SSCP Practice Exam 60 — 20 Questions

Question 1

A security team is designing an access control system for a research facility. They need a model that supports fine-grained, dynamic access decisions based on user department, project assignment, time of day, and the sensitivity of the resource. The model must also allow policies to be expressed in a human-readable language and evaluated at runtime. Which access control model best fits these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control (ABAC) is designed to evaluate multiple attributes—user, resource, and environmental—at runtime, enabling dynamic and fine-grained decisions. It supports policy languages such as XACML, which are human-readable. RBAC, MAC, and DAC do not offer this combination of dynamic attribute evaluation and expressive policy language, so ABAC is the correct choice.

Answer

Role-based access control (RBAC)

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Question 2

A forensic examiner is preparing to acquire a disk image from a compromised server. The server is still running and contains critical evidence in volatile memory. According to NIST SP 800-86, which of the following should the examiner do FIRST?

Accepted Answer

Capture the contents of RAM using a memory acquisition tool.. The order of volatility in digital forensics dictates that the most perishable evidence, such as RAM and running processes, must be collected first. NIST SP 800-86 emphasizes capturing volatile memory before disk imaging or shutting down the system. This ensures that critical evidence like encryption keys, network connections, and malware artifacts are preserved for analysis.

Answer

Document the system's physical configuration and cable connections.

Answer

Create a bit-for-bit image of the hard drive.

Answer

Shut down the server to preserve the disk state.

Question 3

A forensic examiner is preparing to acquire a forensic image of a running Linux server that is suspected of being compromised. The server has active network connections and encrypted volumes. Which of the following should the examiner do FIRST according to the order of volatility?

Accepted Answer

Capture the contents of physical memory (RAM) using a tool such as LiME or AVML.. The order of volatility dictates that the most volatile data should be collected first. RAM is more volatile than disk storage and contains critical evidence such as running processes, network connections, and encryption keys. Capturing RAM first with tools like LiME or AVML ensures that this ephemeral data is preserved before it is lost or altered. Disk imaging, network connection recording, and swap capture are important but should follow memory acquisition to maintain the integrity of the most volatile evidence.

Answer

Record the current network connections using netstat or ss.

Answer

Capture the swap partition to preserve encrypted volume keys.

Answer

Create a bit-for-bit image of the hard drive using dd or a similar tool.

Question 4

A security operations team suspects that an attacker has compromised a Linux web server and is maintaining persistence. The team wants to identify unauthorized scheduled tasks that survive reboots. Which set of locations should the team review FIRST?

Accepted Answer

The systemd timer units, cron tables in /etc/cron* and /var/spool/cron, and the /etc/rc.local startup script.. Reboot-surviving persistence on Linux resides in scheduled execution mechanisms such as systemd timers, cron directories, and legacy startup scripts. These are the components that automatically run code after a restart. Name resolution files, shell history, and authentication logs are valuable for context and detection but do not themselves relaunch an implant.

Answer

The /etc/hosts file and the resolver configuration in /etc/resolv.conf.

Answer

The bash history files in each user's home directory.

Answer

The /var/log/auth.log and /var/log/secure authentication logs.

Question 5

A security administrator is reviewing the organization's awareness program after a recent phishing campaign. Several employees clicked the link, and one entered credentials on the fake page. The administrator wants to reduce the likelihood of credential theft in future campaigns. Which control should the administrator implement to best address this risk?

Accepted Answer

Require multi-factor authentication for all user accounts and privileged access.. Multi-factor authentication is the strongest control against credential theft because it requires a second factor that a phishing page cannot capture with the password alone. Email filtering, awareness simulations, and link-clicking policies are valuable layers, but none of them prevents an attacker from using stolen credentials to authenticate. MFA directly interrupts the attack path after credentials are compromised.

Answer

Increase the frequency of phishing simulation campaigns to once per month.

Answer

Implement a policy that prohibits employees from clicking links in external email messages.

