SSCP Practice Exam 62 — 20 Questions

Question 1

A security administrator is implementing a data loss prevention strategy for a company that handles credit card data. The administrator must ensure the organization meets PCI DSS requirements for protecting stored cardholder data. Which TWO practices should the administrator implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypt cardholder data with a strong algorithm and manage cryptographic keys using documented key management procedures.. PCI DSS requires that stored cardholder data be protected through rendering the primary account number unreadable and through strong cryptography with proper key management. These two practices reduce the likelihood and impact of unauthorized disclosure. Retaining full track data, keeping data indefinitely, or relying on proprietary encryption all violate PCI DSS requirements or accepted security practice for cardholder data protection.

Answer

Transmit cardholder data over public networks using a proprietary encryption scheme that is not reviewed by independent experts.

Answer

Retain all cardholder data indefinitely to support future fraud investigations.

Answer

Store the full magnetic stripe data in a central repository for backup and reconciliation purposes.

Question 2

A financial services firm must prove that an e-commerce application's source code has not been tampered with between the build pipeline and production deployment. The pipeline already stores build artifacts in an internal repository. Which control BEST provides this assurance?

Accepted Answer

Sign each build artifact with a key held by the CI/CD system and verify the signature before deployment.. Signing build artifacts in the pipeline and validating those signatures before deployment creates a cryptographic chain from the trusted build to production. If any byte changes in transit or at rest, verification fails. SBOMs, commit signing, and MFA improve visibility or access control but do not seal the artifact itself, so they cannot prove non-tampering.

Answer

Generate an SBOM in SPDX format and archive it alongside each release.

Answer

Enable multi-factor authentication for all engineers who have access to the artifact repository.

Answer

Require developers to sign Git commits with their personal GPG keys.

Question 3

A security administrator is reviewing the organization's account management procedures. The administrator discovers that user accounts for terminated employees remain active for up to 30 days after departure. Which account management control should the administrator implement to address this risk?

Accepted Answer

Implement an automated account deprovisioning process tied to HR termination records. An automated deprovisioning process linked to HR termination records disables accounts immediately upon termination, eliminating the 30-day window of exposure. Manual or periodic controls cannot match this timeliness. This is the most direct and effective control for ensuring departed employees lose access promptly.

Answer

Enforce a password expiration policy of 30 days

Answer

Conduct quarterly access reviews of all user accounts

Answer

Require multi-factor authentication for all user accounts

Question 4

A financial services firm is implementing role-based access control for its trading platform. An auditor finds that several traders can approve their own trades in addition to executing them. Which principle is being violated, and which control should the security administrator implement to remediate the finding?

Accepted Answer

Separation of duties; enforce distinct roles so the trade executor cannot also approve the same transaction.. The auditor observed that the same individual can execute and approve a trade, which is a classic separation of duties violation. Separation of duties ensures that critical tasks are divided among multiple people so that no single person can complete a sensitive transaction alone. Implementing mutually exclusive roles that separate execution from approval directly remediates the finding.

Answer

Need to know; restrict traders from viewing market data unrelated to their assigned portfolios.

Answer

Least privilege; implement just-in-time privileged access with approval workflows.

Answer

Mandatory access control; classify trades by sensitivity and apply system-enforced labels.

Question 5

An incident responder is preparing to acquire volatile data from a compromised Linux server that is still powered on. The server hosts a critical database and cannot be shut down yet. According to order of volatility, which data source should the responder collect FIRST?

Accepted Answer

Contents of physical memory (RAM) using a tool such as LiME. The order of volatility prioritizes data that is most likely to be lost first. RAM is highly volatile and contains running processes, network connections, encryption keys, and malware that may not exist on disk. Network state and disk logs are less volatile and can be collected afterward. Capturing memory with a tool like LiME before other sources ensures the most perishable evidence is preserved for forensic analysis.

Answer

Output of the netstat -antp command showing active network connections

Answer

Contents of the /var/log/auth.log file

Answer

Temporary files in the /tmp directory

Question 6

A security analyst is reviewing firewall logs and notices repeated inbound TCP SYN packets to multiple destination ports on an internal web server, but no corresponding ACK packets are returned. The source IP address is spoofed. Which type of activity does this pattern most likely indicate?

Accepted Answer

TCP SYN flood. The pattern of many TCP SYN packets with spoofed source addresses and no completing ACKs is the signature of a TCP SYN flood, a denial-of-service technique that exhausts the target's half-open connection table. The lack of ACK packets confirms that the handshake is never completed, which is characteristic of this attack.

Answer

Smurf attack

Answer

UDP amplification attack

Answer

DNS cache poisoning

Question 7

A financial institution uses a centralized authentication system. An auditor notes that when an employee is terminated, their access to several critical applications remains active for up to 24 hours because each application maintains its own local user database. Which of the following is the MOST effective control to reduce this window of exposure?

