SSCP Practice Exam 59 — 20 Questions

Question 1

A security analyst is reviewing network traffic and notices a large number of ICMP echo requests from a single source to multiple destinations within the organization's network. The analyst suspects a reconnaissance attempt. Which type of attack is most likely being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ping sweep. A ping sweep is a reconnaissance technique that uses ICMP echo requests to identify live hosts on a network. The scenario describes a single source sending ICMP echo requests to multiple destinations, which matches the pattern of a ping sweep. Other ICMP-based attacks like Smurf, Ping of Death, and ICMP flood have different characteristics and objectives.

Answer

Ping of death

Answer

Smurf attack

Answer

ICMP flood

Question 2

A developer is building a mobile banking application and wants to ensure that if an attacker gains physical access to a rooted or jailbroken device, the application's sensitive data stored locally cannot be easily read. The developer decides to use the secure storage provided by the mobile operating system. Which of the following BEST describes the protection offered by this secure storage?

Accepted Answer

Data is encrypted with a hardware-backed key stored in a secure element or trusted execution environment.. Mobile operating systems provide secure storage such as iOS Keychain and Android Keystore, which encrypt data with hardware-backed keys stored in a secure element or trusted execution environment. This protects sensitive data even on rooted or jailbroken devices because the key cannot be easily extracted. Password-derived keys, obfuscation, and sandbox permissions do not provide equivalent protection against a privileged attacker.

Answer

Data is encrypted with a key derived from the user's login password, which is never stored on the device.

Answer

Data is stored in a hidden directory that is inaccessible to other applications due to sandbox permissions.

Answer

Data is obfuscated using a proprietary algorithm that changes with each application release to prevent reverse engineering.

Question 3

A security administrator is implementing application whitelisting on a fleet of Linux servers that run a fixed set of approved binaries. The administrator wants to ensure only authorized executables can run, while still allowing legitimate administrative scripts. Which TWO of the following approaches BEST support this goal? (Choose two.)

Accepted Answer

Use an integrity measurement and attestation mechanism that records hashes of approved binaries and blocks execution of unlisted files.. Effective application whitelisting on Linux relies on preventive controls that stop unapproved executables before they run. Integrity measurement with attestation and mandatory access control profiles both enforce an allowlist at execution time, while still permitting approved administrative scripts when properly configured. Detection and hardening measures are useful complements but do not by themselves guarantee that only authorized binaries execute.

Answer

Enable a host-based intrusion detection system that alerts on execution of unknown binaries.

Answer

Mount the application directories as read-only and restrict write access to root only.

Answer

Configure a cron job that periodically compares running processes against a known-good list and kills anomalies.

Question 4

A small business wants to protect data stored on employee laptops. The security policy requires that if a laptop is lost or stolen, the data on its disk cannot be read by anyone without the proper authentication. Which of the following should be implemented?

Accepted Answer

Full disk encryption. Full disk encryption ensures that data at rest is ciphertext and unreadable without the correct key or authentication, which is exactly the protection needed when a laptop is lost or stolen. The other controls address runtime monitoring, integrity, or network filtering and do not prevent offline disk reading. For portable devices, encryption is the foundational data-at-rest control.

Answer

A personal firewall

Answer

File integrity monitoring

Answer

A host-based intrusion detection system

Question 5

A network architect is designing a solution to protect against ARP spoofing attacks on a flat Layer 2 network. The architect wants to ensure that only valid IP-to-MAC address mappings are used by hosts. Which feature should be enabled on the switches?

Accepted Answer

Dynamic ARP Inspection (DAI). Dynamic ARP Inspection (DAI) is the switch feature specifically designed to prevent ARP spoofing by validating ARP packets against a trusted binding table. It drops packets with invalid IP-to-MAC mappings, ensuring that hosts only receive legitimate ARP information. The other options do not provide this capability, although DHCP snooping is often used to build the binding table that DAI relies on.

Answer

802.1X authentication

Answer

DHCP snooping

Answer

Port security

Question 6

A security analyst is reviewing a web application that stores user session identifiers in cookies. The analyst wants to recommend cookie attributes that reduce the risk of session hijacking through cross-site scripting (XSS) and cross-site request forgery (CSRF). Which TWO of the following cookie attributes should the analyst recommend? (Choose two.)

Accepted Answer

SameSite. HttpOnly prevents JavaScript from reading the session cookie, mitigating session theft via XSS. SameSite restricts the browser from sending the cookie on cross-site requests, mitigating CSRF. Together they address both threats named in the scenario. Secure, Domain, and Max-Age provide other benefits but do not directly counter XSS cookie theft or CSRF in the way the analyst requires.

Answer

Max-Age

Answer

Domain

Answer

Secure

Question 7

A security analyst is reviewing an application that accepts a user-supplied file path and uses it to read a configuration file from disk. The analyst observes that a user can enter ../../etc/passwd and the application returns the contents of that system file. Which of the following best describes this vulnerability?

