positives; it only addresses the symptoms by requiring more manual review.

Answer

Increase the number of log sources feeding the SIEM

Answer

Raise the threshold for each correlation rule to reduce alerts

Answer

Assign more analysts to manually review all alerts

Question 18

A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?

Accepted Answer

Enforce a formal approval process via a change advisory board. A formal approval process via a change advisory board (CAB) ensures that all changes are reviewed and authorized before implementation, which is the most important preventive control. Option A is wrong because a staging environment, while useful for testing, does not prevent unauthorized changes. Option C is wrong because notifying users is a communication step, not a preventive control. Option D is wrong because a documented backout plan is important for recovery, but it does not prevent unauthorized changes.

Answer

Implement a staging environment to test all changes

Answer

Notify all users before the change window

Answer

Require a documented backout plan for every change

Question 19

A company uses a Cloud Workload Protection Platform (CWPP) to secure IaaS workloads. They discover that a virtual machine (VM) is communicating with a known command-and-control server. What is the FIRST action the security team should take?

Accepted Answer

Immediately isolate the VM by removing it from the network. The first priority is to stop the malicious communication and prevent lateral movement. Isolating the VM immediately contains the threat. Option B (run antivirus) is not the first action because the infection is already active; scanning can be done after isolation. Option C (terminate VM) is too aggressive and may cause data loss without forensic investigation. Option D (analyze logs) is important but should follow containment.

Answer

Run an antivirus scan on the VM to remove the malware

Answer

Terminate the VM and create a new one from a clean image

Answer

Analyze the traffic logs to determine the scope of the compromise

Question 20

A database administrator notices unusual queries that seem to be trying to extract data via SQL injection. The application uses parameterized queries for most queries, but some dynamic queries are built using string concatenation. What is the BEST remediation?

Accepted Answer

Rewrite all dynamic queries to use parameterized queries. Rewriting all dynamic queries to use parameterized queries separates SQL code from user data, effectively preventing SQL injection. Option A (restricting permissions) reduces damage but does not stop injection. Option B (input validation) is helpful but can be bypassed if concatenation remains. Option C (WAF) is a detection/blocking measure, not a code-level fix.

Answer

Restrict database user permissions to only necessary tables

Answer

Implement strict input validation for all user inputs

Answer

Deploy a web application firewall (WAF) in front of the application