SSCP Practice Exam 60 — 20 Questions

Question 1

During a change management process, the Change Advisory Board (CAB) approves a high-risk change. What is the NEXT step according to standard change management?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment to validate its functionality and identify potential issues before production deployment. This aligns with standard change management processes (e.g., ITIL) where testing follows approval to ensure the change does not disrupt operations. Immediate implementation without testing would bypass risk mitigation, making D the correct answer.

Answer

Implement the change immediately

Answer

Document the rollback plan

Answer

Perform a post-implementation review

Question 2

In a federated identity environment using SAML, what is the role of the Identity Provider (IdP) when a user requests access to a service provider (SP)?

Accepted Answer

The IdP authenticates the user and issues a SAML assertion to the SP. The IdP authenticates the user and issues a SAML assertion containing identity attributes and authorization claims. The SP trusts this assertion to grant access without re-authenticating the user.

Answer

The IdP hosts the application and enforces access control policies

Answer

The IdP validates the user's OTP token

Answer

The IdP generates a Kerberos ticket for the user

Question 3

An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?

Accepted Answer

To authorize the client to access the resource server on behalf of the user. The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.

Answer

To encrypt the user's data in transit

Answer

To store the user's credentials in the client application

Answer

To authenticate the user to the authorization server

Question 4

A security administrator is reviewing Linux audit logs to detect unauthorized file access. Which Linux component is primarily responsible for generating these security audit logs?

Accepted Answer

auditd. auditd is the userspace component of the Linux Audit system that writes audit records to disk.

Answer

systemd-journald

Answer

SELinux

Answer

PAM

Question 5

A security team is conducting a qualitative risk assessment for a new cloud application. They want to prioritize risks based on likelihood and impact. Which method should they use to combine these factors?

Accepted Answer

Risk matrix (heat map). A risk matrix (heat map) is the correct method because it combines qualitative assessments of likelihood and impact into a single visual grid, allowing the team to prioritize risks by their position in the matrix. This approach is standard for qualitative risk assessments where numerical data is unavailable, as it maps ordinal ratings (e.g., low, medium, high) to a color-coded priority level.

Answer

SWOT analysis

Answer

Annualized loss expectancy (ALE)

Answer

Business Impact Analysis (BIA)

Question 6

An organization is designing an access control policy for a new system. Which THREE of the following are fundamental principles that should be incorporated? (Choose THREE.)

Accepted Answer

Least privilege. Least privilege, separation of duties, and need-to-know are core access control principles. Defense in depth is a security strategy, not a principle of access control itself.

Answer

Fail-open

Answer

Defense in depth

Question 7

An employee reports that they cannot access a shared folder on the network. The security administrator checks the permission and finds that the user is in the correct group, but the 'Deny' entry for a different group is blocking access. What is the MOST likely cause?

Accepted Answer

A Deny ACE is explicitly applied to the user's group.. In Windows NTFS permissions, a Deny Access Control Entry (ACE) explicitly overrides any Allow ACE, regardless of group membership order. Since the user is in the correct group but a Deny entry on a different group blocks access, the most likely cause is that a Deny ACE is explicitly applied to the user's group (or a group the user belongs to), which takes precedence over Allow permissions. This is a core principle of the Windows discretionary access control model.

Answer

The folder is encrypted with EFS.

Answer

The folder has inherited permissions from the parent.

Answer

The user is not a member of the correct group.

Question 8

During a change management process, the Change Advisory Board (CAB) approves a high-risk change. What is the NEXT step according to standard change management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 9

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

Accepted Answer

Implement a break-glass procedure for emergency access.. A break-glass procedure provides a predefined, auditable method for granting emergency privileged access without requiring real-time manager approval. This balances security with operational continuity, allowing analysts to perform critical changes outside business hours while maintaining accountability through post-event review and logging.

Answer

Extend manager on-call hours to cover all times.

Answer

Remove the approval requirement for privileged access.

Answer

Require analysts to call a manager for approval each time.

Question 10

During a security audit, it is discovered that network devices are using Telnet for management. Which of the following is the most secure replacement to ensure encrypted remote access?

Accepted Answer

SSH with public key authentication. SSH (Secure Shell) provides encrypted remote access and authentication, replacing the insecure Telnet protocol. Public key authentication adds a second factor (the private key) and is resistant to brute-force password attacks, making it the most secure option for managing network devices.

Answer

SNMPv3 with authentication and encryption

Answer

HTTPS with self-signed certificate

Answer

SSH with password authentication

Question 11

A company detects ransomware on a file server. The ransomware is currently encrypting files. Which containment strategy should be implemented FIRST?

Accepted Answer

Disconnect the server from the network. The immediate priority in ransomware containment is to isolate the compromised server from the network to prevent the encryption process from spreading to other systems. Disconnecting the network cable or disabling the network interface stops the ransomware from communicating with command-and-control servers and blocks lateral movement via SMB or other protocols. This containment step must occur before any remediation like antivirus scans or file restoration.

