SSCP Practice Exam 57 — 20 Questions

Question 1

A security analyst is responding to a confirmed malware infection on a Windows workstation. The workstation is still powered on and connected to the corporate network. The analyst needs to collect volatile data that could be lost if the system is shut down or the malware is allowed to continue running. Which TWO of the following data sources should the analyst prioritize for collection? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active network connections and associated process IDs.. The two most volatile data sources are RAM contents and active network connections with process IDs. Both are lost when the system is powered off or the malware terminates its connections. Registry hives, MFT, and event logs are stored on disk and persist, so they can be collected later. Prioritizing volatile data aligns with the order of volatility in incident response.

Answer

Event logs stored in the C:\Windows\System32\winevt\Logs directory.

Answer

The master file table (MFT) on the NTFS volume.

Answer

The Windows Registry hive files stored on the hard drive.

Question 2

A security administrator is conducting a risk assessment for a new cloud-based application. The administrator needs to identify TWO factors that are most important when determining the appropriate security controls for the application. (Choose two.)

Accepted Answer

The regulatory requirements applicable to the data. Data sensitivity and regulatory requirements are the two most important factors because they define the impact of a breach and the mandatory controls. Sensitivity drives risk-based decisions, while regulations impose specific obligations. User count, programming language, and data center location are secondary and do not directly determine the appropriate security controls.

Answer

The physical location of the cloud provider's data center

Answer

The programming language used to develop the application

Answer

The number of users who will access the application

Question 3

An incident responder is collecting evidence from a compromised Linux server. The responder uses the 'dd' command to create an image of the hard drive. Which of the following is the PRIMARY reason for using a write blocker during this process?

Accepted Answer

To ensure the imaging process does not modify the original evidence.. A write blocker is a hardware or software tool that allows read-only access to a storage device, preventing any write operations. Its primary purpose is to ensure that the original evidence is not modified during forensic imaging. This preservation of integrity is crucial for the evidence to be admissible in court and for accurate analysis.

Answer

To prevent the operating system from mounting the drive and altering timestamps.

Answer

To increase the speed of the imaging process by bypassing file system checks.

Answer

To allow the responder to write notes directly to the evidence drive for documentation.

Question 4

A healthcare organization's security team is reviewing a third-party cloud provider that will store electronic protected health information. The provider's SOC 2 Type II report is two years old, and the provider has since migrated to a new data center. Which action should the security administrator take FIRST to determine whether the provider still meets the organization's security requirements?

Accepted Answer

Request the provider's current SOC 2 Type II report or bridge letter covering the new data center period.. A SOC 2 Type II report is point-in-time evidence covering a defined audit period and specific systems. Because the provider migrated to a new data center after the report was issued, the prior opinion does not cover the current environment. Requesting an updated report or a bridge letter is the correct first action because it provides current, independent assurance before the organization makes contractual or technical decisions.

Answer

Immediately terminate the contract and select a new cloud provider with a current SOC 2 report.

Answer

Accept the existing SOC 2 Type II report because it demonstrates the provider has a mature security program.

Answer

Perform a full penetration test of the provider's new data center without notifying the provider.

Question 5

A security administrator is tasked with implementing a formal process for managing user access rights. The organization requires that access be granted based on job roles and that users receive only the permissions necessary to perform their duties. Which of the following should the administrator implement?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is designed to assign permissions to roles and then assign users to those roles, ensuring that users have only the access required for their job functions. This satisfies the requirement for role-based provisioning and least privilege. Other models like MAC, DAC, or ABAC do not align as directly with the stated need.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Attribute-based access control (ABAC)

Question 6

A security engineer is reviewing a network architecture that uses IPsec in tunnel mode between two site gateways. The engineer must verify that the design provides confidentiality for the entire original IP packet. Which component of the IPsec architecture is responsible for encrypting the payload and providing confidentiality?

Accepted Answer

Encapsulating Security Payload (ESP). In IPsec, ESP is the protocol that provides confidentiality by encrypting the payload. In tunnel mode, it encrypts the entire original IP packet, ensuring that the contents are protected. AH only provides integrity and authentication without encryption, while IKE and SAs are supporting components that establish and define security parameters but do not perform encryption.

Answer

Security Association (SA)

Answer

Internet Key Exchange (IKE)

Answer

Authentication Header (AH)

Question 7

A security administrator is implementing a new file integrity monitoring (FIM) solution on critical servers. The administrator needs to ensure that the solution can detect unauthorized changes to system binaries and configuration files. Which of the following should the administrator configure to establish a trusted baseline for the FIM solution?

Accepted Answer

Generate cryptographic hashes of the files and store them in a secure, offline location.. To establish a trusted baseline for FIM, the administrator must capture the current state of critical files, typically by generating cryptographic hashes. Storing these hashes securely offline prevents tampering. File access auditing, backups, and registry monitoring do not provide a file content baseline. Therefore, the correct action is to generate and securely store file hashes.

Answer

Schedule a daily full backup of the critical servers and store the backups on a separate network share.

Answer

Configure the FIM solution to monitor the Windows Registry for changes to critical keys.

Answer

Enable auditing of file access events in the operating system's security log.

Question 8

A network administrator is configuring a switch to prevent unauthorized devices from connecting to a specific switch port. The administrator wants to restrict access based on the device's MAC address. Which feature should be implemented?

Accepted Answer

Port security. Port security is the switch feature that restricts access to a port based on MAC addresses. It can be configured to allow only specific MAC addresses or a maximum number of addresses. When a violation occurs, the switch can drop packets, send an alert, or shut down the port. This effectively prevents unauthorized devices from connecting.

Answer

Dynamic ARP Inspection (DAI)

Answer

VLAN pruning

Answer

Spanning Tree Protocol (STP)

Question 9

A security analyst is reviewing the cryptographic controls for a new messaging application. The application must ensure that messages are encrypted in transit and that the sender cannot later deny having sent a message. Which two of the following cryptographic mechanisms should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Digital signatures using the sender's private key. To encrypt messages in transit, TLS is appropriate as it provides confidentiality and integrity for data in transit. To ensure non-repudiation, digital signatures using the sender's private key are required because they uniquely bind the sender to the message. Symmetric encryption, hashing, and HMAC do not provide non-repudiation.

Answer

Keyed-hash message authentication code (HMAC)

Answer

Hashing messages with SHA-256

Answer

Symmetric encryption using a shared secret key

Question 10

A security administrator is implementing a security awareness training program. The administrator wants to measure the effectiveness of the training in reducing phishing susceptibility. Which of the following metrics would be MOST indicative of the training's success?

Accepted Answer

The number of phishing emails reported by employees during simulated campaigns.. To measure the effectiveness of phishing awareness training, the best metric is behavioral. The number of phishing emails reported during simulations shows whether employees are applying what they learned. Completion rate, gateway blocks, and training time do not directly measure reduced susceptibility. Therefore, reported phishing emails is the most indicative metric.

Answer

The total number of phishing emails blocked by the email gateway.

Answer

The average time taken by employees to complete the training module.

Answer

The percentage of employees who completed the training module.

Question 11

A software vendor distributes patches over the internet. Customers must be able to verify that a patch came from the vendor and was not altered in transit. The vendor wants to use a digital signature. Which key should the vendor use to create the signature?

Accepted Answer

The vendor's private key. Digital signatures rely on asymmetric cryptography: the signer uses its private key to sign a hash of the data, and verifiers use the signer's public key to check the signature. Because only the vendor holds its private key, a valid signature proves the patch originated from the vendor and was not altered. Public keys, symmetric keys, and customer keys cannot provide this combination of authenticity and integrity.

Answer

The customer's private key

Answer

A symmetric session key shared with each customer

Answer

The vendor's public key

Question 12

A security administrator is implementing a mandatory vacation policy for employees in sensitive roles. The administrator needs to ensure that the policy supports the detection of fraudulent activities. Which control should be implemented alongside mandatory vacations to maximize its effectiveness?

Accepted Answer

Job rotation. Job rotation ensures that multiple employees perform the same duties, increasing the likelihood that fraudulent transactions or irregularities are noticed. When paired with mandatory vacations, it removes the single-person dependency that allows fraud to remain hidden. This combination is a classic segregation of duties and detective control pairing.

Answer

Security awareness training

Answer

Acceptable use policy

Answer

Background checks

Question 13

A security analyst is reviewing a proposed solution that uses a stream cipher to encrypt real-time voice traffic. Which property of stream ciphers makes them well suited for this scenario?

Accepted Answer

They encrypt data one bit or byte at a time, avoiding the need to pad to a block boundary.. Stream ciphers operate on small units of data, such as bits or bytes, and do not require padding to a block boundary. This makes them efficient for continuous, low-latency traffic like real-time voice, where waiting for a full block would add delay. They are symmetric and provide confidentiality only, so properties such as non-repudiation, per-call key pairs, and compression are not inherent to them.

Answer

They require a unique public/private key pair for every call.

Answer

They provide built-in non-repudiation for each voice packet.

Answer

They automatically compress voice data before encryption.

Question 14

A network architect is designing a demilitarized zone (DMZ) for a company that hosts a public web server and an internal database. The architect must ensure that if the web server is compromised, the attacker cannot directly access the internal database. Which DMZ design principle should be applied?

Accepted Answer

Use a screened subnet with two firewalls: an external firewall between the internet and DMZ, and an internal firewall between DMZ and internal network.. Using a screened subnet with two firewalls provides defense in depth: the external firewall protects the DMZ from the internet, and the internal firewall protects the internal network from the DMZ. If the web server is compromised, the attacker still faces the internal firewall, which should only allow specific traffic to the database. Placing the database in the DMZ or allowing unrestricted DMZ-to-internal traffic would eliminate this protection.

Answer

Implement a single firewall with three interfaces: internet, DMZ, and internal network, with rules allowing any traffic between DMZ and internal.

Answer

Allow all traffic from the DMZ to the internal network to ensure the web server can retrieve data from the database.

Answer

Place the database in the same DMZ as the web server to simplify firewall rules.

Question 15

A financial services firm needs to detect unauthorized changes to its public DNS records that could redirect customers to a phishing site. The security team wants a control that validates DNS responses cryptographically so that a resolver can verify the data originated from the authoritative zone. Which technology should they implement?

Accepted Answer

DNSSEC (Domain Name System Security Extensions). DNSSEC is the only listed control that signs DNS records and lets a validating resolver verify their origin and integrity through a chain of trust. Encryption options such as DoH protect the query path but not the data's authenticity, while sinkholing and split-horizon DNS address different problems. For detecting tampering with public records, DNSSEC provides the required cryptographic assurance.

Answer

DNS over HTTPS (DoH)

Answer

DNS sinkholing

Answer

Split-horizon DNS

Question 16

A security engineer is deploying a Network Intrusion Detection System (NIDS) on a switched network. The engineer needs to ensure the NIDS can monitor all traffic passing through a critical switch port that connects to a server. Which technology should be configured on the switch to copy traffic from the server port to the NIDS monitoring port?

Accepted Answer

Port mirroring (SPAN). Port mirroring (SPAN) is the correct technology because it copies traffic from a source port to a destination port, allowing a NIDS to monitor all traffic without being inline. STP, VLAN trunking, and LACP serve different purposes: loop prevention, carrying multiple VLANs, and link aggregation, respectively. None of them replicate traffic to a monitoring port. Port mirroring is essential for passive monitoring in switched environments.

Answer

Link Aggregation Control Protocol (LACP)

Answer

Spanning Tree Protocol (STP)

Answer

Virtual LAN (VLAN) trunking

Question 17

A network architect is evaluating a remote access design where users must authenticate with a hardware token and the session must be resistant to replay even if an attacker captures the encrypted traffic. Which protocol property should the architect prioritize?

Accepted Answer

Per-session ephemeral keys established through a Diffie-Hellman exchange.. Replay resistance and forward secrecy depend on fresh, per-session cryptographic material. Ephemeral Diffie-Hellman generates a unique key for each session, so a recorded handshake cannot be replayed against a new session and compromise of one key does not expose others. Static keys and strong bulk encryption alone do not provide these properties, and split tunneling is unrelated to the authentication exchange.

Answer

Use of a shared static key for all sessions to simplify key management.

Answer

Split tunneling so only corporate traffic traverses the encrypted tunnel.

Answer

Pre-shared key authentication with AES-256 encryption in tunnel mode.

Question 18

A security administrator is hardening a data center switch. Management requires that only the switch's configured management station can initiate a remote CLI session, and that the switch never accept an inbound management connection from any other host. Which control should the administrator implement on the switch to meet this requirement?

Accepted Answer

An inbound access control list applied to the management VLAN interface that permits only the management station's IP address to reach TCP port 22. Restricting the management plane by source address is the only control listed that limits who may initiate an administrative session. An inbound ACL bound to the management interface permits the approved management station and denies everything else, directly matching the stated policy. Authentication, port security, and loop-prevention features address different problems and leave the management service reachable from any host on the network.

Answer

BPDU Guard enabled on all access ports to prevent rogue spanning-tree devices

Answer

Port security configured on every access port with a maximum of one learned MAC address

Answer

A TACACS+ or RADIUS server that authenticates all administrative logins with individual accounts

Question 19

A security administrator at a software company is reviewing the organization's security assessment strategy. The administrator must select an assessment method that evaluates the effectiveness of implemented controls through direct observation and testing, rather than relying on interviews or documentation review alone. Which assessment method should the administrator choose?

Accepted Answer

An independent security assessment that includes interviews, documentation review, and control testing.. Evaluating control effectiveness requires evidence beyond what people say or what policies state. An independent assessment that performs control testing through observation, sampling, and technical verification provides that evidence and reduces bias. Self-assessments, policy reviews, and vulnerability scans each address only part of the picture and cannot confirm that controls operate as designed across the organization.

Answer

A compliance review of the organization's written security policies and standards.

Answer

A self-assessment questionnaire completed by each department manager.

Answer

A vulnerability scan of all internet-facing systems using an automated scanner.

Question 20

A security administrator needs to verify the integrity and authenticity of a downloaded software package. The vendor provides a separate file containing a cryptographic hash of the package, but the hash file itself is not signed. Which action BEST mitigates the risk of a modified package being accepted?

Accepted Answer

Obtain the hash value from a trusted, independent source and compare it to a locally computed hash.. Hashes alone provide integrity only when the reference value is trusted. Since the provided hash file is unsigned and could be altered alongside the package, the administrator must obtain the expected hash through an independent, authenticated channel. Comparing a locally computed hash against that trusted value detects tampering, whereas using the untrusted file or changing algorithms does not.

Answer

Compare the provided hash with a hash computed locally using the same algorithm.

Answer

Decrypt the package using the vendor's public key before hashing it.

Answer

Recompute the hash using a different algorithm and compare it to the vendor's hash.