SSCP Practice Exam 55 — 20 Questions

Question 1

A company implements a DMZ to host public services. Which of the following is the best practice for securing the DMZ?

Accepted Answer

Use separate firewall rules for inbound and outbound traffic. DMZ security relies on strict separation of inbound and outbound traffic rules. Inbound rules should permit only necessary traffic (e.g., HTTP/HTTPS to web servers) from the internet to the DMZ, while outbound rules should restrict DMZ-initiated connections to the internal network, typically allowing only established sessions or specific protocols. This prevents an attacker who compromises a DMZ host from using it as a pivot to access internal resources.

Answer

Allow all traffic from the internet to the DMZ

Answer

Disable logging on DMZ firewalls

Answer

Place the DMZ behind the internal firewall

Answer

Use the same subnet for DMZ and internal network

Question 2

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Accepted Answer

CVEs. C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Answer

Configuration weaknesses

Answer

Hardware failure

Answer

Design flaws

Question 3

An organization is implementing a jump server architecture for managing critical servers. Which additional control BEST reduces the risk of lateral movement if the jump server is compromised?

Accepted Answer

Implement SSH key-based authentication with agent forwarding restricted to specific target hosts.. Restricting SSH agent forwarding to specific target hosts prevents an attacker who compromises the jump server from using forwarded credentials to authenticate to arbitrary internal systems. This containment limits lateral movement by ensuring that even if the jump server is breached, the attacker cannot reuse SSH keys to pivot to non-approved targets.

Answer

Enable verbose logging on all target servers.

Answer

Require multi-factor authentication for all jump server logins.

Answer

Use a separate VLAN for management traffic.

Question 4

A small business uses a wireless network for employees and guests. The network uses WPA2-PSK with a single SSID, and the guest network is separate but broadcasts the same SSID. Recently, employees report intermittent connection drops and slow internet speeds. A site survey shows multiple access points from neighboring businesses operating on channels 1, 6, and 11. The business's access points are set to auto-channel selection. What is the most likely cause of the issue?

Accepted Answer

Channel interference due to overlapping channels. With multiple neighboring access points operating on channels 1, 6, and 11, and the business's access points set to auto-channel selection, the most likely cause is channel interference. Auto-channel selection may not dynamically avoid co-channel or adjacent-channel overlap, leading to contention, retransmissions, and degraded performance. The separate guest network broadcasting the same SSID can also cause client confusion and increased collisions.

Answer

RADIUS server misconfiguration

Answer

Rogue access point

Answer

Weak PSK passphrase

Question 5

A healthcare organization stores patient records in a database that is encrypted at rest using AES-256-CBC. The encryption key is stored in a plaintext configuration file on the database server, with file permissions set to read-only for the database service account and administrators. During an internal audit, the security team flags this as a critical vulnerability because the key is co-located with the encrypted data. The system administrator argues that the file permissions are sufficient to prevent unauthorized access. Separately, the organization must comply with HIPAA requirements for encryption key management. Which remediation most effectively addresses the vulnerability and meets compliance requirements?

Accepted Answer

Move the encryption key to a hardware security module (HSM) accessible only via authenticated API calls.. Moving the encryption key to a hardware security module (HSM) physically separates the key from the encrypted data, eliminating the co-location vulnerability. HSMs provide tamper-resistant key storage and enforce access controls via authenticated API calls, which aligns with HIPAA requirements for proper key management and protection of electronic protected health information (ePHI).

Answer

Change the encryption algorithm from AES-256-CBC to AES-256-GCM.

Answer

Implement file integrity monitoring (FIM) on the configuration file to alert on unauthorized access.

Answer

Encrypt the configuration file containing the key with a second AES-256 key stored in the same directory.

Question 6

Which two commands can be used to modify existing file permissions on a Linux system? (Select TWO)

Accepted Answer

setfacl. B is correct because `setfacl` is used to modify Access Control Lists (ACLs) on a file or directory, which are an extended mechanism for setting permissions beyond the standard owner/group/others model. E is correct because `chmod` is the standard command for changing the read, write, and execute permissions for the file owner, group, and others using symbolic or octal notation.

