SSCP Practice Exam 56 — 20 Questions

Question 1

A financial services firm has just contained a ransomware incident on a file server. The incident response plan requires a formal post-incident activity phase. The CISO wants to know what the team should do FIRST to improve future response. Which action best aligns with NIST SP 800-61 post-incident activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a lessons learned meeting with all involved parties to review the incident timeline and response actions.. NIST SP 800-61 defines post-incident activity as including lessons learned to improve future response. Holding a lessons learned meeting with involved parties captures what happened, what was effective, and what needs improvement. This should occur before recovery actions or plan updates, because the team's memory is freshest and evidence is still available. The other actions are either recovery steps or communication tasks that do not directly fulfill the improvement goal.

Answer

Update the incident response plan with new detection signatures based on the ransomware variant.

Answer

Immediately reimage the server and restore data from the most recent backup.

Answer

Notify the board of directors and external regulators about the incident.

Question 2

During a risk assessment, a team identifies that a legacy inventory application has no vendor support and cannot be patched. Leadership decides to accept the risk because replacing the application would cost more than the potential loss. Which term best describes this decision?

Accepted Answer

Risk acceptance. When leadership evaluates a risk and consciously decides to continue operating without adding controls because remediation costs outweigh expected losses, the decision is risk acceptance. This must be documented and periodically reviewed so it remains an informed choice. It differs from avoidance, which eliminates the activity, and from transference, which shifts financial impact to another party.

Answer

Risk transference

Answer

Risk avoidance

Answer

Risk mitigation

Question 3

A financial services firm runs a Java-based customer portal on Apache Tomcat. During a code review, the security team discovers that the application deserializes session objects received from an untrusted partner API without validating their contents. An attacker could craft a malicious serialized object that executes arbitrary code on the server when deserialized. Which of the following controls BEST mitigates this risk?

Accepted Answer

Implement a strict allowlist of permitted classes for deserialization and reject all others.. Insecure deserialization allows attackers to influence object state and potentially achieve remote code execution. The most direct fix is to constrain which classes can be deserialized using an allowlist, so only expected types from the partner API are accepted. Transport encryption, WAF rules, and JVM tuning do not validate object contents and therefore fail to eliminate the vulnerability.

Answer

Enable TLS 1.3 with mutual authentication between the portal and the partner API.

Answer

Increase the Java heap size and enable garbage collection tuning on the Tomcat server.

Answer

Deploy a web application firewall (WAF) with OWASP ModSecurity Core Rule Set in blocking mode.

Question 4

A security operations center (SOC) receives an alert from its intrusion detection system (IDS) about a possible SQL injection attack against a web server. The SOC analyst reviews the IDS signature and sees that it triggered on a request containing the string 'OR 1=1'. However, the web application logs show that the request was blocked by a web application firewall (WAF) and returned a 403 error. Which of the following BEST describes the nature of this alert?

Accepted Answer

True positive; the IDS correctly detected an attack, and the WAF successfully blocked it.. The IDS correctly identified a SQL injection attempt, making it a true positive. The WAF then blocked the request, as shown by the 403 error, so the attack was prevented. This is a true positive detection with successful mitigation. It is not a false positive because the traffic was malicious, and not a false negative because the IDS did alert. The SOC should investigate the source and consider whether the IDS signature needs tuning to reduce noise.

Answer

True positive; the IDS correctly detected an attack, and the WAF failed to block it.

Answer

False negative; the IDS failed to detect the attack, but the WAF blocked it.

Answer

False positive; the request was legitimate and the IDS misclassified it.

Question 5

A security administrator is implementing a solution to detect unauthorized changes to critical system files on a server. Which of the following technologies is BEST suited for this purpose?

Accepted Answer

File integrity monitoring (FIM). File integrity monitoring is specifically designed to detect unauthorized changes to files by comparing current hashes to known good baselines. It provides alerts when critical system files are modified, making it the best choice for this requirement.

Answer

Security information and event management (SIEM)

Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Question 6

A healthcare provider's incident response team is handling a suspected ransomware incident on a clinical workstation. The team lead wants to determine whether the incident should be escalated to a full response or handled as a false positive. According to NIST SP 800-61, which activity is part of the detection and analysis phase?

