SSCP Practice Exam 52 — 20 Questions

Question 1

Which TWO of the following cryptographic algorithms are considered secure for modern use?

Accepted Answer

ChaCha20. ChaCha20 (option B) and AES-256 (option C) are considered secure for modern use. DES, RC4, and MD5 are broken or deprecated.

Answer

MD5 (Message Digest 5)

Answer

RC4 (Rivest Cipher 4)

Answer

DES (Data Encryption Standard)

Question 2

A developer wants to ensure that a web application is protected against cross-site request forgery (CSRF). Which mitigation technique is most commonly recommended?

Accepted Answer

Use anti-CSRF tokens in forms.. Anti-CSRF tokens are unique per session and validated on state-changing requests, ensuring the request originated from the legitimate site. Option A (Content Security Policy) mitigates XSS, not CSRF. Option B (HTTP Strict Transport Security) enforces HTTPS. Option C (sanitize user input) is for injection attacks. Option E (Cross-Origin Resource Sharing) controls cross-origin reads.

Answer

Implement a Content Security Policy (CSP).

Answer

Enable HTTP Strict Transport Security (HSTS).

Answer

Sanitize all user input.

Answer

Implement Cross-Origin Resource Sharing (CORS) headers.

Question 3

An organization is migrating its on-premises applications to a cloud provider. Which of the following security controls should be implemented to protect data at rest in the cloud?

Accepted Answer

Enable server-side encryption on storage services.. Enable server-side encryption on storage services. Server-side encryption ensures data is encrypted at rest by the cloud provider, protecting it from unauthorized access even if storage media is compromised. Option A (multi-factor authentication) protects access but not data at rest. Option B (network segmentation) primarily protects data in transit and network boundaries. Option C (access keys for API authentication) is for identity and access management, not data encryption. Option D (CloudTrail or equivalent audit logging) provides detective controls, not data protection at rest.

Answer

Implement multi-factor authentication for all users.

Answer

Configure network segmentation using VPCs.

Answer

Use access keys for API authentication.

Answer

Enable CloudTrail or equivalent audit logging.

Question 4

A small financial services company has deployed a SIEM solution collecting logs from their firewall, web server, and domain controller. They also have an IDS monitoring the network perimeter. The security analyst receives an alert from the IDS indicating a potential exploit attempt against the web server from an external IP. The analyst checks the SIEM and sees that the firewall log shows the connection was allowed, but the web server log does not show any corresponding request. The domain controller logs show no abnormal activity. The company has a policy to immediately contain any confirmed threats. What should the analyst do first based on this information?

Accepted Answer

Verify the web server's integrity by checking for filesystem changes or anomalous processes. The IDS alert indicates a possible exploit, but the missing web server log suggests the request may have been blocked or the IDS generated a false positive. However, the firewall allowed the connection, so it is possible the traffic reached the web server but the log entry is missing or delayed. The safest first step is to verify the web server's integrity by checking for signs of compromise (Option C). Immediately blocking the external IP (Option B) might disrupt legitimate traffic if the alert is false. Rebooting (Option A) could destroy forensic evidence. Escalating (Option D) without verification wastes time.

Answer

Reboot the web server to clear any potential memory-resident malware

Answer

Block the external IP at the firewall

Answer

Escalate the alert to the incident response team

Question 5

A small business experienced a ransomware attack that encrypted all files on the file server. They have no backups. The attacker demands a ransom. The CEO asks for advice. Which recommendation should the incident responder give?

Accepted Answer

Contact law enforcement and attempt decryption from public tools. Contacting law enforcement and attempting decryption using public tools (such as those from the No More Ransom project) is the recommended first step. Law enforcement can provide guidance and may have decryption keys. Paying the ransom (C) is discouraged as it funds criminals and does not guarantee data recovery. Wiping the server and restoring from cloud sync (B) is not possible because no backups exist. Reinstalling the OS and rebuilding data manually (D) is extremely time-consuming and likely infeasible without backups.

Answer

Wipe the server and restore from the cloud sync if available

Answer

Pay the ransom immediately to regain access

Answer

Reinstall the OS and rebuild data from manual copies

Question 6

An organization is implementing system hardening. Which of the following actions are recommended by CIS Benchmarks? (Select all that apply.)

Accepted Answer

Remove unnecessary services and accounts. CIS Benchmarks recommend removing unnecessary services and accounts (A) to reduce attack surface, disabling autorun and autoplay features (C) to prevent unauthorized code execution, and enabling User Account Control (UAC) (D) to enforce least privilege. These are all common system hardening recommendations.

Answer

Enable DHCP for all network interfaces

Answer

Disable the host-based firewall

Question 7

Which THREE of the following are common methods to identify risks in an organization?

Accepted Answer

Brainstorming.. Brainstorming is a common method for risk identification because it leverages group creativity to surface potential threats, vulnerabilities, and impacts that might not be captured by automated tools. In an organizational context, structured brainstorming sessions (e.g., using nominal group technique) help elicit a wide range of risks from diverse stakeholders, ensuring coverage across technical, operational, and strategic domains.

Answer

Hash verification.

Answer

Fault tree analysis.

Question 8

Which TWO of the following are examples of biometric authentication? (Choose two.)

Accepted Answer

Retina scan. Retina scan is a biometric authentication method because it uses unique physiological characteristics of the eye's retinal blood vessel pattern to verify identity. Biometric authentication relies on measurable biological traits, and the retina's pattern is highly distinctive and difficult to replicate, making it a strong form of authentication.