Answer

chattr

Answer

umask

Answer

chown

Question 7

A security analyst reviews the syslog message from a router. What does this log entry indicate?

Accepted Answer

An internal host attempted to access an external web server and was blocked.. The log entry shows a packet from source IP 10.0.0.2 (internal) to destination IP 203.0.113.5 (external) on port 80 (HTTP) being denied by the router's access control list (ACL). The 'DENY' action indicates the traffic was blocked, not allowed. Since the source is internal and the destination is external, this matches an outbound connection attempt being blocked.

Answer

The router's ACL is misconfigured and is blocking all traffic.

Answer

An external host attempted to access an internal web server and was blocked.

Answer

An internal host successfully accessed an external web server.

Question 8

A healthcare organization is implementing an access control system to ensure that employees can only access patient records necessary for their job functions. Which model best enforces this principle?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct model because it assigns permissions based on job roles, ensuring employees only access patient records necessary for their duties. In healthcare, RBAC aligns with the principle of least privilege by mapping roles (e.g., nurse, doctor, billing) to specific data access, as defined in standards like NIST SP 800-53. This directly enforces the requirement that access is tied to job functions, not individual discretion or system-wide rules.

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 9

A security administrator receives an alert from the SIEM indicating a configuration change on a critical server. The change was not part of any approved change request. What should be the first step?

Accepted Answer

Investigate the change to determine its source and impact. The first step when an unauthorized configuration change is detected is to investigate the change to determine its source and impact. This aligns with the incident response process, where initial assessment (identification and scoping) precedes containment or remediation. Without investigation, reverting or disabling could destroy forensic evidence or disrupt legitimate services.

Answer

Notify the server owner

Answer

Revert the server to the last known good configuration

Answer

Disable the server's network access

Question 10

Which TWO actions are appropriate during the containment phase of incident response?

Accepted Answer

Isolating the affected system from the network. During the containment phase of incident response, the primary goal is to stop the incident from spreading and to limit damage. Isolating the affected system from the network (Option C) immediately prevents lateral movement of the threat and further data exfiltration. Blocking malicious IP addresses at the firewall (Option D) is another containment action that cuts off communication with known command-and-control servers or attack sources, effectively containing the network-level impact.

Answer

Restoring data from backups

Answer

Removing malware from the system

Answer

Analyzing the root cause of the incident

Question 11

After containing a malware outbreak, the incident response team needs to ensure the malware is completely removed from all systems. Which phase of the incident response process is this?

Accepted Answer

Eradication. The eradication phase is specifically focused on removing the root cause of the incident, such as deleting malware files, registry keys, and disabling malicious services from all affected systems. After containment (which stops the spread), eradication ensures the threat is completely eliminated before recovery begins. This aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment and precedes recovery.

Answer

Post-Incident

Answer

Detection

Answer

Recovery

Question 12

A network administrator is designing a secure remote access solution for employees using company laptops. The solution must support strong authentication, encryption, and be resistant to man-in-the-middle attacks. Which THREE components should be included?

Accepted Answer

EAP-TLS for authentication. IKEv2 supports strong authentication and mobility; EAP-TLS provides certificate-based authentication; IPsec provides encryption and authentication.

Answer

L2TP tunneling protocol

Answer

PPTP with MPPE encryption

Question 13

Match each access control model to its description.

Accepted Answer

Discretionary Access Control (DAC): Access decisions are based on the identity of the subject and the discretion of the object owner.. The four primary access control models are DAC (owner-determined), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include mixing up DAC and MAC, or RBAC with DAC.

Answer

Discretionary Access Control (DAC): Access is based on security labels and clearances.

Answer

Role-Based Access Control (RBAC): Access decisions are made by the data owner.

Question 14

A company wants to ensure that employees use strong passwords. Which policy is most effective?

