SSCP Practice Exam 58 — 20 Questions

Question 1

A security administrator is building a Security Information and Event Management (SIEM) correlation rule to detect a specific attack pattern on a Linux web server. The rule must identify attempts where an attacker sends a single malicious HTTP request that causes the server to execute an arbitrary operating system command. Which of the following event sources would provide the most reliable and immediate evidence for this rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Linux auditd logs configured to monitor execve system calls. Detecting arbitrary command execution requires visibility into process creation on the host. Linux auditd can monitor the execve system call, capturing the exact command line and parent process for every new program. This gives the SIEM immediate, high-fidelity evidence of the attack, unlike network flow or web access logs that lack process-level context.

Answer

Apache access logs with the Combined Log Format enabled

Answer

NetFlow records exported from the network router

Answer

Syslog messages from the SSH daemon

Question 2

A security administrator is reviewing network traffic logs and notices a large number of TCP SYN packets from various source IP addresses to a single destination IP address on port 443. The destination server is unresponsive. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. The scenario describes a large volume of TCP SYN packets from various sources to a single destination, resulting in an unresponsive server. This is indicative of a SYN flood attack, where the attacker sends numerous SYN requests but does not complete the TCP handshake, causing the server to exhaust its resources on half-open connections. Other attacks like Smurf, ping flood, or Teardrop involve different protocols or mechanisms and do not match the described traffic pattern.

Answer

Teardrop attack

Answer

Ping flood

Answer

Smurf attack

Question 3

A small business wants to prevent employees from accessing known malicious websites without deploying a full next-generation firewall. The IT consultant recommends a service that filters DNS queries before they reach the public internet. Which technology is being described?

Accepted Answer

A DNS filtering service that blocks resolution of known malicious domains.. DNS filtering works by checking each name resolution request against a threat intelligence feed and returning a block response for known malicious domains. It requires no inline firewall, covers all applications that use DNS, and is simple to deploy for a small business. The other options address different layers or purposes and would not deliver the same lightweight outbound protection.

Answer

A web application firewall (WAF) placed in front of the company's public website.

Answer

An intrusion prevention system (IPS) deployed inline at the network perimeter.

Answer

A forward proxy that caches frequently visited web content.

Question 4

A security engineer is implementing a Network Access Control (NAC) solution to enforce endpoint compliance before allowing devices onto the corporate network. Which TWO of the following are common NAC enforcement methods? (Choose two.)

Accepted Answer

802.1X with RADIUS authentication. Common NAC enforcement methods include 802.1X with RADIUS authentication and captive portals with posture assessment. 802.1X provides port-based access control using authentication, while captive portals redirect users to a web page for authentication and compliance checks. Both methods can enforce endpoint compliance before granting network access. DHCP snooping, VLAN hopping prevention, and MAC filtering are security features but do not provide the identity and posture assessment typical of NAC.

Answer

VLAN hopping prevention

Answer

MAC address filtering

Answer

DHCP snooping with IP source guard

Question 5

A security administrator is reviewing a network diagram and identifies several controls intended to reduce the attack surface of a demilitarized zone (DMZ). Which TWO controls best limit the impact of a compromised DMZ host on the internal network? (Choose two.)

Accepted Answer

Enforce strict firewall rules that permit only required outbound flows from the DMZ to specific internal hosts and ports.. Limiting the impact of a compromised DMZ host depends on restricting what that host can reach. Strict egress rules from the DMZ and a separate firewall with authentication for DMZ-to-internal connections both enforce least privilege at the boundary. Sharing a VLAN with internal servers or allowing unrestricted egress removes containment, and promiscuous mode on production ports increases exposure rather than reducing it.

Answer

Enable promiscuous mode on the DMZ switch ports so that monitoring tools can capture all traffic.

Answer

Deploy the DMZ on the same VLAN as internal servers to simplify administration and monitoring.

Answer

Allow all outbound traffic from the DMZ to any destination so that services can reach update servers without interference.

Question 6

A network engineer is implementing a secure network design that requires separating the network into multiple segments to limit the scope of a potential breach. The engineer wants to ensure that even if one segment is compromised, the attacker cannot easily move laterally to other segments. Which of the following technologies should be implemented to achieve this?