Accepted Answer

Deploy a centralized identity management system with automated provisioning and deprovisioning.. The core issue is that each application maintains its own user database, causing manual and delayed deprovisioning. A centralized identity management system with automated provisioning and deprovisioning solves this by integrating with applications and immediately disabling accounts upon termination. The other options do not address the root cause of decentralized, delayed account revocation.

Answer

Require employees to sign a security awareness policy acknowledging immediate termination of access.

Answer

Implement a mandatory password change every 30 days for all users.

Answer

Implement network access control (NAC) to restrict terminated employees' devices from connecting to the network.

Question 8

A security analyst is reviewing the organization's disaster recovery plan and notices that the Recovery Time Objective (RTO) for a critical application is 2 hours, but the current recovery process takes 8 hours. Which of the following should the analyst recommend FIRST?

Accepted Answer

Implement additional automation to reduce recovery time.. When the actual recovery time exceeds the RTO, the priority is to improve the recovery process to meet the business requirement. Automation can reduce manual effort and errors, speeding up recovery. Adjusting the RTO or accepting risk should only be considered after attempting to meet the objective. Purchasing new infrastructure is a last resort and may not address process inefficiencies.

Answer

Accept the risk and document the deviation.

Answer

Increase the RTO to 8 hours to match the current capability.

Answer

Purchase a new disaster recovery site.

Question 9

A small business wants to let visitors use its guest Wi-Fi without exposing internal servers. The visitors must reach the internet only, while employees keep using the corporate SSID. Which design best isolates guest traffic from the internal network?

Accepted Answer

Place guest clients on a separate VLAN whose only permitted path is to the internet gateway, with ACLs blocking access to internal subnets. Guest isolation requires separating traffic at Layer 2 and controlling it at Layer 3. A dedicated VLAN removes guests from the corporate broadcast domain, and ACLs or firewall rules that permit only internet-bound flows prevent lateral movement to internal servers. Encryption, client isolation, and MAC filtering affect who may join or talk to peers, but none of them keeps an associated guest away from internal subnets.

Answer

Enable MAC filtering on the guest access points so only registered visitor devices may associate

Answer

Keep guests on the corporate SSID but enable client isolation so wireless clients cannot talk to each other

Answer

Configure the guest SSID to use WPA3-Personal with a strong passphrase and rotate it monthly

Question 10

A financial services firm's incident response team has just contained a malware outbreak on a file server. The server contains regulated customer data. The team lead instructs the responder to capture the current state of the system before any remediation. According to NIST SP 800-61, which action should the responder take FIRST to preserve the most volatile evidence?

Accepted Answer

Dump the contents of RAM and capture active network connections.. The order of volatility dictates that the most transient evidence be collected first. RAM contents, running processes, and active network connections disappear when a system is powered down or rebooted, so they must be captured before disk imaging, log export, or physical documentation. This aligns with NIST SP 800-61 guidance to preserve volatile data during containment.

Answer

Export the server's event logs to a remote syslog server.

Answer

Capture a forensic image of the server's hard drive using a write blocker.

Answer

Document the server's physical location and hardware configuration.

Question 11

A security analyst is hardening a web application that stores user-uploaded images. The application currently writes uploads to a directory served directly by the web server. Which TWO controls BEST reduce the risk of a malicious upload leading to remote code execution? (Choose two.)

Accepted Answer

Validate the file's magic bytes and extension against an allowlist of permitted image formats.. Preventing upload-based remote code execution requires both validating that the content is genuinely an allowed image type and ensuring stored files can never be interpreted as executable code. Content inspection and an extension allowlist establish the first barrier, while storing files outside the web root with safe response headers removes the execution path entirely.

Answer

Log every upload event with the client IP address and user agent for later review.

Answer

Increase the PHP upload_max_filesize directive to accommodate large images.

Answer

Rename each uploaded file to a random UUID while keeping the original extension.

Question 12

A security administrator is implementing a data loss prevention strategy for a company that handles credit card data. The administrator must ensure the organization meets PCI DSS requirements for protecting stored cardholder data. Which TWO practices should the administrator implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

False Acceptance Rate (FAR). The goal is to minimize unauthorized access, which means reducing the False Acceptance Rate. Lowering FAR makes the system stricter, accepting fewer impostors, though it may increase false rejections. CER and EER represent balanced points and do not prioritize security, while FRR relates to rejecting legitimate users, which is not the primary concern here.

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Answer

Equal Error Rate (EER)

Question 13

A security administrator is reviewing an incident response plan and finds that the team has no agreed way to classify how severe a detected event is before deciding whether to escalate. Which artifact should be created to standardize this decision?

Accepted Answer

An incident severity matrix that maps impact and scope to response tiers.. Consistent incident triage depends on predefined criteria that translate technical indicators and business impact into response tiers. A severity matrix supplies those criteria, so different analysts reach the same escalation decision. It also enables meaningful metrics, since severity levels become comparable across incidents and reporting periods.

Answer

A vulnerability management scanning schedule.

Answer

A memorandum of understanding with the legal department.

