SSCP Practice Exam 53 — 20 Questions

Question 1

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

Accepted Answer

Patch prioritization based on CVSS score and asset criticality. Patch prioritization based on CVSS score and asset criticality ensures that resources are allocated to the most impactful vulnerabilities first. CVSS provides a standardized severity rating (0-10), while asset criticality accounts for the business value and exposure of the system, enabling risk-based decision-making rather than a one-size-fits-all approach.

Answer

Immediate deployment of all patches without testing

Answer

Annual review of patch status

Question 2

During a wireless penetration test, an attacker captures the four-way handshake of a WPA2-PSK network and attempts to crack the passphrase offline. Which attack is the attacker likely using?

Accepted Answer

Evil twin attack. In the given scenario, the attacker captures the four-way handshake of a WPA2-PSK network. The most likely method to capture such a handshake is an evil twin attack, where the attacker sets up a rogue access point impersonating a legitimate network. Once a client connects to the rogue AP, the attacker captures the handshake and can then attempt to crack the passphrase offline using dictionary or brute-force attacks.

Answer

WPS PIN attack

Answer

KRACK attack

Answer

PMKID attack

Question 3

A company is implementing a Single Sign-On (SSO) solution that uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider. Which protocol is being used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 4

You are a security analyst at a financial institution. The company uses a role-based access control (RBAC) system for its internal banking application. Recently, the compliance team discovered that a teller, who should only have access to customer account information for their branch, was able to view account details for customers in other branches. The RBAC system assigns roles based on job titles. You review the configuration and find that the 'Teller' role has a permission that allows viewing all customer accounts, regardless of branch. The company wants to enforce branch-level restrictions. Which of the following is the best approach to address this issue?

Accepted Answer

Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.. ABAC extends RBAC by evaluating attributes (e.g., branch location) at access time, enabling fine-grained per-branch restrictions without role explosion. Option B is incorrect: MAC with labels would require re-labeling all accounts and users, which is complex and less flexible than ABAC for this dynamic requirement. Option C is incorrect because creating separate roles per branch leads to role explosion (many roles to manage) and does not scale well. Option D is insufficient because simply removing the permission to view all accounts would prevent tellers from seeing any branch data; they need branch-specific access, not a global removal.

Answer

Use mandatory access control (MAC) with labels for each customer account.

Answer

Create separate roles for each branch, such as 'Teller_Branch1', 'Teller_Branch2', etc.

Answer

Modify the 'Teller' role to remove the permission to view all accounts.

Question 5

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Answer

Strong password policy

Answer

Asset tracking software

Answer

Remote wiping capability

Question 6

A security team is implementing User Behavior Analytics (UBA) to detect insider threats. Which THREE types of activities would most likely indicate a compromised account?

Accepted Answer

Accessing systems not normally used by the user. Accessing systems not normally used by the user (A) is a strong indicator of a compromised account because User Behavior Analytics (UBA) builds a baseline of each user's typical access patterns, including which servers, applications, or network segments they routinely interact with. A deviation from this baseline—such as authenticating to a system outside the user's job function—triggers an anomaly score, as it suggests an attacker is using stolen credentials to move laterally. This aligns with the MITRE ATT&CK technique T1078 (Valid Accounts) and is a core detection signal in UBA platforms like Splunk UBA or Microsoft Sentinel UEBA.

Answer

Logging in during normal business hours from a known workstation

Answer

Printing a document

Question 7

A security administrator is implementing an access control model that assigns permissions based on the clearance of the subject and the classification of the object. Which model is being implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) uses labels for subjects (clearance) and objects (classification) to enforce access decisions, commonly used in government and military environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 8

An organization requires users to authenticate using a password and a one-time code from a mobile app. Which authentication method is being used?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) generates a temporary code that changes every 30-60 seconds, commonly used with mobile apps like Google Authenticator.

Answer

Smart card

Answer

Hardware token

Answer

Biometrics

Question 9

A security engineer is designing a system that must ensure data integrity at all costs, even if it means sacrificing availability. Which access control model and corresponding principle should be applied?

Accepted Answer

Biba with no write-up and no read-down. Biba is a MAC model that focuses on integrity, preventing subjects from writing to higher integrity levels (no write-up) and preventing subjects from reading lower integrity levels (no read-down). This can impact availability.