Accepted Answer

Require a minimum password length of 12 characters.. Password length is the single most important factor in resistance to brute-force and rainbow table attacks. NIST SP 800-63B and industry best practices now recommend a minimum of 12–16 characters, as each additional character exponentially increases the keyspace. While complexity adds some entropy, a long passphrase is far more effective against modern GPU-based cracking than a short, complex password.

Answer

Prohibit password reuse for the last 10 passwords.

Answer

Require password changes every 30 days.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols.

Question 15

A security administrator notices that a critical server's event log shows repeated failed login attempts from an internal IP address that normally does not generate any traffic. The administrator immediately blocks the IP at the firewall and resets the account password. However, the incident response team later determines that the attacker had already gained access to the server. What is the MOST likely reason the administrator's actions were insufficient?

Accepted Answer

The administrator did not isolate the server from the network.. The administrator's actions—blocking the IP at the firewall and resetting the password—were insufficient because the attacker had already gained access to the server. Isolating the server (e.g., disconnecting it from the network) would have severed the attacker's active connection and prevented further compromise. Option A is wrong because preserving logs is important for investigation but does not stop an ongoing breach. Option B is wrong because a malware scan is a remediation step after containment. Option D is wrong because notifying the data owner addresses notification requirements but does not directly contain the threat.

Answer

The administrator did not preserve the log evidence for forensic analysis.

Answer

The administrator neglected to perform a full system scan for malware.

Answer

The administrator failed to notify the data owner about the incident.

Question 16

A new employee needs access to the CRM, email, and file servers. The security policy requires that access privileges are granted based on job function. Which process should be used?

Accepted Answer

The identity management team assigns the employee to a role that includes the necessary permissions. Role-based access control (RBAC) assigns permissions based on job functions, not individual requests or ad-hoc approvals. By placing the employee into a predefined role (e.g., 'Sales Rep'), the identity management team ensures that the CRM, email, and file server permissions are granted consistently and in compliance with the security policy. This process enforces the principle of least privilege and simplifies auditing.

Answer

The employee completes a request form detailing the access they need

Answer

The IT department grants full access to all systems and later reviews

Answer

The employee's supervisor decides which access is appropriate and informs IT

Question 17

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

Accepted Answer

Warm site with hourly log shipping to a standby database. A warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Answer

Cold site with weekly backup tapes shipped offsite

Answer

Cloud-based cold site with daily backups

Answer

Hot site with synchronous replication

Question 18

Which access control mechanism most likely failed to prevent this unauthorized privilege escalation?

Accepted Answer

Account lockout policy. An account lockout policy is designed to prevent brute-force attacks by locking an account after a specified number of failed login attempts. In the context of unauthorized privilege escalation, a lockout policy would not prevent a user who already has valid credentials from escalating privileges through other means, such as exploiting a misconfigured sudoers file or a kernel vulnerability. Therefore, the failure of the account lockout policy is the most likely mechanism that allowed the escalation, as it does not control what an authenticated user can do after login.

Answer

Sudoers configuration

Answer

Password policy

Answer

SELinux

Question 19

A Linux system administrator needs to restrict network traffic to a server, allowing only HTTP and HTTPS from the internet. Which tool should be used to configure packet filtering rules?

Accepted Answer

iptables. iptables or nftables are Linux firewall tools for packet filtering. PAM handles authentication. SELinux enforces MAC. auditd logs events. They do not filter network traffic.

Answer

PAM

Answer

SELinux

Answer

auditd

Question 20

An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?

Accepted Answer

Using write-once storage and digitally signing each log entry. Write-once storage (e.g., WORM media or append-only filesystems) prevents any modification or deletion of log entries after they are written. Digitally signing each log entry ensures that any tampering can be detected by verifying the signature against the log data. Together, these provide non-repudiation and integrity, meeting compliance requirements for immutable audit logs.

Answer

Encrypting logs during transmission only

Answer

Compressing logs to save space

Answer

Storing logs on a standard file server with restricted permissions