Accepted Answer

Validating the incident by correlating alerts with known indicators and impact.. Detection and analysis in NIST SP 800-61 involves validating alerts, correlating indicators, scoping the incident, and determining impact. Validation is the critical step that separates real incidents from false positives and informs escalation decisions. Eradication, containment, and post-incident review occur in later phases, so they are not part of detection and analysis.

Answer

Implementing a network access control list to block the ransomware's command-and-control domain.

Answer

Conducting a lessons learned meeting with clinical staff.

Answer

Eradicating the malware by reimaging the workstation.

Question 7

A security team is conducting a risk assessment for a new cloud-based collaboration platform. They need to identify potential threats and vulnerabilities. Which TWO of the following are examples of technical vulnerabilities that should be considered? (Choose two.)

Accepted Answer

Weak encryption algorithms used for data in transit.. Technical vulnerabilities are weaknesses in hardware, software, or configurations that can be exploited. Unpatched software and weak encryption algorithms are both technical flaws that directly affect the security of the cloud platform. The other options—lack of training, insufficient physical security, and missing policy—are administrative, physical, or governance issues, not technical vulnerabilities. A comprehensive risk assessment should consider all types, but the question specifically targets technical ones.

Answer

Lack of security awareness training for employees.

Answer

Insufficient physical security at the data center.

Answer

Lack of a formal risk management policy.

Question 8

A security analyst is reviewing a disaster recovery plan and notes that the organization has a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours for a critical database. Which of the following backup strategies BEST meets these objectives?

Accepted Answer

Continuous data protection (CDP) with asynchronous replication to a hot site.. The RPO of 15 minutes requires that no more than 15 minutes of data can be lost, necessitating continuous or near-continuous backup. The RTO of 2 hours demands rapid recovery, which a hot site with asynchronous replication can provide. Continuous data protection combined with a hot site meets both objectives by minimizing data loss and downtime.

Answer

Hourly incremental backups to a local NAS with nightly replication to a warm site.

Answer

Daily full backups with weekly tape rotation stored offsite.

Answer

Weekly full backups with daily differential backups stored in the cloud.

Question 9

After a security incident, an organization's legal team requests documentation that shows who had possession of a hard drive at every point from seizure to analysis. Which document should the incident responder provide?

Accepted Answer

Chain of custody form. A chain of custody form is the formal record that documents the seizure, transfer, and analysis of evidence. It includes dates, times, names, and signatures of everyone who handled the evidence. This ensures that evidence has not been tampered with and is admissible in court. The legal team's request for possession history is precisely what a chain of custody form provides, so it is the correct document.

Answer

Vulnerability assessment report

Answer

Incident response plan

Answer

Forensic imaging log

Question 10

A retail company issues contactless smart cards to employees for physical entry to its data center. The security manager wants to ensure that a lost card cannot be used by someone who finds it, without adding a fingerprint reader at every door. Which access control enhancement best meets this requirement?

Accepted Answer

Require a personal identification number entered on the door keypad in addition to presenting the card. The requirement is to stop a finder from using a lost card, which calls for adding a second authentication factor tied to the person rather than the token. A personal identification number supplies that knowledge factor at low cost and without new biometric hardware at every door. Cryptography, expiration, and anti-passback all strengthen the credential system in different ways but none of them verifies who is presenting the card.

Answer

Increase the encryption key length used by the card's contactless interface

Answer

Enable anti-passback so the system rejects a card presented twice without an intervening exit

Answer

Shorten the card's validity period and require reissuance every quarter

Question 11

A financial services firm must demonstrate to auditors that access to its core banking platform follows least privilege and is reviewed regularly. Which TWO practices BEST support this objective? (Choose two.)

Accepted Answer

Implement role-based access control with entitlements mapped to documented job functions.. Least privilege is sustained through two complementary mechanisms: a design that grants only role-appropriate entitlements, and a recurring review that confirms those grants remain justified. Role-based access control structures the grants, while owner certification validates them over time. Together they produce both the control and the evidence auditors expect.

Answer

Grant permanent elevated access to any user who requests it to reduce help desk tickets.

Answer

Assign all platform administrators a shared emergency account for routine maintenance.

Answer

Disable audit logging on the platform to improve performance during peak transaction periods.

Question 12

An analyst reviewing the risk register notices that a web application vulnerability has an annualized loss expectancy (ALE) of $40,000 before controls. A web application firewall (WAF) would cost $12,000 per year to operate and is expected to reduce the ALE to $10,000. Based on this quantitative analysis, what should the analyst recommend?

Accepted Answer

Recommend the WAF because the control cost of $12,000 is less than the $30,000 reduction in annualized loss expectancy.. Quantitative risk analysis compares the annual cost of a control with the reduction in annualized loss expectancy it produces. The WAF cuts expected loss by $30,000 while costing $12,000 per year, yielding a positive net benefit of $18,000. That favorable relationship is the basis for recommending implementation; the residual loss simply reflects that no control eliminates risk entirely.

Answer

Recommend against the WAF because the annualized loss expectancy is still $10,000 after implementation.

Answer

Recommend against the WAF because the $12,000 cost exceeds ten percent of the original $40,000 annualized loss expectancy.

Answer

Recommend the WAF only if the residual annualized loss expectancy can be reduced to zero.

Question 13

A security analyst is reviewing alerts from a Network Intrusion Detection System (NIDS) that monitors a demilitarized zone segment. Over one week, the same alert fires hundreds of times for traffic that the business has confirmed is a legitimate partner integration. The analyst has verified the signature is correctly written and the traffic is truly benign. What is the most appropriate action?

Accepted Answer

Create a tuned exception or suppression rule scoped to the specific signature, source, and destination of the partner traffic.. When a signature is accurate but a verified benign source repeatedly triggers it, targeted suppression is the proportionate response. Scoping the exception to the exact signature, source, and destination eliminates the noise without weakening detection elsewhere. Deleting the signature or disabling the sensor would create blind spots, and raising severity would simply escalate benign alerts for manual review.

Answer

Disable the NIDS sensor on the DMZ segment to stop the noise until the partner integration is retired.

Answer

Increase the alert severity of the signature so that analysts investigate every occurrence manually.

Answer

Delete the signature from the NIDS rule set and rely on firewall logs for DMZ monitoring.

Question 14

A security administrator is implementing a new access control system. The organization wants to ensure that users are granted only the permissions necessary to perform their job functions and nothing more. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege is the principle of providing users with only the access rights required for their tasks. It minimizes the potential for accidental or malicious misuse of privileges. Separation of duties, defense in depth, and implicit deny are related but distinct concepts that do not directly address minimizing granted permissions.

Answer

Implicit deny

Answer

Separation of duties

Answer

Defense in depth

Question 15

A security team is conducting a lessons learned meeting after a major security incident. The team identifies that the incident response plan was not followed because team members were unsure of their roles. Which of the following should be the PRIMARY outcome of this meeting to address the issue?

Accepted Answer

Update the incident response plan with clearer role definitions and provide additional training.. The primary outcome of a lessons learned meeting is to identify improvements and implement changes to prevent recurrence. Since the issue was unclear roles, updating the incident response plan with clear role definitions and providing training directly addresses the deficiency. This aligns with best practices for continuous improvement in incident response.

Answer

Outsource all incident response activities to a third-party provider.

Answer

Purchase a new SIEM solution to improve detection capabilities.

Answer

Immediately terminate the employees who failed to follow the plan.

Question 16

A security analyst is reviewing alerts and sees that a user's workstation has begun encrypting files with a new extension, and a ransom note has appeared on the desktop. The analyst confirms this is an active ransomware infection. According to NIST SP 800-61, which action should the analyst take FIRST during the containment phase?

