SSCP Practice Exam 56 — 20 Questions

Question 1

During a security audit, an analyst finds that a server's audit log shows repeated failed login attempts from a single IP, followed by a successful login from the same IP five minutes later. What is the most likely type of attack that occurred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Brute-force attack. (brute-force attack). The scenario describes repeated failed login attempts from a single IP address followed by a successful login, which is characteristic of a brute-force attack where an attacker tries many passwords until one works. Option A (dictionary attack) uses a list of likely passwords but may not be as exhaustive; the description of repeated attempts without specifying a list suggests brute-force. Option B (man-in-the-middle attack) intercepts communications, not login attempts. Option D (replay attack) involves capturing and reusing a valid credential, not repeated tries. Option E (password spraying attack) targets multiple accounts with a few common passwords, not repeated attempts on a single account from one IP.

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Password spraying attack

Question 2

Which TWO of the following are best practices for securing an application programming interface (API)?

Accepted Answer

Implement rate limiting to control the number of requests.. Options A and B are correct. Rate limiting prevents abuse and denial-of-service attacks, while input validation and sanitization prevent injection attacks. Option C (returning detailed error messages) can leak sensitive information to attackers. Option D (disabling encryption) exposes data in transit. Option E (using HTTP Basic Authentication without HTTPS) transmits credentials in plaintext.

Answer

Return detailed error messages to help clients debug.

Answer

Disable encryption to improve performance.

Answer

Use HTTP Basic Authentication without HTTPS.

Question 3

A system administrator needs to grant a temporary contractor access to a specific shared folder for two weeks. Which access control approach is most appropriate?

Accepted Answer

Create a temporary user account with an expiration date and grant NTFS permissions. Creating a temporary user account with an expiration date directly addresses the need for time-limited access. Granting NTFS permissions on the specific shared folder provides granular, least-privilege access control. This approach ensures the account is automatically disabled after two weeks, reducing administrative overhead and security risk.

Answer

Create a new role with access to the folder and assign the contractor to that role

Answer

Use mandatory access control (MAC) to enforce a security label for the contractor

Answer

Configure the folder with discretionary access control (DAC) and let the contractor request access

Question 4

Which TWO of the following are effective measures to prevent cross-site scripting (XSS) vulnerabilities in a web application?

Accepted Answer

Implement a Content Security Policy (CSP).. The correct answers are A and D. Implementing a Content Security Policy (CSP) is an effective browser-side defense that restricts the execution of unauthorized scripts, thereby mitigating XSS attacks. Encoding all user input before displaying it in HTTP responses (output encoding) neutralizes any embedded malicious scripts, preventing them from executing in the user's browser. Option B (WAF) can help detect and block some known XSS payloads but is not a primary prevention measure and can be bypassed. Option C (replacing GET with POST) does not prevent XSS because XSS can occur regardless of the HTTP method used; the vulnerability lies in how input is handled on the server side. Option E (HTTPS) only encrypts data in transit and does not protect against XSS, which is a client-side injection attack.

Answer

Use a web application firewall (WAF) to block known XSS payloads.

Answer

Replace GET requests with POST for all form submissions.

Answer

Use HTTPS for all communications.

Question 5

During a full interruption test of the disaster recovery plan, which of the following is the PRIMARY risk?

Accepted Answer

Extended downtime or data loss if the plan fails. Full interruption tests involve actually failing over to the DR site, which may cause extended downtime or data loss if the plan has flaws or if the DR site fails.

Answer

Vendor unavailability during the test

Answer

Employee confusion about their roles

Answer

Cost overruns due to overtime pay

Question 6

A security analyst is reviewing logs and finds multiple failed login attempts from an external IP address followed by a successful login. Which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack involves systematically trying all possible password combinations until the correct one is found. The log pattern of multiple failed attempts from a single external IP followed by a success is the classic signature of a brute force attack, as the attacker iterates through a password list or character space against the same username.