Accepted Answer

Path traversal. The ability to enter ../ sequences and retrieve a file outside the intended directory is the defining behavior of path traversal. The application fails to canonicalize and validate the supplied path, allowing access to files such as /etc/passwd. The other choices describe client-side script injection, object identifier manipulation, or forced server requests, none of which match the observed file-read behavior.

Answer

Server-side request forgery

Answer

Insecure direct object reference

Answer

Cross-site scripting

Question 8

A company is deploying a new web application that will be accessible to the public. The security team wants to ensure that session identifiers cannot be predicted or reused by an attacker who captures one over an unencrypted network segment. Which control should be implemented to BEST address this risk?

Accepted Answer

Generate session identifiers using a cryptographically secure random number generator and transmit them only over TLS.. The risk is twofold: an attacker might predict a session identifier or capture one on the network. Using a cryptographically secure random generator makes prediction infeasible, and requiring TLS for transmission prevents interception. Together they directly mitigate the described threat, whereas encoding, long-lived cookies, and client binding do not address the core weaknesses.

Answer

Encode session identifiers using Base64 to obscure their contents from casual observation.

Answer

Bind session identifiers to the client's IP address and user agent string for validation.

Answer

Store session identifiers in persistent cookies with long expiration times to reduce reauthentication.

Question 9

A security analyst is reviewing a mobile application that stores authentication tokens in a location accessible to other applications on the same device. The development team wants to remediate this finding for both Android and iOS. Which change BEST addresses the vulnerability?

Accepted Answer

Store tokens in the platform-provided secure storage such as the Android Keystore and iOS Keychain.. The vulnerability is that tokens are readable by other applications. The platform secure storage mechanisms on Android and iOS are purpose-built to isolate secrets, and on capable hardware they can bind keys to the device's secure element. Hardcoded keys, permission-based files, and memory-only approaches either fail under realistic attacks or do not leverage the strongest available protection.

Answer

Keep tokens in memory only and require reauthentication whenever the application restarts.

Answer

Store tokens in a shared preferences file with file permissions restricted to the application's user ID.

Answer

Encrypt the tokens with a hardcoded symmetric key embedded in the application binary.

Question 10

A company wants to protect its web servers from common web application attacks such as SQL injection and cross-site scripting. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests. Which technology should they implement?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is purpose-built to inspect HTTP/HTTPS traffic and block application-layer attacks such as SQL injection and cross-site scripting. It understands web protocols and can apply rules to detect and mitigate these threats. Other options like IPS, stateful firewalls, or UTM appliances may offer some protection but are not as specialized or effective for web application security.

Answer

Unified Threat Management (UTM) appliance

Answer

Stateful firewall

Answer

Intrusion Prevention System (IPS)

Question 11

A security engineer is configuring a TLS 1.3 server for an e-commerce site. The engineer wants to ensure that the cipher suite provides both confidentiality and integrity for application data. Which of the following cipher suites should the engineer select?

Accepted Answer

TLS_AES_128_GCM_SHA256. TLS_AES_128_GCM_SHA256 is the only valid TLS 1.3 cipher suite listed that uses an AEAD algorithm. GCM provides authenticated encryption, ensuring both confidentiality and integrity of application data. The other options are either legacy TLS 1.2 suites with CBC and separate MACs or an invalid TLS 1.3 suite name, so they do not meet the requirement.

Answer

TLS_RSA_WITH_3DES_EDE_CBC_SHA

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Answer

TLS_AES_256_CBC_SHA384

Question 12

A risk analyst is building a threat model for a new customer-facing web application. The analyst must identify threat sources and classify them appropriately. Which TWO of the following are examples of environmental or natural threat sources that should be documented in the risk assessment? (Choose two.)

Accepted Answer

A prolonged power outage affecting the cloud region where the application is deployed.. Natural and environmental threat sources originate in the physical world and affect assets regardless of human intent. Flooding and extended power loss both threaten the web application's availability and supporting infrastructure, so they must be documented in the risk assessment to justify continuity, redundancy, and recovery investments.

Answer

A disgruntled former employee who retains knowledge of internal application architecture.

Answer

An organized criminal group targeting the application for financial fraud.

Answer

An unstructured software error in a third-party payment library that causes data corruption.

Question 13

A security administrator needs to ensure that a terminated employee loses access to all systems immediately upon departure. Which action best accomplishes this?

Accepted Answer

Disable the user account in the central directory and revoke active sessions and tokens.. Immediate access removal requires disabling the identity in the central directory and revoking any active sessions or tokens. Directory disablement blocks new logins across connected systems, and session revocation closes the gap for already-authenticated connections. Password changes, payroll-only removal, or delayed deletion all leave exploitable access in place.

Answer

Remove the employee from the payroll system only.

Answer

Schedule the account for deletion at the next quarterly access review.

Answer

Change the employee's password and notify the manager of the new credential.

Question 14

A company is deploying a web application in a containerized environment. The security team wants to ensure that if an attacker compromises the application, they cannot escalate privileges to the host or other containers. Which of the following container security measures should be implemented?

Accepted Answer

Run containers as a non-root user and drop unnecessary Linux capabilities.. The most effective runtime control to prevent privilege escalation and container escape is to run containers with least privilege: as a non-root user and with unnecessary Linux capabilities dropped. This limits the impact of a compromise. Other measures like read-only filesystems or private registries add defense in depth but do not directly address privilege escalation.

Answer

Use a read-only root filesystem for the container.

Answer

Enable inter-container communication on the default bridge network.

Answer

Store container images in a private registry with vulnerability scanning.

Question 15

A security administrator needs to ensure that only authorized devices can connect to the corporate wireless network. Which of the following should be implemented to meet this requirement?

Accepted Answer

WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X authenticates each device or user individually, typically against a RADIUS server, before granting network access. This ensures that only authorized devices can connect. MAC filtering, PSK, and SSID hiding are either weak or do not provide per-device authorization.

Answer

MAC address filtering

Answer

SSID broadcasting disabled

Answer

Pre-shared key (PSK) authentication

Question 16

A security operations center is deploying a network-based intrusion detection system. The team wants to detect attacks that span multiple packets and sessions, such as a slow port scan followed by exploitation attempts. Which detection method should the team prioritize to correlate these related events?

Accepted Answer

Stateful protocol analysis that tracks session state and compares activity against expected protocol behavior over time.. Detecting attacks that unfold across many packets and sessions requires the IDS to retain and reason about session state. Stateful protocol analysis tracks conversations against expected protocol behavior, enabling recognition of slow scans, evasive fragmentation, and follow-on exploitation that isolated packet inspection would miss. This makes it the appropriate priority for the described scenario.

Answer

Signature matching against a database of known malicious byte patterns in individual packets.

Answer

Anomaly detection based solely on bandwidth utilization thresholds for each monitored network segment.

Answer

Statistical profiling of user login times to identify credential misuse across authentication servers.

Question 17

A company deploys a VPN gateway that uses Diffie-Hellman key exchange to establish session keys. A security auditor warns that the gateway is vulnerable to a man-in-the-middle attack during key agreement. Which of the following should the administrator implement to mitigate this risk?

Accepted Answer

Deploy certificates and use authenticated Diffie-Hellman. The vulnerability exists because unauthenticated Diffie-Hellman allows an attacker to impersonate each party. Using certificates to authenticate the exchange ensures that each side verifies the other's identity before deriving session keys. Larger groups, perfect forward secrecy, or static keys do not by themselves prevent impersonation, so authenticated Diffie-Hellman is the required mitigation.

Answer

Increase the Diffie-Hellman group to 8192-bit MODP

Answer

Configure the gateway to use static Diffie-Hellman keys

Answer

Enable perfect forward secrecy on the VPN gateway

Question 18

An incident response team is preparing to collect evidence from a compromised Linux web server. The team lead wants to ensure that the evidence will be admissible in a potential legal proceeding. Which TWO actions should the team take to maintain the integrity of the evidence? (Choose two.)

Accepted Answer

Document the chain of custody for each evidence item.. Maintaining evidence integrity requires documenting the chain of custody and using cryptographic hashes to verify that data has not changed. These practices ensure that evidence collected from the compromised Linux server can withstand legal scrutiny. Analyzing originals, storing evidence on the compromised system, or allowing unrestricted access all undermine integrity and admissibility.

Answer

Analyze the original evidence directly to avoid any copy-related discrepancies.

Answer

Allow all team members to access the evidence freely for efficiency.

Answer

Store evidence on the compromised server to maintain original context.

Question 19

A payroll administrator at a healthcare company resigns. On her last day, the security team must ensure she can no longer access the HR payroll application, but her mailbox must remain active for 30 days so her manager can review pending correspondence. Which access management action BEST meets these requirements?

Accepted Answer

Terminate the payroll application entitlement while retaining the account for mailbox access during the review period.. Deprovisioning should remove the entitlements tied to the former role while preserving what the business still needs. Revoking the payroll application access addresses the security risk, and keeping the account for a bounded mailbox review satisfies the operational requirement. Documenting the end date prevents the account from lingering past its purpose.

Answer

Change the user's password and share the new credential with her manager.

Answer

Delete the user account immediately after her last shift.

Answer

Disable the user account and leave it disabled indefinitely.

Question 20

A security administrator is configuring a new web server and wants to ensure that the server's operating system and applications are hardened according to organizational standards. Which of the following should the administrator apply to enforce the desired security settings?

Accepted Answer

Security baseline. A security baseline provides the specific, documented configuration settings that must be applied to a system to meet security standards. It is the authoritative source for hardening a new server. The other options are important security processes but do not directly enforce the desired technical settings on the server.

Answer

Change management process

Answer

Incident response plan

Answer

Vulnerability scan