SSCP Practice Test 6 — 10 Questions

Question 1

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

Accepted Answer

Recognizing phishing attempts. Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

Answer

Proper use of social media

Answer

Physical security procedures

Answer

Data backup procedures

Question 2

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise

Question 3

A financial services company has recently deployed a new customer-facing web application on port 443. The application is essential for client transactions. Within the first week, the security team's monitoring system detected thousands of failed login attempts originating from a wide range of IP addresses across multiple countries. The attempts are using common usernames and passwords, indicating a coordinated brute-force attack. The company's perimeter firewall is configured with a default allow rule for inbound TCP traffic on port 443 to the web server's public IP address. The company operates with a small IT team and has a limited security budget. The web application is custom-developed and cannot be modified quickly. The security analyst must recommend a solution to mitigate the attack while maintaining availability for legitimate users. Which of the following is the most effective first step?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with rate limiting and CAPTCHA challenges. Deploying a Web Application Firewall (WAF) with rate limiting and CAPTCHA is the most effective solution because it can identify and block malicious traffic patterns without requiring application changes. It operates at the application layer and can enforce policies such as rate limiting per IP, geolocation blocking, and CAPTCHA challenges, which directly mitigate brute-force attacks while minimizing impact on legitimate users. Other options are less effective: IP blacklisting is reactive and cannot handle distributed attacks; changing ports only provides obscurity; enabling SSH does not address the web application attack.

Answer

Implement IP blacklisting by manually adding offending IP addresses to the firewall's deny list

Answer

Change the web server port from 443 to a non-standard high port

Answer

Enable SSH access to the web server for administrative purposes

Question 4

Drag and drop the steps for configuring a Windows Firewall rule to allow inbound RDP traffic into the correct order.

Accepted Answer

Create inbound rule for port 3389 → Allow connection → Select profiles → Name it. Windows Firewall: create inbound rule for port 3389, allow connection, select profiles, name it.

Answer

Create inbound rule for port 3389 → Select profiles → Allow connection → Name it

Answer

Allow connection → Create inbound rule for port 3389 → Select profiles → Name it

Answer

Name it → Create inbound rule for port 3389 → Allow connection → Select profiles

Question 5

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 6

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Accepted Answer

Perform memory forensics before disconnecting. Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Answer

Block the C2 IP at the perimeter

Answer

Shut down the host

Answer

Disconnect the host from the network immediately

Question 7

During a quantitative risk analysis, the asset value is $500,000, the exposure factor is 40%, and the annual rate of occurrence is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). SLE is asset value ($500,000) times exposure factor (40%) = $200,000. ALE = $200,000 × 0.5 = $100,000. This is the standard quantitative risk analysis formula per NIST SP 800-30.

Answer

$200,000

Answer

$500,000

Answer

$250,000

Question 8

A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?

Accepted Answer

Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.. Replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.

Answer

Continue using RC4 and accept the risk, since the network is isolated.

Answer

Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.

Answer

Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.

Question 9

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 10

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect