SSCP Practice Exam 61 — 20 Questions

Question 1

A company needs to provide secure remote access for employees working from home. The security team wants to ensure the solution provides strong authentication and encryption, and supports a wide range of client devices without requiring proprietary software. Which technology should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IPsec VPN with IKEv2. IKEv2 is a modern VPN protocol that offers strong security and is widely supported across devices without proprietary clients. It supports various authentication methods and is efficient in reconnecting after network changes, making it ideal for mobile workers. The other options are either not full VPN solutions or are limited in scope. Therefore, IKEv2 IPsec VPN is the correct choice.

Answer

Secure Shell (SSH) tunneling

Answer

Remote Desktop Protocol (RDP) with TLS

Answer

File Transfer Protocol Secure (FTPS)

Question 2

A security administrator is implementing a defense-in-depth strategy for a new data center. Which of the following BEST describes the role of security awareness training within this strategy?

Accepted Answer

It reduces the likelihood of successful social engineering attacks by educating users.. Security awareness training is an administrative control that educates users on recognizing and avoiding social engineering attacks, thereby reducing the likelihood of successful phishing or pretexting attempts. It complements technical controls like firewalls and antivirus, forming a layer of defense that addresses the human element.

Answer

It enforces mandatory vacation policies to detect fraud.

Answer

It encrypts sensitive data at rest and in transit.

Answer

It provides a technical control that blocks malware from executing on endpoints.

Question 3

A security administrator is reviewing the organization's backup strategy for a database server that must meet a recovery point objective (RPO) of 15 minutes. The server currently uses a full backup every Sunday and differential backups every night. The administrator finds that the current strategy cannot meet the RPO. Which backup method should the administrator implement to meet the RPO while minimizing backup storage consumption?

Accepted Answer

Transaction log backups every 15 minutes. Transaction log backups capture every committed transaction since the previous log backup, so a 15-minute schedule delivers an RPO of 15 minutes. They are also far more storage-efficient than full or differential backups because they contain only log records. This combination of frequent recovery points and low storage overhead makes them the correct choice for meeting the stated RPO.

Answer

Differential backups every 15 minutes

Answer

Full backups every 15 minutes

Answer

Snapshot backups every 15 minutes

Question 4

A security consultant is reviewing an organization's identity and access management (IAM) architecture. The organization wants to implement a system where users can authenticate once and access multiple independent systems without re-entering credentials, while also enabling centralized session termination. Which TWO of the following are appropriate components or protocols to meet these requirements? (Choose two.)

Accepted Answer

Security Assertion Markup Language (SAML). SAML and OpenID Connect are both federation protocols that enable single sign-on across independent systems. SAML uses XML assertions, while OIDC uses JSON Web Tokens and builds on OAuth 2.0. Both support centralized session management, allowing an identity provider to terminate sessions. OAuth 2.0 is for authorization, and RADIUS and LDAP are not designed for web-based SSO or centralized session termination.

Answer

OAuth 2.0

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Lightweight Directory Access Protocol (LDAP)

Question 5

A financial institution is deploying a hardware security module (HSM) to protect cryptographic keys used for payment transactions. The security team must ensure that the HSM provides strong logical and physical protection. Which two of the following characteristics are MOST important to validate when selecting the HSM? (Choose two.)

Accepted Answer

The HSM enforces role-based access control and requires multiple physical or logical credentials for administrative actions.. Validating a FIPS 140-2/140-3 certificate at an appropriate level confirms that the HSM meets stringent security requirements, including tamper resistance and key protection. Enforcing role-based access with multi-person control ensures that no single individual can compromise keys. Together, these characteristics provide the logical and physical safeguards needed for payment transaction keys, whereas capacity, automatic updates, and power backup do not directly address security.

Answer

The HSM includes a built-in UPS to maintain power during outages.

Answer

The HSM firmware can be updated automatically over the network without manual intervention.

Answer

The HSM supports the largest possible number of symmetric key slots to avoid future purchases.

Question 6

A security administrator is configuring a network tap to monitor traffic between two switches. The tap is placed inline and must not disrupt network connectivity if it loses power. Which type of tap should be used?

Accepted Answer

Fail-to-wire tap. A fail-to-wire tap ensures that if the tap loses power, the connection between the two network segments is physically closed, allowing traffic to continue flowing. This maintains network availability. Other options like aggregating taps, SPAN ports, or hubs do not provide this fail-safe inline capability. The requirement for non-disruption on power loss is specifically addressed by fail-to-wire functionality.

Answer

Span port

Answer

Aggregating tap

Answer

Network hub

Question 7

A hospital wants clinicians to reach patient records from any ward workstation without signing in repeatedly, but it also wants a single authoritative source of identity so that disabling an employee in the human resources system immediately removes clinical access. The identity team proposes using the Lightweight Directory Access Protocol (LDAP) as that authoritative store. Which statement best describes what LDAP provides in this design?

