SSCP Practice Exam 54 — 20 Questions

Question 1

A security administrator is implementing a formal data retention and destruction program for a financial services firm. The firm stores customer records, transaction logs, and email archives on a variety of media, including solid-state drives, magnetic tapes, and cloud object storage. Which TWO practices should the administrator include to ensure data is destroyed in a manner that is both effective and auditable? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define retention periods by data category and apply destruction only after the retention period expires and any legal hold is released.. An effective destruction program pairs documented retention rules with verifiable destruction evidence. Retention periods must reflect legal and business requirements, with destruction delayed until holds are released. Certificates of destruction provide the audit trail that proves media was destroyed properly. Using one overwrite tool for all media, delegating without assurance, or merely storing expired media fails to deliver either effective destruction or the documentation auditors require.

Answer

Delegate all destruction activities to the cloud service provider and rely on the provider's standard terms of service for assurance.

Answer

Use the same overwriting utility on all media types to simplify the destruction procedure and reduce training requirements.

Answer

Store all media in a locked room after the retention period expires until the media can be reused for other purposes.

Question 2

A security engineer is configuring an IPsec VPN between two offices to protect data in transit. The requirement is to ensure that packets cannot be modified or replayed by an attacker. Which security service should be enabled in the IPsec configuration?

Accepted Answer

Authentication Header (AH). The Authentication Header (AH) provides data integrity and authentication, and includes a sequence number to prevent replay attacks. In an IPsec VPN, AH ensures that packets cannot be altered in transit without detection. While ESP can also provide integrity and replay protection when configured with authentication, the scenario specifically asks for a service to prevent modification and replay, and AH is the dedicated protocol for that purpose. ESP is more commonly used because it also offers confidentiality, but AH alone meets the stated requirement.

Answer

Secure Hash Algorithm 2 (SHA-2) in tunnel mode

Answer

Internet Key Exchange (IKE) version 2

Answer

Encapsulating Security Payload (ESP) with confidentiality only

Question 3

Which TCP port is commonly used for secure web traffic (HTTPS) and is often allowed through firewalls for web browsing?

Accepted Answer

443. HTTPS uses TCP port 443 by default, as defined in RFC 2818. Firewalls commonly allow outbound TCP 443 to permit secure web browsing, and it is the standard port for TLS-encrypted HTTP traffic.

Answer

22

Answer

80

Answer

3389

Question 4

According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?

Accepted Answer

Data classification and access controls. In the shared responsibility model, the cloud provider always owns security *of* the cloud (physical facilities, hypervisor, host OS, and for SaaS the application itself), while the customer always owns security *in* the cloud — their data, identities, and access decisions. Data classification and access controls are therefore unambiguously customer responsibilities in every cloud service model, including SaaS. This is the one responsibility that never transfers to the provider.

Answer

Physical security of data centers

Answer

Securing the application code

Answer

Managing the underlying operating system

Question 5

A healthcare organization deploys a new electronic records system. Clinicians may access patient records only while assigned to the cardiology department, and access is automatically revoked when they rotate to oncology. Which access control model best supports this requirement?

Accepted Answer

Role-based access control (RBAC). The requirement ties access to a clinician's current department and revokes it upon rotation, which is precisely how role-based access control operates. Permissions are grouped into roles, and users receive access only through their assigned roles. When the cardiology role assignment is removed during rotation, access ends automatically, while the oncology role grants the appropriate new access. This makes RBAC the most natural and administratively efficient fit.

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Answer

Mandatory access control (MAC)

Question 6

A financial services firm wants to let customers authorize a third-party budgeting application to read their account transaction history without sharing their banking password. Which technology should the firm deploy?

Accepted Answer

OAuth 2.0. The scenario requires delegated authorization: a customer lets a third-party budgeting app read transaction history without revealing the banking password. OAuth 2.0 is built for this purpose, issuing scoped access tokens that the application presents to the resource server. The customer authenticates with the bank, approves specific scopes, and the app operates within those limits, so credentials are never shared and access can be revoked.

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Security Assertion Markup Language (SAML)

Answer

Kerberos

Question 7

A healthcare organization uses a mandatory access control (MAC) system to protect patient records. A nurse with a Secret clearance attempts to access a file classified as Top Secret. According to the Bell-LaPadula model, what will happen?

Accepted Answer

The access will be denied because the nurse's clearance is lower than the file's classification.. The Bell-LaPadula model is a mandatory access control model designed to protect confidentiality. Its no-read-up property states that a subject cannot read an object with a higher classification than the subject's clearance. Therefore, a nurse with Secret clearance cannot read a Top Secret file. The other options either misunderstand the need-to-know principle, incorrectly assume that an NDA or temporary upgrade can bypass the rule, or misstate the model's behavior.

