SSCP Practice Exam 59 — 20 Questions

Question 1

A security engineer is designing a system to store passwords securely. Which of the following is the most robust approach for password storage?

Accepted Answer

Use bcrypt with a high cost factor. Bcrypt is the most robust option because it incorporates a salt to defend against rainbow table attacks and uses a configurable cost factor to deliberately slow down the hashing process, making brute-force attacks computationally expensive. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password storage and resists GPU-accelerated attacks by requiring significant memory and time per attempt.

Answer

Hash passwords with SHA-256

Answer

Encode passwords with Base64

Answer

Encrypt passwords using AES-256 and store the key separately

Question 2

A security engineer is configuring a firewall to block all inbound traffic except for specific services. Which of the following design principles is being applied?

Accepted Answer

Least privilege. Least Privilege, because the security engineer is configuring the firewall to block all inbound traffic except for specific services. This aligns with the principle of least privilege, which dictates that only the minimum necessary access should be granted—in this case, only allowing specific services through while denying everything else by default. The firewall rule set explicitly permits only required ports (e.g., TCP/443 for HTTPS) and implicitly denies all other traffic, ensuring that no unnecessary access is permitted.

Answer

Separation of duties

Answer

Default deny

Answer

Defense in depth

Question 3

A security analyst notices that a web application is vulnerable to SQL injection. The application uses parameterized queries for most inputs but concatenates user input directly into a query for a legacy module. Which is the BEST immediate remediation?

Accepted Answer

Rewrite the legacy module to use parameterized queries.. Parameterized queries (prepared statements) are the definitive defense against SQL injection, as they separate SQL logic from user data by design. Rewriting the legacy module to use parameterized queries eliminates the root cause of the vulnerability at the code level, ensuring that user input is never concatenated into the SQL statement. This is the most secure and permanent fix, as it directly addresses the injection point in the application layer.

Answer

Disable the legacy module until a full rewrite is completed.

Answer

Deploy a web application firewall (WAF) to block SQL injection patterns.

Answer

Implement input validation to reject special characters.

Question 4

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

Accepted Answer

To reduce the risk of data breaches. A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

Answer

To lower office cleaning costs

Answer

To comply with fire safety regulations

Answer

To improve employee productivity

Question 5

A security analyst reviews the exhibit. The internal IP 10.0.0.1 is a web server, and 203.0.113.5 is an external IP. What is the most likely issue?

Accepted Answer

The web server may be exfiltrating data to an external host. The exhibit shows a high volume of outbound traffic from internal IP 10.0.0.1 (the web server) to external IP 203.0.113.5 on port 443 (HTTPS). This pattern is consistent with data exfiltration, where a compromised web server sends sensitive data to an external command-and-control (C2) server. The traffic is initiated by the internal server, not inbound, which rules out scanning or DDoS attacks.

Answer

The external IP is scanning the web server for vulnerabilities

Answer

The web server is experiencing a DDoS attack from the external IP

Answer

An internal user is browsing a malicious website

Question 6

A Linux server administrator configures SSH key-based authentication for user 'admin'. The authentication fails with the error 'Authentication refused: bad permissions' in the logs. What is the most likely cause?

Accepted Answer

The private key file has permissions set to 644 (world-readable). SSH key-based authentication requires the private key file to have restrictive permissions (typically 600 or 640) to prevent unauthorized access. When the private key is world-readable (e.g., 644), the SSH daemon refuses to use it for security reasons, logging 'Authentication refused: bad permissions'. This is a direct check performed by OpenSSH to protect against key disclosure.

Answer

The SSH service is not running

Answer

The public key is not in the ~/.ssh/authorized_keys file

Answer

The passphrase on the private key is incorrect

Question 7

Which TWO of the following are essential components of a secure configuration baseline for a new server deployment?

Accepted Answer

Disable all unnecessary services and ports. Options A and B are correct. Disabling unnecessary services and ports reduces the attack surface, and applying the latest security patches closes known vulnerabilities. Option C is incorrect because audit logging is essential for monitoring and forensic analysis; enabling only error logging is insufficient. Option D is incorrect because using the same password for all local accounts violates the principle of least privilege and increases the impact of a credential compromise. Option E is incorrect because default passwords are well-known and insecure; they must be changed before deployment.

Answer

Enable only error logging, not audit logging

Answer

Assign the same strong password to all local accounts

Answer

Use default passwords for all service accounts

Question 8

An organization's risk register shows a high risk for phishing attacks. Which controls are considered detective controls for this risk?

Accepted Answer

User reporting mechanism.. A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.

Answer

Security awareness training.

Answer

Email filtering.

Answer

Multi-factor authentication.

Question 9

A company's VPN logs show that a user's account authenticated from two different geographic locations within a span of 10 minutes. The distances between locations make physical travel impossible. The security team investigates and finds that the user's password is complex and not shared. What is the MOST likely explanation?

Accepted Answer

The user's session token was stolen and used by an attacker.. The session token could have been stolen and reused from a different location, allowing an attacker to authenticate without the password. Option A is incorrect; a configuration error would affect multiple users. Option C is incorrect; multiple people using the account would imply password sharing, which is denied. Option D is incorrect; using a VPN service would show the same VPN IP, not two different geographic locations.

Answer

The VPN server has a configuration error causing incorrect location logging.

Answer

The user's account is being used by multiple people with permission.

Answer

The user is using a VPN service to mask their true location.

Question 10

A security analyst notices that a user's account was used to access sensitive files after the user had left the company. Which access control principle was most likely violated?

Accepted Answer

Accountability. Accountability requires that actions be traced to individuals. If an account is not disabled promptly, actions cannot be reliably attributed.