Answer

Bell-LaPadula with no read-down

Answer

Biba with no read-up

Answer

Bell-LaPadula with no write-up

Question 10

A security analyst is reviewing a digital signature implementation. The signer uses their private key to encrypt the hash of a message. What does the recipient use to verify the signature?

Accepted Answer

The signer's public key. Digital signatures use asymmetric cryptography where the signer encrypts the message hash with their private key. The recipient decrypts that encrypted hash using the signer's public key, then compares it to a locally computed hash of the received message. If they match, the signature is verified, proving both authenticity and integrity.

Answer

The recipient's private key

Answer

The signer's private key

Answer

The recipient's public key

Question 11

In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?

Accepted Answer

Identity Provider (IdP). In federated identity, the Identity Provider (IdP) is the home domain that authenticates the user and issues assertions. The Service Provider (SP) trusts the IdP's authentication.

Answer

Relying Party

Answer

Service Provider (SP)

Answer

Kerberos Distribution Center (KDC)

Question 12

An organization uses an ABAC system to control access to documents. Policies are defined using attributes such as user department, document classification, and time of day. Which of the following is an example of an ABAC policy rule?

Accepted Answer

If user.department == 'HR' AND doc.classification == 'Confidential' AND time.business_hours == true then permit read.. ABAC policies use conditions based on subject, object, and environment attributes. The rule combines department, classification, and time.

Answer

The owner of a document can grant read access to any other user.

Answer

Users in the 'HR' role can read documents classified as 'Confidential'.

Answer

All users with security clearance 'Secret' can read documents labeled 'Secret'.

Question 13

Which term describes the process of verifying the identity of a user, system, or entity?

Accepted Answer

Authentication. Authentication is the process of verifying that a claimed identity is valid, typically using factors like passwords, biometrics, or tokens.

Answer

Authorization

Answer

Identification

Answer

Accountability

Question 14

Which access control model enforces the principle of least privilege by granting permissions based on job functions and requires separation of duties?

Accepted Answer

Role-Based Access Control (RBAC). RBAC assigns permissions to roles, and users are assigned to roles, enabling least privilege and separation of duties through role design.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 15

A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the subject, object, and environment to make access decisions, offering fine-grained and dynamic control.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 16

Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?

Accepted Answer

Smart card and PIN. A smart card (something you have) combined with a PIN (something you know) is a classic MFA implementation.

Answer

Fingerprint and retina scan

Answer

Password and security question

Answer

Username and password

Question 17

In a biometric system, the point at which the false rejection rate (FRR) equals the false acceptance rate (FAR) is known as the:

Accepted Answer

Crossover error rate (CER). The crossover error rate (CER), also called the equal error rate (EER), is where FAR and FRR are equal, indicating overall accuracy.

Answer

False acceptance rate (FAR)

Answer

Failure to enroll rate

Answer

False rejection rate (FRR)

Question 18

A security analyst is evaluating a biometric system. The system currently has a high number of false rejections. Which metric is most directly related to this issue?

Accepted Answer

False Rejection Rate (FRR). False Rejection Rate (FRR) measures the likelihood that an authorized user is incorrectly denied access. A high FRR indicates many false rejections.

Answer

False Acceptance Rate (FAR)

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Question 19

A security administrator is configuring password policies to meet compliance. Which combination of settings provides the strongest protection against brute-force attacks?

Accepted Answer

Minimum 12 characters, complexity required, lockout after 5 attempts, history of 10. Longer passwords with complexity and account lockout significantly increase the time required for brute-force attacks, while history prevents reuse. Short expiry (e.g., 30 days) also helps, but length and lockout are most effective.

Answer

Minimum 10 characters, no complexity, lockout after 3 attempts, history of 1

Answer

Minimum 6 characters, complexity required, lockout after 10 attempts, history of 5

Answer

Minimum 8 characters, no complexity, no lockout, password history of 3

Question 20

Which authentication method generates a one-time password that is valid for only a short time window?

Accepted Answer

Time-based One-Time Password (TOTP). Time-based One-Time Password (TOTP) uses the current time to generate a code that expires after a short interval (e.g., 30 seconds).

Answer

Biometric scan

Answer

HMAC-based One-Time Password (HOTP)

Answer

Static password