Accepted Answer

VLAN segmentation with ACLs. VLAN segmentation combined with ACLs allows the network to be divided into isolated logical segments with controlled traffic between them. This limits lateral movement because an attacker in one VLAN cannot access other VLANs without passing through the ACLs, which can be configured to deny unauthorized traffic. Other options like NAT, DMZ, and VPN do not provide the same level of internal segmentation and access control.

Answer

Network Address Translation (NAT)

Answer

Demilitarized zone (DMZ)

Answer

Virtual Private Network (VPN)

Question 7

A security team is reviewing how their organization's DNS infrastructure could be abused. They want to reduce the risk of DNS cache poisoning and of data being smuggled out of the network through DNS queries. Which two measures best address these risks? (Choose two.)

Accepted Answer

Deploy DNSSEC validation on the recursive resolvers so that responses can be cryptographically verified against the authoritative zone. DNSSEC validation gives resolvers cryptographic proof that answers are authentic, which neutralizes forged responses used in cache poisoning. Constraining clients to internal resolvers and blocking outbound DNS to arbitrary servers keeps all resolution inside a monitored path, enabling detection of tunneling and preventing bypass of the validating resolver. Together they cover both integrity of answers and visibility into query behavior.

Answer

Increase the default TTL on all internal DNS records so that cached entries remain valid longer

Answer

Enable EDNS0 Client Subnet on the authoritative servers to return geographically accurate answers

Answer

Configure the internal resolvers to forward all queries to a public open resolver such as a large third-party service

Question 8

A mobile device management (MDM) administrator at a healthcare company needs to ensure that a physician's personally owned smartphone can access patient records through the corporate email application, but the administrator must be able to remotely erase only the corporate email data and its encryption keys if the device is lost, without deleting the physician's personal photos and apps. Which MDM capability should the administrator configure?

Accepted Answer

Enable selective wipe, also called enterprise wipe, which removes only corporate email data and associated keys.. Selective wipe, also known as enterprise wipe, is the MDM feature that removes only corporate data and its encryption keys from a personally owned device. It preserves the user's personal content, making it the correct choice for BYOD scenarios. Full-device wipe, passcode policies, and copy-paste restrictions do not provide the required granular remote erasure of corporate email data.

Answer

Configure a full-device remote wipe that removes all data after a predefined number of failed unlock attempts.

Answer

Enroll the device in a mobile application management (MAM) policy that blocks copy and paste between apps.

Answer

Apply a device-level passcode policy that requires a six-digit PIN and disables the camera application.

Question 9

A network administrator is configuring a demilitarized zone (DMZ) to host a public web server. The server must be accessible from the internet but should be isolated from the internal network. Which of the following is the primary security benefit of placing the web server in a DMZ?

Accepted Answer

It limits the exposure of the internal network if the web server is compromised.. The primary security benefit of a DMZ is to isolate public-facing services from the internal network. If the web server in the DMZ is compromised, the attacker cannot directly access internal systems because firewalls restrict traffic between the DMZ and the internal network. This segmentation limits the damage. Other options describe encryption, prevention, or patching, which are not inherent to a DMZ.

Answer

It provides encryption for all traffic to and from the web server.

Answer

It prevents all attacks against the web server by filtering malicious traffic.

Answer

It automatically patches the web server against vulnerabilities.

Question 10

A security administrator needs to securely transfer files between two servers over an untrusted network. The administrator wants to use a protocol that provides encryption and authentication and operates over TCP port 22. Which protocol should be used?

Accepted Answer

Secure Shell (SSH) File Transfer Protocol (SFTP). SFTP is the correct protocol because it runs over SSH on TCP port 22, providing encryption and authentication for file transfers. FTP, TFTP, and HTTP are insecure and do not meet the requirements. SFTP ensures that data remains confidential and integrity-protected during transit, making it suitable for untrusted networks.

Answer

File Transfer Protocol (FTP)

Answer

Hypertext Transfer Protocol (HTTP)

Answer

Trivial File Transfer Protocol (TFTP)

Question 11

A security analyst is reviewing a proposed cryptographic design for a new messaging application. The design uses AES-256 in Galois/Counter Mode (GCM) for confidentiality and integrity, but the analyst notices that the same nonce is generated for multiple messages under the same key. What is the MOST likely security consequence of this flaw?

Accepted Answer

The integrity protection is broken, allowing an attacker to forge authentication tags and inject messages.. In AES-GCM, the nonce must be unique for each encryption under a given key. Reusing a nonce allows an attacker to recover the GHASH subkey H and forge authentication tags, completely breaking integrity and authenticity. Although confidentiality is also weakened because the keystream repeats, the most critical consequence is the ability to inject undetected messages, which invalidates the application's trust model.

Answer

The performance of the encryption degrades because the nonce is used to seed the counter, causing counter collisions.

Answer

The confidentiality of the messages is lost because the keystream is reused, allowing XOR-based plaintext recovery.

Answer

The encryption key is immediately exposed, requiring rekeying of all sessions.

Question 12

A security analyst is configuring a network intrusion detection system (NIDS) to monitor traffic for signs of a SYN flood attack. The analyst wants to generate alerts when the number of half-open connections exceeds a threshold. Which TWO of the following metrics are MOST relevant for detecting a SYN flood? (Choose two.)

Accepted Answer

Number of SYN packets received per second. A SYN flood is characterized by a high volume of SYN packets and a corresponding increase in half-open connections. Monitoring these two metrics allows the NIDS to detect the attack by recognizing the abnormal rate of SYNs and the accumulation of incomplete handshakes. The other metrics do not directly reflect the mechanics of a SYN flood and would not provide reliable detection.

Answer

Number of established connections

Answer

Number of ICMP echo requests

Answer

Number of RST packets sent

Question 13

A healthcare organization is developing a mobile application that stores patient data locally on the device. The security team must ensure that if a device is lost or stolen, the data cannot be accessed without the user's authentication. Which of the following controls should be implemented to meet this requirement?

Accepted Answer

Enable full-device encryption and require a strong passcode.. The most direct control to prevent access to locally stored data on a lost or stolen device is full-device encryption tied to a passcode. This ensures that without the correct passcode, the encryption keys cannot be derived, rendering the data unreadable. Other options address different threats such as network interception or reverse engineering, but not data-at-rest confidentiality.

Answer

Use obfuscation to hide the application's code and data structures.

Answer

Store all patient data in a remote database and cache nothing locally.

Answer

Implement certificate pinning for all API communications.

Question 14

A healthcare SaaS provider runs its application stack on Docker containers orchestrated by Kubernetes in a public cloud. A security administrator must reduce the risk of a compromised container accessing the underlying node's kernel. Which control BEST addresses this requirement?

Accepted Answer

Deploy containers with gVisor or Kata Containers to provide a sandboxed kernel boundary.. Sandboxed container runtimes such as gVisor and Kata Containers create a kernel boundary between the workload and the node, directly reducing the impact of a compromised container. Network policies, secret encryption, and resource quotas address networking, confidentiality, and availability respectively, but none of them prevent a container from interacting with the host kernel.

Answer

Set CPU and memory resource requests and limits on each container specification.

Answer

Configure Kubernetes Secrets to encrypt environment variables used by the application.

Answer

Enable Kubernetes NetworkPolicy to restrict pod-to-pod traffic on the cluster network.

Question 15

A security analyst is investigating a potential attack on a web application. The analyst observes that an attacker is sending specially crafted requests that cause the application to execute unintended commands on the underlying operating system. Which type of attack is this?

Accepted Answer

Command injection. Command injection is the correct answer because the scenario describes an attacker causing the application to execute unintended operating system commands. This occurs when user input is passed to a system shell without proper sanitization. XSS targets the browser, SQL injection targets the database, and CSRF tricks the user's browser into making requests. None of these directly result in OS command execution as described.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 16

A security operations center (SOC) is investigating a suspected supply chain attack where a trusted software update was modified to include a backdoor. The update was delivered via the vendor's official update server over HTTPS. Which of the following controls, if implemented by the organization, would have BEST prevented the installation of the backdoored update?