Answer

Smart card

Answer

Answer

Password

Question 9

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Accepted Answer

Check the server's running processes and established connections.. The first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Answer

Disconnect the server from the network.

Answer

Reboot the server to clear any malware.

Answer

Block the outbound traffic at the firewall.

Question 10

A company's policy requires that all data at rest be encrypted. Which of the following is the most effective method to encrypt files on a laptop?

Accepted Answer

Implement full disk encryption (FDE).. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, swap files, temporary files, and all user data. This ensures that if the laptop is lost or stolen, all data at rest is protected without relying on the user to selectively encrypt files or folders, which can leave sensitive data exposed in unencrypted system areas.

Answer

Encrypt only the user's home folder.

Answer

Encrypt individual files using a symmetric key.

Answer

Use a self-extracting encrypted archive.

Question 11

Refer to the exhibit. A user at IP 10.0.0.1 reports that they cannot access a web server at 203.0.113.5 on port 443. What is the most likely cause?

Accepted Answer

The firewall does not have a rule permitting outbound traffic.. The user at 10.0.0.1 cannot reach 203.0.113.5:443, which indicates that outbound traffic to that destination is not permitted. Firewalls by default block all traffic unless explicitly allowed; if no rule permits outbound HTTPS (TCP/443) traffic, the connection will be dropped. The symptom (inability to access an external web server) points to a missing outbound rule, not an inbound rule issue.

Answer

The firewall only permits inbound traffic to specific IPs.

Answer

The firewall rule order is incorrect.

Answer

The firewall blocks all outbound traffic.

Question 12

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

Accepted Answer

Quarterly. PCI DSS Requirement 11.2.1 mandates that internal vulnerability scans must be performed at least quarterly and after any significant change in the network. This frequency ensures that new vulnerabilities introduced since the last scan are identified and remediated before they can be exploited. Quarterly scans are a minimum; more frequent scanning is recommended for high-risk environments.

Answer

Annually

Answer

Monthly

Answer

Weekly

Question 13

Match each network security device to its function.

Accepted Answer

Firewall: Filters network traffic based on security rules.. Correct matches: Firewall filters traffic, IDS monitors and alerts, IPS monitors and blocks, VPN concentrator handles encryption. Common confusions: swapping firewall and IDS functions.

Answer

Firewall: Monitors traffic for suspicious activity and sends alerts.

Answer

IDS: Filters network traffic based on security rules.

Question 14

Match each cryptography term to its definition.

Accepted Answer

Symmetric Encryption: Uses the same key for encryption and decryption. Correct matches: Symmetric encryption uses one key; asymmetric uses a key pair; hashing produces fixed-size digests; digital signatures ensure non-repudiation. Common confusions include swapping symmetric/asymmetric definitions or treating hashing as encryption.

Answer

Symmetric Encryption: Uses a pair of keys (public and private)

Answer

Hashing: Used to encrypt data for confidentiality

Question 15

Match each security control type to its example.

Accepted Answer

Preventive: Firewall blocking unauthorized access. Common security control categories: Preventive controls stop incidents (e.g., firewall), Detective controls identify incidents (e.g., camera), Corrective controls remediate (e.g., backup restore), Deterrent controls discourage (e.g., warning sign). Distractors mix these roles.

Answer

Preventive: Log monitoring and alerts

Answer

Detective: Patching vulnerabilities

Question 16

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

Accepted Answer

Correlate high outbound DNS query volume with requests to newly registered or suspicious domains. DNS tunneling encodes data in DNS queries and responses, often generating a high volume of outbound queries to domains that are newly registered or otherwise suspicious. Correlating these two indicators—unusual query volume and suspicious domain characteristics—directly targets the behavior of DNS tunneling, making it the most effective rule for detecting this exfiltration technique.

Answer

Correlate multiple failed logins from a single IP

Answer

Alert on any single failed login attempt

Answer

Alert when a user accesses a file share after hours

Question 17

A security administrator needs to dispose of hard drives that contain sensitive data. Which method provides the highest assurance that data cannot be recovered?

Accepted Answer

Physically shredding the hard drives. Physical destruction (e.g., shredding, crushing) ensures that the storage media is no longer usable and data recovery is virtually impossible. Degaussing may destroy magnetic media but is less effective on SSDs. Overwriting requires multiple passes and may not be effective on all media types.

Answer

Deleting all files and emptying the recycle bin

Answer

Performing a quick format of the drive

Answer

Using a degausser to erase magnetic data

Question 18

A system administrator receives an alert from the SIEM indicating a possible brute-force attack on a server. The logs show 100 failed logins in 2 minutes from a single source. Which of the following is the best immediate action to verify and respond?

Accepted Answer

Check firewall logs for the source IP and block it in the firewall. The immediate priority is to stop the ongoing attack by blocking the source IP at the firewall. Checking firewall logs confirms the source IP and ensures the block is applied to the correct address, preventing further authentication attempts. This aligns with the principle of containment before remediation in incident response.

Answer

Immediately disable the user account that was targeted most

Answer

Reset all user passwords and enable multi-factor authentication

Answer

Ignore the alert because it is likely a false positive

Question 19

During a penetration test, a security analyst captures a packet containing a gratuitous ARP reply that associates the attacker's MAC address with the default gateway's IP address. This is a classic indicator of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) sends gratuitous ARP replies to redirect traffic, enabling man-in-the-middle attacks.

Answer

DHCP spoofing

Answer

MAC cloning

Answer

DNS poisoning

Question 20

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis