SSCP Practice Exam 61 — 20 Questions

Question 1

Based on the exhibit, what is the most likely cause of the web application outage?

Accepted Answer

SQL Server service is down. The exhibit shows that the web application is returning HTTP 500 errors, which typically indicate a server-side issue. Since the web server can connect to the database server (as shown by the successful ping), but the application fails, the most likely cause is that the SQL Server service is down, preventing the application from executing queries. This aligns with the correct answer C.

Answer

Network connectivity issue between web and DB

Answer

Application pool memory leak

Answer

Database server disk failure

Question 2

Which TWO of the following are key components of a data classification policy? (Select the two best answers.)

Accepted Answer

Classification labels

Answer

Encryption algorithm selection

Answer

Firewall rules

Answer

Backup schedules

Question 3

An organization's help desk receives multiple reports of employees unable to access a critical internal application. The IT team confirms the application server is running. What is the FIRST step in the incident response process?

Accepted Answer

Verify the reports and confirm the scope of the issue. The initial step in incident response is to identify and verify the incident. Option B is wrong because containment comes after identification. Option C is wrong because eradication follows containment. Option D is wrong because recovery is performed after eradication.

Answer

Restore the application from the latest backup

Answer

Remove any malicious software from the server

Answer

Isolate the affected systems from the network

Question 4

A security team is implementing a risk treatment plan for a high-risk vulnerability. The cost to fix the vulnerability is $100,000, but the expected loss if exploited is $1,000,000. The annual likelihood of exploitation is 2%. Which risk treatment strategy is most appropriate?

Accepted Answer

Accept the risk and monitor for changes. The annualized loss expectancy (ALE) is $20,000 (2% × $1,000,000), which is less than the $100,000 remediation cost. Since the cost to fix exceeds the expected loss, accepting the risk and monitoring for changes is the most cost-effective strategy. This aligns with the risk management principle that treatment should be proportional to the risk exposure.

Answer

Avoid the risk by decommissioning the asset

Answer

Remediate the vulnerability immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 5

A system administrator is hardening a Windows server. Which two of the following are effective hardening measures? (Choose two.)

Accepted Answer

Disable unnecessary services. Disabling unnecessary services reduces the attack surface by removing potential entry points for malware or unauthorized access. On Windows Server, services like Print Spooler or Windows Search may be disabled if not needed, as they have historically been exploited (e.g., PrintNightmare). This aligns with the principle of least functionality.

Answer

Set file permissions to Everyone: Full Control

Answer

Enable guest account with strong password

Answer

Use Telnet for remote management

Question 6

A PKI administrator is designing a key management lifecycle for a high-security environment. Which practice is most critical for ensuring long-term security of asymmetric keys?

Accepted Answer

Performing regular key rotation. Regular key rotation limits exposure in case of compromise. All other options are important but rotation is most critical for long-term security.

Answer

Using hardware security modules (HSMs)

Answer

Implementing key escrow

Answer

Maintaining a Certificate Revocation List (CRL)

Question 7

An employee receives an email with an attachment claiming to be an invoice but contains a macro virus. What control would have blocked this?

Accepted Answer

Macro security settings in Office. Macro security settings in Office can disable macros or require signed macros, preventing execution. Spam filter may not detect targeted phishing. Attachment scanning may miss zero-day variants. User training reduces risk but does not technically block.

Answer

User awareness training

Answer

Email attachment scanning

Answer

Spam filter

Question 8

A company's log management solution is overwhelmed by high-volume logs from network devices, causing storage and analysis delays. Which strategy would best improve the efficiency of the log management process?

Accepted Answer

Implement log filtering and prioritization rules. Implementing log filtering and prioritization rules (Option C) directly addresses the root cause of the problem by reducing the volume of irrelevant or low-priority logs before they are stored or analyzed. This improves both storage efficiency and analysis speed, as the log management system processes only meaningful events, such as those matching security or performance thresholds, rather than being overwhelmed by high-frequency noise like repeated informational syslog messages.

Answer

Increase the storage capacity of the log server

Answer

Increase the frequency of log analysis cycles

Answer

Reduce the number of devices sending logs

Question 9

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Accepted Answer

Basic security hygiene with minimal impact. CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Answer

Maximum security with high operational impact

Answer

Equivalent to DISA STIGs

Answer

Only applicable to critical systems

Question 10

To determine how malware initially infected a workstation, which artifact would be MOST useful?

Accepted Answer

Windows Event Log showing process creation. The Windows Event Log showing process creation (Event ID 4688) provides a chronological record of every executable that ran on the system, including the parent process and command-line arguments. This allows an investigator to trace the initial execution of the malware binary, identifying the exact moment and mechanism (e.g., a dropped file, a script launch, or a scheduled task) that triggered the infection. Other artifacts may indicate persistence or lateral movement, but only process creation logs directly capture the first execution event.

Answer

Prefetch files

Answer

Windows registry autorun keys

Answer

Web browser history

Question 11

An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?

Accepted Answer

End-entity certificate, intermediate CA certificate, and root CA certificate. In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.

Answer

Only the root CA certificate

Answer

Only the end-entity certificate and the root CA certificate

Answer

Only the end-entity certificate and the intermediate CA certificate

Question 12

When implementing a digital signature, which key is used to create the signature?

Accepted Answer

Sender's private key. In a digital signature scheme, the sender uses their own private key to create the signature. This ensures non-repudiation because only the sender possesses that private key, and the corresponding public key can verify the signature. The process involves encrypting a hash of the message with the sender's private key, as specified in standards like PKCS#1 and RFC 8017.

Answer

Receiver's private key

Answer

Sender's public key

Answer

Receiver's public key

Question 13

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Accepted Answer

Document the findings and update processes. Documenting findings and updating processes is a fundamental part of the change management lifecycle. It ensures that the security vulnerability is formally recorded, root causes are analyzed, and preventive measures are incorporated into future changes. This aligns with the post-implementation review (PIR) phase, where lessons learned are captured to improve security operations and administration.

Answer

Immediately apply a patch

Answer

Blame the change implementer

Answer

Proceed and accept the risk

Question 14

Which THREE of the following are appropriate techniques for securely disposing of magnetic hard disk drives that contain sensitive data? (Choose three.)

Accepted Answer

Shredding. Shredding (B) physically destroys the platters, making data recovery impossible regardless of the magnetic state. This is a definitive disposal method for sensitive data on magnetic hard disk drives.

Answer

Low-level format

Answer

Quick format

Question 15

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). SLE is asset value ($5,000,000) times exposure factor (40%) = $2,000,000. Then ALE = $2,000,000 × 0.5 = $1,000,000. This quantitative risk analysis formula is standard in financial risk assessments for payment systems.

Answer

$800,000

Answer

$2,000,000

Answer

$2,500,000

Question 16

A small medical office has 10 employees who use laptops to access electronic health records (EHR) via a web application hosted at a colocation facility. The office currently uses a consumer-grade wireless router with WPA2-PSK for internet access. The EHR vendor requires all connections to be encrypted with TLS 1.2 and recommends using a VPN for remote access. The office manager wants to ensure secure connections from the office to the EHR system, while keeping costs low. The network consultant proposes several options. Which option best balances security and cost?

Accepted Answer

Configure an IPsec site-to-site VPN between the office router and the colocation firewall.. An IPsec site-to-site VPN creates an encrypted tunnel between the office router and the colocation firewall, securing all EHR traffic without requiring per-user software or high ongoing costs. This directly satisfies the EHR vendor's VPN recommendation while using existing infrastructure (the office router and colocation firewall) and avoiding the expense of a dedicated appliance or complex client management.

Answer

Upgrade the wireless router to one that supports WPA3-Enterprise.

Answer

Install a dedicated SSL VPN appliance at the office for clientless access.

Answer

Use only HTTPS with TLS 1.2 and disable HTTP access on the EHR server.

Question 17

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 18

A company wants to enforce network access control (NAC) for both wired and wireless devices. Which protocol is used for this purpose?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control (NAC) that authenticates devices before granting access to both wired and wireless networks. It operates at the data link layer and uses an authentication server (e.g., RADIUS) to validate credentials, ensuring only authorized devices connect to the network.

Answer

SNMP (Simple Network Management Protocol)

Answer

EAP (Extensible Authentication Protocol)

Answer

PAP (Password Authentication Protocol)

Question 19

A security analyst reviews logs and finds that an attacker exploited a vulnerability in a web application to read arbitrary files from the server. The application runs on Apache with mod_php. Which of the following is the MOST likely vulnerability?

Accepted Answer

Local File Inclusion (LFI) vulnerability in a PHP include statement.. The scenario describes reading arbitrary files from the server, which is the hallmark of a Local File Inclusion (LFI) vulnerability. In a PHP application using include statements, an attacker can manipulate a file path parameter (e.g., `?page=../../etc/passwd`) to include and read local files, exploiting the server's filesystem access. Apache with mod_php is particularly susceptible to LFI when user input is not sanitized before being passed to functions like `include()` or `require()`.

Answer

XML External Entity (XXE) vulnerability.

Answer

Remote File Inclusion (RFI) vulnerability.

Answer

Server-Side Request Forgery (SSRF) vulnerability.

Question 20

An administrator notices that a terminated employee's account is still active. Which access control process was likely skipped?

Accepted Answer

Provisioning. Provisioning is the access control process that includes creating, modifying, and disabling user accounts and their associated privileges. When a terminated employee's account remains active, the de-provisioning step—specifically account revocation—was likely skipped, leaving the account enabled and accessible.

Answer

Authorization

Answer

Authentication

Answer

Accounting