Accepted Answer

Code signing verification of the update package before installation.. Code signing verification is the key control to ensure the integrity and authenticity of software updates. If the update was modified after signing, the signature check fails, and the installation is blocked. Other controls like network segmentation or TLS pinning do not protect against a compromised update server or a malicious insider at the vendor.

Answer

TLS certificate pinning for the update server connection.

Answer

Network segmentation between the update server and critical systems.

Answer

Endpoint detection and response (EDR) with behavioral monitoring.

Question 17

A security administrator at a hospital is configuring a server that processes electronic health records. The server runs a Linux-based operating system, and the administrator needs to select a mandatory access control (MAC) framework that can enforce granular, policy-based restrictions on how processes interact with files, network ports, and other system resources. Which of the following should the administrator choose?

Accepted Answer

SELinux. SELinux provides mandatory access control by labeling subjects and objects and enforcing administrator-defined policy in the kernel, restricting processes regardless of user identity. The other choices describe authentication hardening or discretionary and role-based models that do not enforce system-wide mandatory policy. For a Linux server holding regulated health data, SELinux is the correct framework to meet the granular MAC requirement.

Answer

Password complexity and account lockout policies

Answer

Role-based access control (RBAC) through group membership

Answer

Discretionary access control (DAC) via standard file permissions

Question 18

A financial services company runs a customer-facing mobile banking API on Linux containers. A penetration test reveals that when the API receives an oversized JSON payload, the application returns a stack trace containing internal file paths and database connection strings. The developer wants to prevent this information disclosure without changing the API's core business logic. Which control should the security practitioner recommend FIRST?

Accepted Answer

Configure the application to return generic error messages and log detailed exceptions server-side only.. The core issue is an information disclosure vulnerability caused by improper error handling. Returning generic messages to clients while logging details internally removes the sensitive data from the response path and preserves troubleshooting capability. WAFs and logging are useful compensating or detective controls, but they do not eliminate the root cause, which is the application revealing internal implementation details.

Answer

Deploy a web application firewall in blocking mode with signatures for known stack trace patterns.

Answer

Increase the maximum allowed request body size in the API gateway to reject oversized payloads.

Answer

Enable full verbose logging in the API and ship logs to a centralized SIEM for alerting.

Question 19

A security administrator is deploying a new web application on a Linux server and wants to prevent an attacker who compromises the web server process from reading the application's private TLS keys stored on the same host. The administrator decides to use a hardware security module (HSM) to protect the keys. Which of the following BEST describes how the HSM provides this protection?

Accepted Answer

The HSM performs cryptographic operations internally so the private key never leaves the hardware boundary.. A hardware security module protects private keys by generating and using them inside tamper-resistant hardware. The key never enters the host's memory or file system, so a compromised web server process cannot read it. Encrypting keys on disk, using a TPM, or replicating keys to a CPU enclave still exposes the key material to the host at some point, which fails the stated requirement.

Answer

The HSM stores the private keys in a file encrypted with a passphrase that only the web server process knows.

Answer

The HSM encrypts the private key with a key derived from the server's TPM and stores the ciphertext on disk.

Answer

The HSM replicates the private key to a secure enclave in the server CPU, where it is used for TLS handshakes.

Question 20

A financial services firm is migrating a customer-facing web application to a containerized platform. The security team wants to reduce the risk of a compromised container accessing the host kernel or other containers. Which of the following is the MOST effective control to limit the impact of a container breakout?

Accepted Answer

Enforcing a seccomp profile that allows only required system calls. Seccomp profiles constrain the system call interface exposed to container processes, directly shrinking the kernel attack surface an attacker can use to escape. Read-only filesystems, image scanning, and logging all add value at different stages but do not restrict runtime kernel interactions. Restricting syscalls is the most effective way to limit breakout impact on a shared host.

Answer

Scanning container images for known vulnerabilities before deployment

Answer

Enabling verbose logging of container stdout and stderr

Answer

Running containers with a read-only root filesystem