Answer

Password spraying

Answer

Credential stuffing

Answer

Social engineering

Question 7

During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)

Accepted Answer

Snapshots may contain unpatched vulnerabilities. Snapshots can reintroduce vulnerabilities because they capture the VM state at a point in time; if the VM was not fully patched, the snapshot retains those unpatched vulnerabilities (option A). Additionally, snapshots may contain sensitive data in memory or disk that could be exposed if not properly secured (option B). Furthermore, snapshots can be used to roll back security configurations, undoing security updates or settings (option D). The incorrect options are C (snapshots cause VM sprawl) and E (snapshots can be used as an attack vector for VM escape). VM sprawl is more about excessive VM creation, not a direct risk of snapshots, and VM escape is a different vulnerability unrelated to snapshot risks.

Answer

Snapshots cause VM sprawl

Answer

Snapshots can be used as an attack vector for VM escape

Question 8

Which THREE of the following are essential elements of an effective incident response plan? (Choose three.)

Accepted Answer

Containment, eradication, and recovery. The incident response plan lifecycle, as defined by NIST SP 800-61, includes four core phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Options A, B, and E directly map to these essential phases, ensuring the organization can detect an incident, contain it to prevent spread, eradicate the root cause, recover normal operations, and continuously improve through training and preparation.

Answer

Public relations and media notification

Answer

Cyber insurance purchasing

Question 9

A security analyst is reviewing the access control policy and notices that some users have been granted 'write' access to a directory that contains sensitive financial reports. Which principle of information security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting 'write' access to a directory containing sensitive financial reports to users who do not require that level of access violates this principle, as it introduces unnecessary risk of unauthorized modification or data leakage.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 10

A company uses a cloud storage service that encrypts files with a key derived from the user's password (e.g., using PBKDF2). The security team recommends migrating to a separate key management service (KMS) that generates and manages encryption keys independently of user passwords. What is the most critical security advantage of using a KMS in this scenario?

Accepted Answer

Changing the user password does not require re-encrypting all files.. When encryption keys are derived from a user's password (e.g., via PBKDF2), changing the password changes the derived key, requiring all files encrypted under the old key to be decrypted and re-encrypted with the new key. A separate KMS decouples key management from user credentials, allowing password changes without affecting the underlying encryption keys, thus avoiding costly and time-consuming re-encryption operations.

Answer

Password-derived keys are inherently weaker than KMS-generated keys.

Answer

A KMS is faster at encrypting and decrypting large files.

Answer

A KMS provides better audit logging of key usage.

Question 11

Which TWO of the following are functions of a network firewall?

Accepted Answer

Filtering traffic based on IP addresses and ports. A network firewall's primary function is to enforce access control policies by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (ports) information. This stateless or stateful inspection allows the firewall to permit or deny packets according to rules, such as allowing HTTP traffic (TCP port 80) from a specific source IP. This is a core security mechanism to segment networks and block unauthorized access.

Answer

Resolving domain names to IP addresses

Answer

Encrypting data at rest

Answer

Assigning IP addresses to hosts

Question 12

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

Accepted Answer

Two different media types. The 3-2-1 backup rule requires three copies of the data (one primary and two backups), stored on two different media types (e.g., disk and tape, or local disk and cloud storage), with one copy kept offsite. Option D is correct because using two different media types ensures that a failure or vulnerability affecting one medium (e.g., ransomware encrypting a disk array) does not compromise the other copy. This diversity is a core principle of the rule, reducing the risk of simultaneous data loss.

Answer

One copy in the cloud

Answer

Daily full backups

Answer

All copies on the same media

Question 13

A network analyst reviews firewall logs and sees multiple SYN packets to various ports from the same external IP in a short time, with no subsequent ACK. What is the most likely cause?

Accepted Answer

Port scan using SYN scan technique. A SYN scan sends SYN packets to multiple ports; if a port is open, the target responds with SYN-ACK, but the scanner never completes the handshake (no ACK). The absence of ACK packets after the SYN packets indicates the scanner is not establishing connections, which is characteristic of a SYN scan, not a brute force or DDoS attack.

Answer

Brute force password attack on SSH

Answer

Distributed denial-of-service (DDoS) attack

Answer

ICMP ping sweep

Question 14

Based on the exhibit, what type of attack is most likely occurring?

Accepted Answer

Password spraying attack. The exhibit shows a scenario where an attacker attempts a small number of common passwords (e.g., one or a few) against many different usernames. This low-and-slow approach avoids triggering account lockout policies, which is the hallmark of a password spraying attack. Unlike dictionary attacks (many passwords on a single user) or brute-force attacks (exhaustive password guessing on one account), password spraying targets multiple accounts with commonly used passwords to increase success rates while staying under detection thresholds.