Answer

Deploy a secure email gateway that quarantines messages containing known malicious URLs.

Question 6

A security team is conducting a lessons learned meeting after a major security incident. Which TWO of the following are PRIMARY objectives of this meeting? (Choose two.)

Accepted Answer

Identify the root cause of the incident to prevent recurrence.. The primary objectives of a lessons learned meeting are to identify the root cause of the incident and to evaluate the effectiveness of the incident response process. These objectives help the organization prevent future incidents and improve its response capabilities. Blame assignment, financial cost determination, and specific plan updates are not primary goals of this meeting.

Answer

Determine the financial cost of the incident for insurance claims.

Answer

Assign blame to the individuals responsible for the incident.

Answer

Update the disaster recovery plan with new backup procedures.

Question 7

A security administrator is configuring a VPN gateway that must support perfect forward secrecy for IPsec connections. Which key establishment method should be enabled to ensure that compromise of a long-term key does not expose previously established session keys?

Accepted Answer

Internet Key Exchange with ephemeral Diffie-Hellman (DHE). Perfect forward secrecy requires that session keys cannot be recovered from a long-term secret. Ephemeral Diffie-Hellman achieves this by generating temporary key pairs for each session and deleting them after use. Static PSK and static RSA key transport reuse long-term secrets, so compromise of those secrets can expose past sessions. HMAC provides integrity, not key establishment, and is therefore not the correct control.

Answer

RSA key transport with the gateway's static RSA key pair

Answer

Pre-shared key authentication with a static PSK

Answer

HMAC-SHA-256 for integrity protection of IKE messages

Question 8

A security administrator must verify that a third-party service provider meets the organization's security requirements before signing a contract. The provider will process regulated customer data. Which action provides the most reliable assurance?

Accepted Answer

Obtain and review an independent third-party audit report covering the provider's relevant controls.. Independent third-party audit reports give the most reliable assurance because an external auditor examines the provider's controls against recognized criteria and reports scope, period, and exceptions. Self-signed questionnaires, marketing claims, and verbal confirmations are unverified and unsuitable as primary evidence when regulated customer data is involved.

Answer

Ask the provider to confirm verbally during a call that it follows industry best practices.

Answer

Rely on the provider's marketing materials describing its security program.

Answer

Accept the provider's completed security questionnaire signed by its sales director.

Question 9

After a security incident at a retail company, the incident response team conducts a post-incident review. The team identifies that the attacker gained initial access through an unpatched web server. Which of the following is the PRIMARY purpose of the lessons learned meeting in this scenario?

Accepted Answer

To identify improvements to prevent similar incidents and enhance response capabilities.. The lessons learned meeting is a post-incident activity focused on improving future prevention, detection, and response. It should produce actionable recommendations, such as strengthening patch management, rather than assigning blame or calculating costs. In this scenario, the unpatched web server points to a process gap that the meeting should address to reduce recurrence risk.

Answer

To determine the exact financial cost of the incident for insurance claims.

Answer

To assign blame to the team responsible for the unpatched server.

Answer

To immediately reimage all servers in the environment.

Question 10

A security administrator is configuring log collection for a new web application tier. The organization must retain logs for one year and needs to ensure that log data cannot be altered after collection. Which control best meets the integrity requirement?

Accepted Answer

Forward logs to a centralized server configured with write-once storage and cryptographic hashing of log records. Protecting log integrity requires moving records out of the control of the systems being monitored and storing them where they cannot be modified. Write-once storage plus cryptographic hashing delivers both immutability and verifiability, satisfying the one-year retention and tamper-evidence requirements. Local storage and email archives leave logs exposed to the same threats as the applications themselves.

Answer

Store logs on the same web servers that generate them, protected by the application's own file permissions

Answer

Compress logs into archives on each server and email weekly copies to the security team

Answer

Enable verbose logging on all servers and rely on the operating system's default log rotation

Question 11

A security analyst notices that an attacker on the same VLAN is able to capture traffic from other hosts, including sensitive data. The attacker has not compromised any switch or router. Which network attack is most likely being used?

