SSCP Practice Exam 58 — 20 Questions

Question 1

A network engineer is designing a secure WAN link between two offices using IPsec VPN. The company requires encryption of all traffic, authentication of both endpoints, and protection against replay attacks. Which combination of IPsec protocols and modes should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ESP in tunnel mode. ESP in tunnel mode encrypts and authenticates the entire original IP packet, providing confidentiality, integrity, and authentication for the entire payload. It also includes sequence numbers to protect against replay attacks, making it the correct choice for a secure WAN link between two offices.

Answer

AH in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 2

During a security audit, it is discovered that a legacy system uses SNMPv1 for network monitoring. Which of the following is the primary security concern?

Accepted Answer

Community strings transmitted in cleartext. SNMPv1 transmits community strings (effectively passwords) in cleartext over the network. An attacker capturing network traffic can directly read the community string and gain unauthorized access to SNMP-managed devices. This lack of confidentiality is the primary security concern because it exposes the entire monitoring infrastructure to compromise.

Answer

Weak hashing

Answer

No access control

Answer

Lack of encryption

Question 3

An attacker sends a flood of DHCP request packets with spoofed MAC addresses to exhaust the DHCP server's IP address pool, preventing legitimate clients from obtaining IP addresses. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation exhausts the IP pool by sending many fake DHCP requests, leading to denial of service.

Answer

ARP poisoning

Answer

MAC flooding

Answer

DHCP spoofing

Question 4

Which TWO of the following are key components of the 3-2-1 backup rule?

Accepted Answer

At least three copies of the data. The 3-2-1 backup rule mandates at least three copies of the data (one primary and two backups) to ensure redundancy against failures. Option D directly states this requirement, which is the '3' in the rule.

Answer

One copy stored in a different geographic location

Answer

Daily full backups

Answer

All backups must be encrypted

Question 5

An organization experiences malware that injects code into legitimate processes. Which security feature should be enabled to prevent code execution in memory pages?

Accepted Answer

Data Execution Prevention (DEP). Data Execution Prevention (DEP) is a hardware and software security feature that marks memory pages as non-executable unless they explicitly contain executable code. By preventing code execution in data-only memory regions (such as the heap and stack), DEP stops malware that attempts to inject and run shellcode within legitimate processes, even if the process is compromised.

Answer

Encrypted File System (EFS)

Answer

Address Space Layout Randomization (ASLR)

Answer

Mandatory Access Control (MAC)

Question 6

Based on the exhibit, which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The exhibit shows a URL parameter containing SQL injection syntax (DROP TABLE users;). The %22%3B%20 sequence decodes to "; " which is used to break out of a SQL query. The destination is an internal host (10.0.0.100), likely a web application server. A status code of 500 indicates a server error, possibly due to the malicious input. Thus, SQL injection (Option D) is correct. The other options do not match the pattern.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

Buffer overflow

Question 7

Which of the following is the primary purpose of network segmentation?

Accepted Answer

Enhance security by isolating sensitive systems. The primary purpose of network segmentation is to enhance security by isolating sensitive systems and limiting lateral movement of threats. Option D is correct. Option A is incorrect because segmentation does not directly increase bandwidth. Option B is incorrect; while performance may improve due to reduced broadcast domains, security is the primary goal. Option C is incorrect because segmentation can complicate IP address management. Option E is incorrect because segmentation often increases hardware cost.

Answer

Increase bandwidth

Answer

Improve network performance

Answer

Simplify IP address management

Answer

Reduce hardware cost

Question 8

Which THREE of the following are key objectives of data classification?

Accepted Answer

Identify and protect sensitive information. Data classification is a foundational security control that directly supports the identification and protection of sensitive information. By categorizing data based on its sensitivity and criticality, organizations can apply appropriate security controls, such as access controls and encryption, to safeguard confidential data from unauthorized disclosure or modification.

Answer

Reduce storage costs by identifying duplicate data

Answer

Determine the encryption algorithm to use

Question 9

A security analyst is troubleshooting a network issue where users on VLAN 10 cannot reach a server on VLAN 20. The router has an ACL applied to the interface connected to VLAN 10. Which step should the analyst take first to isolate the problem?

Accepted Answer

Review the ACL configuration on the router interface. The ACL applied to the router interface connected to VLAN 10 is the most likely cause of the connectivity issue, as it can explicitly permit or deny traffic from VLAN 10 to VLAN 20. Reviewing the ACL configuration first allows the analyst to quickly determine if the traffic is being blocked by a deny statement or missing permit entry, which is a common and immediate cause of such inter-VLAN routing failures. This step is the most efficient because it directly addresses the access control mechanism at the routing boundary.

Answer

Run a traceroute from a user machine to the server

Answer

Check the ARP table for the server's MAC address

Answer

Verify the VLAN configuration on the switch

Question 10

Which TWO of the following are effective measures to prevent buffer overflow attacks in software development?

Accepted Answer

Validate all input to ensure it meets length constraints. Options A and E are correct. Input validation with length constraints (A) directly prevents buffer overflows by ensuring data does not exceed buffer boundaries. Bounds-checking functions like strncpy (E) also prevent overflows by limiting data copy. Stack canaries (B) detect overflows but do not prevent them; code obfuscation (C) hinders exploitation but does not prevent the vulnerability; ASLR (D) randomizes memory addresses but does not stop the overflow itself.