Answer

Brute-force attack

Answer

Pass-the-hash attack

Answer

Dictionary attack

Question 15

A network administrator implements the firewall rules above. What is the effect of this rulebase?

Accepted Answer

HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed. Firewall rules are processed top-down; the first match applies. Rule 1 permits HTTP/HTTPS traffic from source 10.0.0.0/8 to any destination. Rule 2 permits similar traffic from other networks (but that is irrelevant). Rule 3 denies all traffic from 10.0.0.0/8, but because Rule 1 matches first for HTTP/HTTPS from that network, the deny rule is never evaluated for those protocols. Therefore, HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed, making option B correct. Options A and C are incorrect due to the logic above. Option D is incorrect because the deny rule is not redundant; it blocks non-HTTP/HTTPS traffic from 10.0.0.0/8, which would otherwise be implicitly denied anyway.

Answer

HTTP and HTTPS traffic from all networks is blocked

Answer

All traffic from the 10.0.0.0/8 network is blocked

Answer

The deny rule is redundant because permit rules exist

Question 16

Drag and drop the steps for establishing a VPN using IPsec in tunnel mode into the correct order.

Accepted Answer

IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA, then Apply IPsec SA to traffic. IPsec tunnel setup: IKE phase 1 (management SA), IKE phase 2 (IPsec SA), then apply to traffic.

Answer

IKE Phase 2: Establish IPsec SA, then IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic

Answer

Apply IPsec SA to traffic, then IKE Phase 1: Establish management SA, then IKE Phase 2: Establish IPsec SA

Answer

IKE Phase 1: Establish management SA, then Apply IPsec SA to traffic, then IKE Phase 2: Establish IPsec SA

Question 17

Which TWO of the following are key indicators of a potential data exfiltration attempt?

Accepted Answer

Unusual outbound traffic to a known malicious IP address. Unusual outbound traffic to a known malicious IP address (B) is a direct sign of data being sent to an attacker. Sudden increase in database read operations by a single user (E) could indicate data harvesting. Failed login attempts (A) indicate brute force but not exfiltration. Firewall rule changes (C) are more about network changes. Successful logins from unusual geolocations (D) indicate compromised credentials, not necessarily exfiltration itself.

Answer

Large number of failed login attempts from multiple accounts

Answer

Multiple firewall rule changes in a short period

Answer

Successful logins from unusual geolocations for multiple users

Question 18

An analyst detects outbound traffic from a workstation to a known malicious IP address. The workstation is a developer machine with local admin rights. Which containment action should be taken first?

Accepted Answer

Isolate the workstation from the network. The first step is to isolate the workstation from the network (Option B) to prevent further communication with the malicious IP and lateral movement. Blocking only the IP (Option A) is insufficient because the malware may use other IPs. Shutting down (Option C) may lose volatile evidence. Disabling the user's account (Option D) does not stop network traffic from the workstation.

Answer

Block the malicious IP on the firewall

Answer

Shut down the workstation immediately

Answer

Disable the user's domain account

Question 19

A security analyst detects unusual outbound traffic from a server to a known malicious IP. The server is running a critical business application. What should the analyst do FIRST?

Accepted Answer

Disconnect the server from the network. The first priority in incident response is containment. Disconnecting the server from the network immediately stops potential data exfiltration and prevents the attacker from causing further damage. Option A is too broad and would disrupt legitimate services. Option B (running antivirus) delays containment and may not be effective against advanced threats. Option D (alerting the system administrator) is important but should not precede containment; containment must be performed first to minimize impact.

Answer

Block all traffic from that server

Answer

Run antivirus on the server

Answer

Alert the system administrator

Question 20

Which TWO of the following are types of intrusion detection systems (IDS) based on the detection method?

Accepted Answer

Anomaly-based IDS. The two types of IDS based on detection method are anomaly-based (detects deviations from normal behavior) and signature-based (matches known attack patterns). Host-based and network-based are types based on deployment location, not detection method. Rule-based is often considered a subtype of signature-based detection. Therefore, options A (Anomaly-based) and D (Signature-based) are correct.

Answer

Host-based IDS

Answer

Rule-based IDS

Answer

Network-based IDS