Accepted Answer

LDAP is a hierarchical directory that can serve as the authoritative identity store and support authentication binds, but it does not by itself provide single sign-on or session management. The design needs an authoritative account repository plus a separate mechanism for cross-workstation session continuity. LDAP supplies the hierarchical directory and the bind operation that validates credentials, and disabling an account in that directory can take effect immediately. Single sign-on and session handling must come from an additional service, so the option that separates those responsibilities is the accurate description.

Answer

LDAP provides the ticket-granting service that lets users obtain service tickets for clinical applications

Answer

LDAP issues signed assertions that workstations present to each other to establish single sign-on sessions

Answer

LDAP synchronizes credentials to each workstation so that local validation removes the need for a central authority

Question 8

A security administrator at a healthcare company must ensure that audit logs from a critical patient-record system are retained for seven years and cannot be altered even by system administrators. Which solution BEST meets these requirements?

Accepted Answer

Implement a write-once read-many (WORM) storage solution for log archival with a seven-year retention policy.. WORM storage ensures that once audit logs are written, they cannot be modified or deleted, even by users with administrative privileges, directly meeting the immutability and seven-year retention requirements. Other options focus on access control or encryption but do not provide the non-repudiation and tamper-evidence needed for compliance.

Answer

Use a SIEM with role-based access control (RBAC) to limit who can view or delete logs.

Answer

Enable local logging with daily log rotation and store the logs on a separate encrypted volume.

Answer

Configure the system to send logs to a remote syslog server with file permissions restricted to root.

Question 9

A retail chain issues each cashier a badge containing a photograph and a scannable code. At the start of every shift, a supervisor visually compares the badge photograph to the person and scans the code into the point-of-sale terminal. Which two access control components are being combined in this process?

Accepted Answer

Identification by the badge code and authentication by the supervisor's visual comparison. The badge code is an assertion of who the cashier claims to be, and the supervisor's check that the face matches the photograph validates that assertion. Identification precedes authentication, and both precede the authorization decision the terminal makes about which functions the cashier may use.

Answer

Authorization by the badge code and accounting by the supervisor's visual comparison

Answer

Identification by the supervisor's visual comparison and authentication by the badge code

Answer

Authentication by the badge code and authorization by the supervisor's visual comparison

Question 10

A healthcare organization has completed a risk assessment and documented a set of identified risks in its risk register. Management decides not to purchase cyber insurance and not to implement any additional safeguards for a specific risk involving legacy medical devices. Which risk response strategy has management chosen?

Accepted Answer

Risk acceptance. When management reviews a documented risk and consciously decides to add no controls and buy no insurance, the organization is accepting the risk. Acceptance is recorded in the risk register with a rationale and often a review date, so the decision is deliberate and auditable. Mitigation, transfer, and avoidance all require concrete actions that were explicitly declined for the legacy devices.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 11

A financial services firm is deploying a centralized access control server that will make authorization decisions for dozens of internal applications. The architects want the applications to query a single decision point instead of embedding their own permission logic. Which two characteristics should the chosen model exhibit? (Choose two.)

Accepted Answer

Authorization decisions are expressed as policy that can be updated centrally and take effect without redeploying applications. Centralized authorization requires a shared decision point that evaluates rich context and a policy store that can be changed without touching application code. Attribute-based access control delivers both by evaluating subject, object, and environmental attributes in a central engine, and by expressing rules as centrally managed policy rather than as logic embedded in each application.

Answer

Each application maintains its own copy of the permission tables so decisions can be made without network calls

Answer

Permissions are baked into each application's source code during development and released through the change management pipeline

Answer

The decision point grants access based solely on the user's job title stored in the human resources system

Question 12

A security administrator is configuring a web server to use TLS 1.3. The administrator wants to ensure that the server supports forward secrecy for all connections. Which of the following key exchange mechanisms should be used?

Accepted Answer

Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). TLS 1.3 requires forward secrecy, which is achieved by using ephemeral key exchanges such as DHE or ECDHE. These generate a unique session key that is not derivable from the server's long-term private key. RSA and static DH key exchanges lack forward secrecy and are not supported in TLS 1.3. PSK alone also does not provide forward secrecy.

Answer

Pre-shared key (PSK) exchange

Answer

Static Diffie-Hellman (DH)

Answer

RSA key exchange

Question 13

A DevOps team deploys containerized microservices and wants to reduce the impact of a compromised container. They need a control that limits which system calls each container process can make, without changing the application image. Which Linux kernel feature should they enable?

Accepted Answer

seccomp profiles applied to the container. seccomp attaches a filter to each process that permits or denies individual system calls, so even a fully compromised container is constrained at the kernel boundary. Because profiles are supplied by the container runtime at launch, the team avoids modifying the application image while gaining strong containment.

Answer

Read-only root file system for the container

Answer

Dropping all Linux capabilities from the container

Answer

Linux cgroups v2 memory limits

Question 14

A security administrator is configuring a network intrusion detection system (NIDS) to monitor traffic for signs of attacks. The administrator wants to ensure the NIDS can detect attacks that involve fragmented packets. Which of the following should be enabled on the NIDS to reassemble fragmented packets before analysis?