Accepted Answer

Immediately disconnect the workstation from the network by unplugging the Ethernet cable or disabling Wi-Fi.. During an active ransomware incident, the first containment action is to isolate the infected system from the network to prevent lateral spread and further encryption of shared resources. This aligns with NIST SP 800-61, which emphasizes limiting the scope of the incident before eradication and recovery. Disconnecting the network preserves volatile evidence while stopping the malware's communication and propagation. Other actions like scanning, shutting down, or paying the ransom do not address immediate containment and may hinder forensic efforts.

Answer

Shut down the workstation immediately to stop the encryption process.

Answer

Pay the ransom to obtain the decryption key and restore files quickly.

Answer

Run a full antivirus scan on the workstation to remove the ransomware.

Question 17

A multinational corporation has a disaster recovery plan with a Recovery Time Objective (RTO) of 2 hours for its customer-facing e-commerce platform. During a regional power outage, the primary data center goes offline. The DR team activates the hot site, but the database replication lag causes the e-commerce platform to come online after 5 hours. Which of the following should the incident response team do FIRST after restoring services?

Accepted Answer

Conduct a root cause analysis of the replication lag and RTO miss.. After restoring services, the incident response team should perform a root cause analysis to understand why the hot site did not meet the 2-hour RTO. The replication lag is a technical issue that must be diagnosed and corrected to improve DR readiness. Punitive actions, plan normalization, or untested failback do not address the underlying cause and could worsen future outcomes.

Answer

Immediately fail back to the primary data center without testing.

Answer

Terminate the DR team lead for failing to meet the RTO.

Answer

Update the DR plan to reflect the actual recovery time achieved.

Question 18

An incident responder is analyzing a network packet capture to determine the scope of a data exfiltration incident. The responder notices a large volume of outbound traffic to an unfamiliar IP address over port 443. Which of the following should the responder do FIRST to determine if the traffic is malicious?

Accepted Answer

Inspect the packet payload and metadata for signs of command-and-control or data exfiltration.. To determine if the outbound traffic is malicious, the responder must first inspect the packet payload and metadata. This direct analysis can reveal signs of exfiltration, such as large data transfers, unusual protocols, or communication patterns indicative of command-and-control. It provides concrete evidence before taking any containment or intelligence-gathering steps that might be premature.

Answer

Block the IP address at the firewall to stop the exfiltration.

Answer

Check the IP address against a threat intelligence feed to see if it is known malicious.

Answer

Perform reverse DNS lookup and WHOIS on the IP address to gather ownership information.

Question 19

An organization's incident response team has just completed the recovery phase of a major security incident. The team lead is now planning the post-incident activity. According to NIST SP 800-61, which of the following should be the PRIMARY focus of the lessons learned meeting?

Accepted Answer

Identifying improvements to the incident response plan and procedures based on what worked and what did not.. The primary focus of a lessons learned meeting after an incident is to review the response efforts and identify improvements to the incident response plan, procedures, and training. This aligns with NIST SP 800-61, which emphasizes that the meeting should produce actionable recommendations to enhance future response. It is not about discipline, financial reporting, or solely updating disaster recovery plans. The goal is continuous improvement of the incident response capability.

Answer

Updating the organization's disaster recovery plan to reflect the new threat landscape.

Answer

Calculating the total financial cost of the incident to report to stakeholders.

Answer

Determining which team members should be disciplined for mistakes made during the response.

Question 20

A security administrator is reviewing the organization's account management process. The policy states that user accounts must be reviewed at least quarterly to ensure that only authorized individuals retain access. During an audit, it is discovered that several former employees still have active accounts. Which of the following is the MOST appropriate action to address this finding?

Accepted Answer

Immediately disable the accounts and then review the account management process to identify why the accounts were not removed.. The most critical step is to immediately disable the accounts to eliminate the unauthorized access. Then, the administrator should investigate why the accounts were not removed to prevent similar issues. Deleting accounts can destroy evidence and is not best practice; resetting passwords does not revoke access; and delaying action increases risk. Thus, disabling and then reviewing the process is the correct approach.

Answer

Delete the accounts and then perform a full audit of all user accounts to ensure no other former employees have access.

Answer

Document the finding in the audit report and schedule the account removals for the next quarterly review cycle.

Answer

Reset the passwords on the accounts and notify the former employees' managers to confirm whether access is still needed.