Answer

Implement stack canaries

Answer

Obfuscate the code to make exploitation harder

Answer

Enable Address Space Layout Randomization (ASLR)

Question 11

During incident response, a team member uses a tool to capture memory from a compromised Windows system. Which of the following best describes the order of volatility?

Accepted Answer

Network connections, memory, disk. The order of volatility dictates that the most volatile data (network connections) should be captured first, followed by memory, and finally disk. Network connections change constantly and are lost when the system is powered off, while memory (RAM) persists until power loss, and disk is the least volatile as it retains data even after shutdown. This sequence ensures critical evidence is preserved before it disappears.

Answer

Disk, memory, network

Answer

Memory, network, disk

Answer

Memory, disk, network connections

Question 12

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

Accepted Answer

Deviation detection. SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Answer

Patch management

Answer

Vulnerability scanning

Answer

Asset management

Question 13

An organization uses Kerberos for SSO. A user reports that after entering their password, they receive a 'ticket expired' error when trying to access a network share. The system administrator checks the Kerberos configuration. Which ticket is most likely expired?

Accepted Answer

Ticket-Granting Ticket (TGT). The Ticket-Granting Ticket (TGT) has a limited lifetime (typically 8-10 hours). When it expires, the user must re-authenticate to get a new TGT.

Answer

Session key

Answer

Service ticket

Answer

Authentication Server (AS) reply

Question 14

Which THREE of the following are common techniques for identifying risks?

Accepted Answer

Stakeholder interviews. Stakeholder interviews are a common technique for identifying risks because they leverage the knowledge and experience of individuals who have a direct interest in or are affected by the project or system. By engaging stakeholders, you can uncover risks that may not be apparent from documentation or technical analysis, as they provide insights into operational, regulatory, and business-specific threats. This aligns with the risk identification process in the SSCP domain, which emphasizes gathering input from diverse sources to build a comprehensive risk profile.

Answer

Penetration testing

Answer

Quantitative risk analysis

Question 15

A security engineer needs to select a hashing algorithm for storing user passwords in a database. Which of the following is the most secure choice?

Accepted Answer

bcrypt. (bcrypt) is correct because bcrypt is specifically designed for password hashing with a cost factor to resist brute-force attacks. Option A (SHA-256) is fast and suitable for data integrity, not password storage. Option B (MD5) is cryptographically broken and susceptible to collision attacks. Option D (SHA-1) is also weak and deprecated for security use. Option E (PBKDF2) is a good password hashing function, but bcrypt is often preferred due to its built-in salt and adaptive cost factor.

Answer

SHA-256

Answer

MD5

Answer

SHA-1

Answer

PBKDF2

Question 16

A company uses an identity management system that requires users to authenticate using a smart card and a PIN. This is an example of:

Accepted Answer

Two-factor authentication. Two-factor authentication (2FA) requires two distinct factors from different categories: something you have (the smart card) and something you know (the PIN). This combination provides stronger assurance than a single factor because an attacker would need both physical possession of the card and knowledge of the PIN to authenticate.

Answer

Single sign-on (SSO)

Answer

Biometric authentication

Answer

Multi-factor authentication

Question 17

An organization uses role-based access control (RBAC). After a merger, a user account from the acquired company is migrated into the parent company's domain. The user is assigned to multiple roles, but is unable to access a critical application that requires a specific role. The administrator verified that the user's account is enabled and the application server is reachable. What is the MOST likely cause?

Accepted Answer

The user's account was not assigned the required role.. In RBAC, access is granted based on the roles explicitly assigned to a user account. Since the administrator confirmed the account is enabled and the application server is reachable, the most likely cause is that the required role was not assigned to the migrated user. Without that role assignment, the user lacks the necessary permissions to access the critical application, regardless of other roles held.

Answer

The user's group memberships are conflicting with the required role.

Answer

There is a firewall rule blocking traffic from the user's IP range.

Answer

The application's session timeout is set too low.

Question 18

Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?

Accepted Answer

Default outbound connections are set to Allow, potentially allowing malware to communicate out. The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface. Therefore, the default outbound allow (B) poses the greatest risk.

Answer

Inbound connections are set to Block by default

Answer

The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic

Answer

The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery

Question 19

A security administrator is configuring a web server to use TLS. They want to optimize performance while maintaining strong security. Which cipher suite should they prioritize?

Accepted Answer

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy, ECDSA for efficient authentication, AES-256 in GCM mode for authenticated encryption, and SHA-384 for integrity. This combination provides the strongest security with modern, optimized algorithms, making it the best choice for performance and security on a TLS web server.

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

Answer

TLS_RSA_WITH_AES_128_CBC_SHA256

Answer

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Question 20

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Accepted Answer

Run a full antivirus and anti-malware scan on the restored systems. Running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.

Answer

Restore the systems from the most recent backup

Answer

Change all user passwords associated with the systems

Answer

Apply all security patches to the operating system