Answer

Run antivirus to remove the ransomware

Answer

Notify all users to change passwords

Answer

Restore files from backup

Question 12

A small company uses a single firewall at the network perimeter. The security team receives alerts from an IDS but cannot correlate them with firewall logs because logs are stored on separate servers with different timestamps. The CEO wants to reduce false positives and improve incident response. What should the security team do first?

Accepted Answer

Implement a SIEM to aggregate and correlate logs from multiple sources.. A SIEM (Security Information and Event Management) system aggregates logs from multiple sources, normalizes timestamps, and correlates events to reduce false positives and improve incident response. This directly addresses the core problem of disparate log sources with unsynchronized timestamps, enabling effective correlation between IDS alerts and firewall logs without replacing existing infrastructure.

Answer

Increase the IDS sensitivity to catch more threats.

Answer

Replace the IDS with a next-generation firewall.

Answer

Manually align timestamps on each server daily.

Question 13

Refer to the exhibit. What does this event indicate?

Accepted Answer

A failed logon attempt for the Administrator account from the network.. The event shows a logon failure with a status code indicating the account is disabled or locked, but the exhibit specifically references a network logon (logon type 3) for the Administrator account. Option D is correct because the failure is from the network, not interactive or locked out, and the event ID 4625 with logon type 3 indicates a failed network logon attempt.

Answer

A successful logon for the Administrator account.

Answer

An interactive logon failure for the Administrator account.

Answer

The Administrator account is locked out.

Question 14

A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.

Answer

Perform post-implementation review

Answer

Develop a rollback plan

Answer

Implement the change in production

Question 15

A security analyst discovers that an internal host is sending traffic to an external IP address known to be a command-and-control server. The analyst wants to block only that specific traffic without affecting other traffic. Which firewall rule should be implemented?

Accepted Answer

Deny traffic from the internal host to the external IP.. It creates a specific deny rule that matches only the source IP of the internal host and the destination IP of the command-and-control server, blocking that exact traffic flow while allowing all other traffic to and from both hosts. This is the most precise and least disruptive approach, adhering to the principle of least privilege in firewall rule design.

Answer

Deny all traffic from the internal host.

Answer

Deny all traffic to the external IP.

Answer

Deny traffic on the specific port used.

Question 16

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

Accepted Answer

Split tunnel VPN. A split tunnel VPN configuration allows remote users to access the corporate network securely over an encrypted tunnel while simultaneously sending internet-bound traffic directly to the internet without passing through the corporate VPN gateway. This meets the security policy requirement because only traffic destined for the corporate network is encrypted, reducing latency and bandwidth load on the VPN concentrator.

Answer

Remote Desktop Gateway

Answer

Host-to-host VPN

Answer

Full tunnel VPN

Question 17

An organization is implementing a secure software development lifecycle (SDLC). Which activity should be performed during the design phase to minimize security flaws?

Accepted Answer

Perform threat modeling to identify potential attack vectors.. Threat modeling is a proactive security activity performed during the design phase to identify potential attack vectors, trust boundaries, and threats before any code is written. By analyzing the system architecture and data flows, teams can mitigate security flaws early, reducing the cost and effort of fixing vulnerabilities later in the SDLC.

Answer

Run dynamic application security testing (DAST) tools.

Answer

Apply security patches to the development environment.

Answer

Conduct a code review for security vulnerabilities.

Question 18

Which of the following is the primary purpose of a security awareness program?

Accepted Answer

To teach employees about security best practices and reduce human error.. The primary purpose of a security awareness program is to educate employees on security best practices and reduce human error, which is the leading cause of security incidents. Unlike technical controls, awareness programs target the human element by teaching users to recognize phishing attempts, handle sensitive data properly, and follow secure behaviors. This aligns with the NIST SP 800-50 framework, which defines awareness as a foundational component of an organizational security posture.

Answer

To evaluate the effectiveness of security technologies.

Answer

To enforce security policies through penalties.

Answer

To train employees on advanced technical security skills.

Question 19

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed

Question 20

A security analyst reviews a firewall log showing an internal IP attempting outbound connections to multiple external IPs on port 443. The analyst suspects command and control. Which additional data source would be MOST useful for confirmation?

Accepted Answer

DNS logs. DNS logs are the most useful additional data source because C2 traffic often uses domain generation algorithms (DGAs) or connects to known malicious domains. By correlating the outbound connections on port 443 with DNS queries, the analyst can identify suspicious domain lookups that precede the connections, revealing the C2 infrastructure. Unlike NetFlow or system logs, DNS logs directly show the domain names being resolved, which is a key indicator of C2 activity.

Answer

NetFlow data

Answer

System event logs

Answer

Antivirus logs