Accepted Answer

IP defragmentation. IP defragmentation is necessary for a NIDS to reassemble fragmented IP packets before inspecting them. Fragmentation is a common evasion technique where attackers split malicious payloads across multiple packets to avoid detection. By enabling IP defragmentation, the NIDS can reconstruct the original packet and analyze it for threats. Stream reassembly and other options do not address IP-layer fragmentation.

Answer

TCP segmentation offload

Answer

Application layer gateway

Answer

Stream reassembly

Question 15

A company is deploying a hardware security module (HSM) to protect the root keys of its certificate authority. Which two practices are essential for maintaining the security of the CA's private keys? (Choose two.)

Accepted Answer

Store the CA private keys in the HSM and configure it to prevent export of the keys in plaintext.. Protecting a CA's private keys requires keeping them inside a tamper-resistant HSM and preventing plaintext export, as well as enforcing multi-person control over signing operations. Exporting keys to a file, exposing administration to the internet, or merging root and issuing roles all increase the risk of key compromise. These practices reflect standard CA hardening guidance.

Answer

Enable remote administration of the HSM over the public internet for convenience.

Answer

Back up the CA private keys by exporting them to an encrypted file on a network share.

Answer

Use the same HSM partition for the root CA and for issuing subordinate certificates to simplify management.

Question 16

A security analyst investigates a suspicious process on a Linux web server that is making outbound connections to an unknown IP address. The analyst wants to confirm which executable file is running and whether it has been modified since installation. Which combination of actions best accomplishes this?

Accepted Answer

Inspect the process's /proc//exe link and compare the file hash against a known-good baseline. Resolving the /proc//exe link identifies the exact executable behind the process, and hashing that file against a trusted baseline detects tampering. Used together, these steps confirm both the binary's identity and its integrity, which is what the investigation requires.

Answer

Check the process owner with the ps command and confirm it is not root

Answer

Run netstat to list the established outbound connection

Answer

Review the process's open file descriptors in /proc/<pid>/fd

Question 17

A healthcare provider must protect the confidentiality of patient records stored on a shared network drive. The compliance officer mandates that the encryption solution use a symmetric algorithm with a 256-bit key and operate as a block cipher. Which of the following should the security administrator select to meet these requirements?

Accepted Answer

AES-256. AES-256 is the correct choice because it is a symmetric block cipher with a 256-bit key, exactly matching the compliance requirement. RSA is asymmetric and too slow for bulk data, 3DES lacks the required key size and is deprecated, and SHA-256 is a hash function that provides no confidentiality. Only AES-256 satisfies all stated conditions for protecting stored records.

Answer

RSA-2048

Answer

SHA-256

Answer

3DES

Question 18

A financial institution is implementing a digital signature solution to ensure the integrity and authenticity of wire transfer instructions. The solution must provide non-repudiation and use a NIST-approved algorithm. Which of the following should the security architect select?

Accepted Answer

ECDSA with SHA-256. ECDSA with SHA-256 is a NIST-approved digital signature algorithm that provides non-repudiation, integrity, and authenticity. It is based on elliptic curve cryptography, which is efficient and secure with smaller key sizes. The other options either lack non-repudiation (HMAC, AES-GCM) or use deprecated algorithms (RSA-1024 with SHA-1).

Answer

HMAC-SHA256

Answer

AES-256-GCM

Answer

RSA-1024 with SHA-1

Question 19

A security administrator is reviewing the organization's incident response plan. The plan must include procedures for handling security incidents. Which of the following are appropriate steps to include in the incident response process? (Choose two.)

Accepted Answer

Containment of the incident to prevent further damage.. The incident response process typically includes preparation, identification, containment, eradication, recovery, and lessons learned. Containment and eradication are two key steps. Deleting logs destroys evidence, public disclosure to all employees is not a standard step, and shutting down all network services is overly broad and disruptive. Thus, containment and eradication are the correct steps to include.

Answer

Immediate shutdown of all network services to isolate the incident.

Answer

Public disclosure of the incident details to all employees.

Answer

Immediate deletion of all logs to prevent attacker access.

Question 20

A security administrator is drafting a data handling standard for a retail company that processes payment cards. The standard must state how long transaction records may be retained and how they must be destroyed. Which source should PRIMARILY drive these retention and destruction requirements?

Accepted Answer

Legal, regulatory, and contractual requirements applicable to payment card data.. Data retention and destruction standards must be anchored in the obligations that apply to the data. For payment card information, those obligations come from laws, the payment card industry standard, and acquiring bank contracts. Operational factors such as storage capacity or analytics desires inform implementation but cannot define the retention period or destruction method.

Answer

The storage capacity available in the primary transaction database.

Answer

The vendor's default configuration settings for the point-of-sale system.

Answer

The preferences of the marketing department for customer analytics.