Accepted Answer

ARP spoofing. ARP spoofing, also called ARP poisoning, allows an attacker on the same subnet to intercept traffic by sending forged ARP messages. The attacker can then forward traffic to the real destination while capturing it, achieving a man-in-the-middle attack without compromising network devices.

Answer

MAC flooding

Answer

VLAN hopping

Answer

DHCP starvation

Question 12

An analyst is reviewing alerts from a network-based intrusion detection system (NIDS) deployed on a span port at the internet edge. Several alerts reference exploit attempts against services that are not exposed to the internet. Which TWO actions should the analyst take to improve the fidelity of the monitoring data? (Choose two.)

Accepted Answer

Verify the span port configuration and confirm which VLANs and interfaces are actually mirrored. Alerts against services that are not actually reachable indicate a mismatch between what the sensor is configured to detect or see and the environment it protects. Restricting signatures to the real exposed services removes irrelevant detections, and validating the span port mirroring confirms the sensor is observing the intended segment, so alerts can be trusted to reflect genuine attack surface.

Answer

Increase the alert severity of all exploit signatures to critical to ensure they are reviewed

Answer

Enable blocking mode so the NIDS drops packets matching the noisy signatures

Answer

Disable all exploit-class signatures and rely solely on anomaly-based detection

Question 13

An organization is conducting a disaster recovery test for its critical database. The RTO is 4 hours, and the RPO is 15 minutes. During the test, the team restores the database from a backup taken 2 hours before the test. The restore completes in 3 hours. Which statement accurately reflects the test outcome?

Accepted Answer

The test failed because the RPO was exceeded.. The RPO defines the maximum tolerable data loss, measured in time. A 2-hour-old backup means up to 2 hours of data could be lost, which exceeds the 15-minute RPO. The RTO, which is the maximum tolerable downtime, was met because the restore took 3 hours out of 4 allowed. However, since the RPO was violated, the test failed overall. The correct statement identifies the RPO exceedance as the failure reason.

Answer

The test failed because the restore took longer than 15 minutes.

Answer

The test passed because the backup was available and restorable.

Answer

The test passed because the RTO was met.

Question 14

A security administrator is configuring a mobile device management (MDM) policy for company-owned smartphones. The organization wants to ensure that if a device is lost or stolen, corporate data can be removed without affecting the user's personal data. Which of the following MDM capabilities should be enabled?

Accepted Answer

Selective wipe of corporate data. Selective wipe is designed to remove only corporate data and settings from a mobile device, preserving personal data. This is essential for scenarios where devices are used for both work and personal purposes. It ensures that sensitive company information is not exposed if the device is lost or stolen, while not intruding on the user's personal data.

Answer

Enforcing a strong screen lock PIN

Answer

Containerization of corporate applications

Answer

Remote wipe of the entire device

Question 15

A security analyst is documenting an incident that involved unauthorized access to a file server. The analyst needs to record the timeline of events, actions taken, and evidence collected. Which of the following is the PRIMARY purpose of maintaining proper documentation during incident response?

Accepted Answer

To provide a detailed record that supports legal proceedings, regulatory compliance, and post-incident review.. Incident response documentation is essential for creating a reliable record that can be used in legal proceedings, to demonstrate regulatory compliance, and to conduct meaningful post-incident reviews. It captures the timeline, actions taken, and evidence collected, ensuring accountability and enabling lessons learned. Without it, organizations risk losing critical information needed for prosecution, compliance audits, and improving future response efforts. Other purposes like billing, blanket law enforcement reporting, or PR are secondary and not the primary drivers.

Answer

To satisfy the requirement that all incidents must be reported to law enforcement within 24 hours.

Answer

To allow the public relations team to craft a press release about the incident.

Answer

To ensure that the incident response team can bill the organization for overtime hours.