Answer

The access will be allowed but the nurse will be required to sign an additional non-disclosure agreement.

Answer

The access will be denied because the nurse does not have Top Secret clearance, but the nurse can request a temporary upgrade.

Answer

The access will be allowed because the nurse has a legitimate need to know for patient care.

Question 8

A small business wants to implement single sign-on so employees can authenticate once and reach several internal web applications without re-entering credentials. The applications support SAML 2.0. Which component issues the signed assertion that the applications consume to establish the user's identity?

Accepted Answer

The identity provider. SAML 2.0 separates the identity provider, which authenticates users and issues signed assertions, from the service provider, which consumes and trusts them. The business needs one authentication event to reach multiple applications, so the identity provider is the issuing component. Certificate authorities and browsers support the exchange but do not create assertions.

Answer

The user agent (browser)

Answer

The service provider

Answer

The certificate authority

Question 9

A security administrator is configuring access controls for a shared file server. The administrator wants to grant permissions based on the sensitivity labels of the files and the clearance levels of the users, ensuring that users cannot change these permissions. Which access control model should be implemented?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the only model that enforces access using sensitivity labels on objects and clearances on subjects, with permissions managed centrally so users cannot change them. This precisely matches the administrator's requirement. The other models either rely on roles, owner discretion, or flexible attributes, none of which provide the same mandatory, label-based enforcement.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Question 10

A financial institution uses a RADIUS server for centralized authentication of its VPN users. A security administrator notices that authentication requests from a new VPN concentrator are being rejected, while requests from other devices work fine. The RADIUS server logs show that the shared secret does not match. What is the most likely cause?

Accepted Answer

The VPN concentrator is configured with the wrong shared secret.. RADIUS uses a shared secret between the client (VPN concentrator) and the server to authenticate and encrypt certain attributes. When the shared secret does not match, the server rejects requests from that client. The logs explicitly indicate a shared secret mismatch, so the most likely cause is that the new VPN concentrator has been configured with an incorrect shared secret. Other options would produce different symptoms or logs.

Answer

The RADIUS server's certificate has expired.

Answer

The user accounts are not configured with the correct password policy.

Answer

The VPN concentrator is not included in the RADIUS server's list of authorized clients.

Question 11

A security administrator is configuring a Linux server that hosts a shared project directory. The requirement is that new files created in the directory /projects/team must automatically inherit the group owner of the parent directory rather than the primary group of the user who created them. The administrator wants the setting to apply only to that directory. Which command should the administrator use?

Accepted Answer

chmod g+s /projects/team. The setgid bit on a directory is the standard Unix mechanism for ensuring that files and subdirectories created within it inherit the directory's group ownership. This is commonly used for shared project directories where collaboration among group members is required. Other options either alter permissions without affecting ownership, change only the directory's group, or set the sticky bit, which controls deletion rather than ownership inheritance.

Answer

chmod +t /projects/team

Answer

setfacl -d -m g:team:rwx /projects/team

Answer

chown :team /projects/team

Question 12

A company uses discretionary access control (DAC) for its file shares. A project manager creates a folder and wants to grant a team member read-only access. Which of the following best describes how access is determined in this model?

Accepted Answer

The project manager, as the owner of the folder, can set the permissions for the team member.. Discretionary access control (DAC) is characterized by the owner of the resource having the ability to determine who can access it and with what permissions. In this scenario, the project manager owns the folder and can grant read-only access to the team member. The other options describe characteristics of MAC, RBAC, or administrative approval processes, which are not inherent to DAC.

Answer

The team member must request access through a centralized approval workflow.

Answer

The team member's access is determined by their role in the organization.

Answer

The system administrator must assign a label to the folder and the user's clearance.

Question 13

A hospital is deploying a new electronic health records (EHR) system. The security team wants to ensure that access decisions are based on the user's assigned job function rather than on the user's identity or resource ownership. Which access control model best meets this requirement?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is designed to assign permissions to roles, and users are then assigned to roles according to their job responsibilities. This directly satisfies the hospital's requirement that access be based on job function rather than individual identity or resource ownership. The other models either rely on ownership, labels, or global rules, which do not meet the stated need.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control

Question 14

A small business owner wants to implement access control for a shared folder on a Windows server. The owner wants to grant different permissions to individual employees based on their specific job duties, without creating groups. Which access control model is most appropriate?

Accepted Answer

Discretionary access control (DAC). Discretionary access control (DAC) is the model where the owner of a resource determines who can access it and with what permissions. In this scenario, the small business owner wants to grant individual permissions to employees based on their job duties without creating groups. DAC allows this flexibility. RBAC would require roles, MAC uses labels, and ABAC uses attributes, all of which are more complex or not aligned with the owner's direct control.

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Question 15

A healthcare organization must enforce access control based on a combination of the user's assigned department, the classification of the data being accessed, and the time of day. Users in the cardiology department may view patient records only during their scheduled shift, and only if the record belongs to a patient currently admitted to cardiology. Which access control model BEST supports these requirements?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control is designed for policy decisions that combine multiple characteristics of the user, the resource, and the environment. Department, data classification, shift time, and a patient's current admission status are all attributes that can be evaluated in a single rule, so access is granted only when every condition is satisfied. The other models rely on ownership, static labels, or roles that cannot express these dynamic, contextual constraints together.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 16

A security analyst at a financial firm is reviewing the risk register and notes that the firm has purchased a cyber insurance policy to cover losses from a data breach. In risk management terms, which of the following best describes this action?

Accepted Answer

Risk transference. Risk transference is the correct classification because cyber insurance shifts the financial consequences of a data breach to an external insurer. The organization still owns the risk operationally, but the monetary impact is contractually borne by another party. This is a standard risk treatment option alongside avoidance, mitigation, and acceptance, and it is commonly used for low-frequency, high-impact events such as major data breaches.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 17

A company deploys a RADIUS server for wireless 802.1X authentication. Users report that after a password change, their devices still authenticate successfully for several hours using cached credentials. Which RADIUS behavior most likely explains this?

Accepted Answer

The authenticator caches the successful authentication and continues to authorize the supplicant until reauthentication is triggered. In 802.1X, the authenticator keeps a supplicant in an authorized state after a successful RADIUS exchange and only reauthenticates at defined intervals or on session events. A password change does not tear down existing authorized sessions, so devices continue to work until reauthentication is forced. Transport protocol and local authentication do not explain the observed delay.

Answer

RADIUS encrypts only the password field and relies on a shared secret, so cached credentials are replayed

Answer

RADIUS uses UDP and therefore cannot immediately propagate a password change to the client

Answer

The wireless controller performs local authentication and never contacts the RADIUS server

Question 18

A small business wants employees to authenticate to the corporate VPN using a hardware token that generates a time-based one-time code in addition to their password. Which authentication factor category does the hardware token represent?

Accepted Answer

Something you have. Authentication factors fall into categories including knowledge, possession, inherence, and location. A hardware token that generates time-based one-time codes must be physically held by the user, making it a possession factor. Pairing it with a password, which is a knowledge factor, satisfies multi-factor authentication because two different categories are required, rather than two instances of the same category.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 19

An analyst is tuning an intrusion detection system that generates far too many alerts. The analyst wants to reduce noise while preserving detection of genuinely suspicious behavior. Which approach BEST supports this goal?

Accepted Answer

Baseline normal network and host activity, then write thresholds and correlation rules relative to that baseline.. Alert noise is best reduced by understanding the environment. Baselining normal traffic and behavior gives the analyst a reference point, so thresholds and correlation rules can distinguish expected activity from anomalies. This preserves detection of real threats while eliminating the benign events that flood the console, which is far more effective than suppressing categories or hiding alerts.

Answer

Lower the severity rating of all signature-based alerts so analysts can triage them last.

Answer

Disable signature categories that have produced any false positives in the past month.

Answer

Increase the alert threshold on the console so events are only displayed after they repeat several times.

Question 20

A security operations center uses Nessus to scan its internal network nightly. A newly deployed web server is reporting a critical TLS vulnerability, but the vulnerability analyst confirms the server is configured to negotiate only TLS 1.3 with approved cipher suites. The scanner plugin was last updated eight weeks ago. Which action should the analyst take FIRST to resolve the discrepancy?

Accepted Answer

Update the Nessus plugins and credentials, then rescan the host to validate the finding before acting.. Stale scanner content is a common source of false positives, especially for protocol and cipher detection where vendor logic evolves quickly. Before treating the TLS finding as real, the analyst should refresh plugins, confirm credentials work, and rescan so the scanner evaluates the actual negotiated protocol and cipher suites. Only validated findings should be escalated, suppressed, or formally accepted as risk.

Answer

Escalate the finding to the change advisory board as a confirmed critical risk requiring emergency patching.

Answer

Accept the risk for the web server and document the exception because TLS 1.3 is enabled.

Answer

Disable the TLS-related plugin family on the scanner so the server stops generating noisy findings.