Answer

Identification

Answer

Least privilege

Answer

Separation of duties

Question 11

A SIEM correlation rule triggers when an administrative account logs in after hours and subsequently performs a bulk export of a customer database. Which THREE threat types does this scenario most likely indicate?

Accepted Answer

Privilege escalation. The scenario describes an administrative account performing actions (after-hours login and bulk database export) that exceed its normal privileges or intended use, which is the essence of privilege escalation. The SIEM rule detects this by correlating the account's elevated access with anomalous behavior, indicating the account may have been compromised or misused to gain unauthorized capabilities.

Answer

Malware infection

Answer

Denial of service

Question 12

A system administrator is configuring a file encryption solution for a shared network drive. The solution must allow multiple users to read the files without sharing a single symmetric key. Which approach should be used?

Accepted Answer

Encrypt the file with a symmetric key, then encrypt that key with each authorized user's public key. Describes hybrid encryption, which is the correct approach for this scenario. The file is encrypted with a random symmetric key (session key) for efficiency, and that symmetric key is then encrypted with each authorized user's public key. This allows multiple users to decrypt the symmetric key with their private key and then decrypt the file, without sharing a single symmetric key.

Answer

Use a different symmetric key for each user and re-encrypt the file for each user

Answer

Encrypt the file with each user's public key directly

Answer

Encrypt the file with a single symmetric key and share that key securely with all users

Question 13

A company implements mandatory access control (MAC) on its classified document system. A user with a security clearance of Secret attempts to read a document labeled Top Secret. What happens?

Accepted Answer

The access is denied by the system. In a mandatory access control (MAC) system, access decisions are based on comparing the user's security clearance (Secret) with the document's classification label (Top Secret). Since the clearance level is lower than the document's classification, the system automatically denies the read operation. This is a fundamental property of MAC, where the system enforces the Bell-LaPadula model's simple security property (no read up).

Answer

The user is prompted to request a temporary upgrade

Answer

The document is downgraded to Secret for the user

Answer

The user can read the document because they have a valid clearance

Question 14

A company deploys a guest Wi-Fi network that must be isolated from the internal network. The network team uses VLANs and a firewall. Which configuration best ensures isolation?

Accepted Answer

Create a separate VLAN for guest traffic with a firewall rule blocking access to internal subnets.. Creating a separate VLAN for guest traffic logically segments the network at Layer 2, and adding a firewall rule that explicitly blocks access to internal subnets enforces isolation at Layer 3/4. This ensures guest devices cannot reach internal resources, even if they are on the same physical infrastructure.

Answer

Configure the same SSID for both guest and internal networks but use different passwords.

Answer

Use WPA2 encryption with a pre-shared key and disable SSID broadcast.

Answer

Assign guest devices to the same subnet as internal devices but enforce MAC filtering.

Question 15

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

Accepted Answer

The service is using cached credentials that are out of sync with the domain controller.. Service accounts used for automated backups typically run as services that cache their credentials locally. When the password is changed on the domain controller, the cached credentials in the service's logon session become out of sync. The service repeatedly attempts to authenticate with the stale cached password, causing rapid lockout events within a short window.

Answer

The service account's certificate has expired.

Answer

A brute force attack is targeting the service account.

Answer

The account password has expired and needs to be reset.

Question 16

Which backup type copies all data that has changed since the last full backup, regardless of any incremental backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate incremental backups. This means each differential backup grows in size as it accumulates all changes made after the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Synthetic full backup

Answer

Full backup

Answer

Incremental backup

Question 17

Refer to the exhibit. An analyst reviews the sshd log. What should be the immediate response?

Accepted Answer

Change the root password and disable root SSH login. The sshd log shows repeated failed root login attempts from IP 203.0.113.5, indicating a brute-force attack targeting the root account. The immediate response is to change the root password and disable root SSH login (e.g., set `PermitRootLogin no` in `/etc/ssh/sshd_config`), as this directly mitigates the attack vector by removing the ability to authenticate as root via SSH. This aligns with the principle of least privilege and is a standard first step in SSH security hardening.

Answer

Block the source IP 203.0.113.5 on the firewall

Answer

Disable SSH service on the server

Answer

Inform the server administrator of the suspicious activity

Question 18

A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?

Accepted Answer

Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.. Applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.

Answer

Add a firewall rule to block all traffic to and from the server's IP.

Answer

Move the server to a quarantine VLAN with no route to the internet.

Answer

Shut down the switch port to disconnect the server immediately.

Question 19

A system administrator needs to securely transfer log files from a Linux server to a central log collector. Which protocol should be used to ensure confidentiality and integrity?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted tunnels for data transfer, ensuring both confidentiality and integrity of log files in transit. It uses strong cryptographic algorithms (e.g., AES, ChaCha20) and HMAC-based integrity checks, making it the correct choice for secure file transfer over untrusted networks.

Answer

SMTP

Answer

NFS

Answer

FTP

Question 20

Refer to the exhibit. What is the effect of this access control list on traffic entering the interface?

Accepted Answer

Allows SSH to 10.0.0.1 and blocks all other traffic with logging. The ACL shown (likely an extended IP access list with a permit statement for TCP port 22 to host 10.0.0.1 followed by a deny ip any any log statement) permits SSH traffic to 10.0.0.1 and explicitly denies all other traffic while logging the denied packets. The implicit deny at the end of every ACL would block unmatched traffic, but the explicit deny with the 'log' keyword ensures that denied packets are logged, which matches the description in B.

Answer

Permits only TCP traffic to 10.0.0.1 on port 22

Answer

Blocks all traffic except SSH and logs the denied packets

Answer

Allows all TCP traffic to any host on port 22

Answer

Allows all traffic to 10.0.0.1