Question 16

A hospital uses a MAC-based system where data labels carry classifications such as Restricted and Public, and user clearances are assigned by the security office. A nurse with a Secret-equivalent clearance attempts to read a patient record labeled with a higher classification. According to the Bell-LaPadula model, what should occur?

Accepted Answer

The read is denied because no-read-up prevents reading higher-classified data. Bell-LaPadula enforces confidentiality through the simple security property, which forbids a subject from reading an object at a higher classification than the subject's clearance. Since the nurse's clearance is below the record's label, the read is denied. Business need, logging, and encryption do not alter the mandatory clearance comparison that drives the access decision.

Answer

The read is permitted because the nurse is accessing the record over an encrypted channel

Answer

The read is allowed but only if the nurse first writes a justification to the audit log

Answer

The read is allowed because the nurse has a legitimate business need

Question 17

A security analyst is reviewing the organization's SIEM and notices that the daily log volume dropped by 60 percent overnight, but no maintenance window was scheduled. The analyst must determine whether this is a genuine reduction in activity or a monitoring failure. Which action should the analyst take FIRST to validate the health of the monitoring capability?

Accepted Answer

Perform a log-source inventory reconciliation against the SIEM's expected asset list and verify each critical source is actively sending events.. A sharp, unexplained decrease in collected logs points to a monitoring failure rather than a quiet network. The fastest way to confirm this is to compare the SIEM's expected log sources with those actually reporting. Identifying silent sources restores visibility and prevents the organization from operating blind while believing it is fully monitored.

Answer

Increase the severity threshold for correlation rules so that only high-priority alerts are generated while the volume anomaly is investigated.

Answer

Run a full vulnerability scan against the entire environment to confirm whether any systems have stopped responding.

Answer

Review the SIEM's storage utilization and archive older logs to free capacity for incoming events.

Question 18

A healthcare organization stores protected health information on a database server. Auditors require that the data remain unreadable if the physical disk is stolen, and that encryption keys never reside on the same disk as the ciphertext. Which approach BEST satisfies these requirements?

Accepted Answer

Enable full disk encryption using a key stored in a hardware security module or external key manager.. The auditors require protection of data at rest plus separation of keys from ciphertext. Full disk encryption with keys held in an HSM or external key manager meets both conditions by ensuring a stolen disk yields only ciphertext and the key remains in a controlled, separate system. The other approaches either leave key material on the same disk or fail to provide equivalent protection.

Answer

Use file-level encryption on individual tablespaces with passwords stored in a local script.

Answer

Apply column-level encryption using a symmetric key embedded in the application configuration file.

Answer

Implement database transparent data encryption with keys managed by the database instance on the same volume.

Question 19

A security administrator at a financial services firm is reviewing the organization's data retention practices. The legal team has mandated that certain transaction records be kept for exactly seven years and then destroyed. The administrator must ensure records are deleted automatically after seven years. Which of the following should be implemented to enforce this requirement?

Accepted Answer

A retention policy with automated deletion after the seven-year period. A retention policy is the formal control that specifies how long records must be kept and triggers their destruction when the period ends. It aligns legal requirements with operational procedures and can be automated. Classification, backups, and DLP address different concerns and do not enforce time-based deletion.

Answer

A data loss prevention (DLP) solution that blocks exfiltration of transaction records

Answer

A backup schedule that archives transaction records every quarter to tape

Answer

A data classification scheme that labels transaction records as confidential

Question 20

A security manager is assessing the risk of insider threat for a healthcare organization. Which of the following is the most appropriate way to categorize a malicious insider who intentionally exfiltrates patient data?

Accepted Answer

Human threat. Threat sources are commonly categorized as natural, human, and environmental. A malicious insider who intentionally exfiltrates data is a human threat because the act is deliberate and performed by a person. This classification directs risk managers to apply controls such as background checks, least privilege, separation of duties, and continuous monitoring, which are effective against human threats.

Answer

Natural threat

Answer

Technical threat

Answer

Environmental threat