Answer

A service level agreement with the managed security service provider.

Question 14

A security analyst is hardening a wireless network that uses WPA2-Enterprise with a RADIUS server. The analyst wants to mitigate the risk of an attacker setting up a rogue access point to capture user credentials. Which TWO measures should be implemented? (Choose two.)

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS) to detect and contain rogue access points.. Deploying a WIPS detects and contains rogue access points, directly addressing the threat. Configuring 802.1X with EAP-TLS ensures mutual authentication, so clients verify the server's certificate and will not connect to a rogue AP. Together, these measures prevent credential harvesting. PMF, hidden SSIDs, and PSKs do not adequately mitigate the risk of a rogue AP capturing credentials.

Answer

Enable Protected Management Frames (PMF) to prevent deauthentication attacks.

Answer

Use a preshared key (PSK) instead of 802.1X to simplify authentication.

Answer

Disable SSID broadcasting to hide the network name.

Question 15

A cloud operations team is hardening the management plane of its Infrastructure as a Service (IaaS) environment. The team wants to reduce the risk of unauthorized administrative access to the cloud console and APIs. Which TWO of the following controls best address this objective? (Choose two.)

Accepted Answer

Enforce multi-factor authentication for all privileged accounts. Protecting the cloud management plane requires strong authentication and tight authorization. Multi-factor authentication ensures that a compromised password alone cannot grant administrative access, while least-privilege IAM policies limit what any authenticated identity can do. Together they reduce the likelihood and impact of unauthorized administrative access. The other choices concern storage durability, database sizing, and content delivery, none of which govern who can reach the console or APIs.

Answer

Configure a content delivery network in front of public web endpoints

Answer

Enable object storage versioning on application data buckets

Answer

Increase the size of the managed database instance class

Question 16

A security administrator is implementing a data loss prevention strategy for a company that handles credit card data. The administrator must ensure the organization meets PCI DSS requirements for protecting stored cardholder data. Which TWO practices should the administrator implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypting cardholder data at rest using strong cryptography. PCI DSS requires that stored cardholder data be protected by rendering it unreadable, commonly through strong encryption. This directly addresses the risk of data exposure from compromised storage. A WAF, ASV scans, and password policies are required or recommended for other aspects of PCI DSS but do not fulfill the specific stored-data protection requirement.

Answer

Implementing a web application firewall (WAF) in front of the payment application

Answer

Conducting quarterly external network scans by an Approved Scanning Vendor (ASV)

Answer

Enforcing a minimum password length of eight characters for all users

Question 17

A healthcare company must store backup tapes offsite for seven years. The tapes contain patient records, and the company wants a symmetric encryption algorithm that is fast, widely supported, and approved by NIST for protecting data at rest. Which algorithm best meets these requirements?

Accepted Answer

AES with a 256-bit key. AES is a NIST-approved symmetric block cipher that provides strong confidentiality with high performance, which is essential for encrypting large volumes of backup data. A 256-bit key offers a conservative security margin for long-term storage. Hashing provides integrity only, RSA and Diffie-Hellman are asymmetric mechanisms not suited to bulk data-at-rest encryption, so AES is the appropriate choice.

Answer

Diffie-Hellman key exchange with a 2048-bit group

Answer

RSA with a 2048-bit key

Answer

SHA-256 hashing of each backup file

Question 18

A financial services company is deploying a new VPN concentrator that must support perfect forward secrecy (PFS) for all client sessions. The security team is configuring the IPsec phase 2 (Quick Mode) proposals. Which of the following should be configured to achieve PFS?

Accepted Answer

Enable Diffie-Hellman group 14 in the phase 2 proposal.. Perfect forward secrecy in IPsec is achieved by including a Diffie-Hellman group in the phase 2 (Quick Mode) proposal. This forces a new key exchange for each session, ensuring that compromise of one session key does not compromise other sessions. Encryption algorithms and authentication methods do not provide PFS; they serve different purposes.

Answer

Set the phase 1 lifetime to be shorter than the phase 2 lifetime.

Answer

Configure the phase 1 proposal to use RSA signatures for authentication.

Answer

Use AES-256-GCM for the phase 2 encryption algorithm.

Question 19

A security incident response team is reviewing their disaster recovery plan. They need to ensure that their backup strategy supports recovery from a ransomware attack that encrypts critical files. Which TWO of the following are essential characteristics of an effective backup strategy for this scenario? (Choose two.)

Accepted Answer

Backups are stored offline or in an immutable format.. An effective backup strategy against ransomware must ensure that backups cannot be encrypted by the attacker and that they can be successfully restored. Offline or immutable backups provide protection from encryption, and regular testing verifies that restoration will work when needed. Other factors like retention period or encryption key management are important but not as directly critical for this specific threat.

Answer

Backups are encrypted with a key stored on the same server.

Answer

Backups are retained for at least seven years.

Answer

Backups are performed daily to the same network share.

Question 20

A security analyst is reviewing network traffic and notices that an attacker is sending forged ARP replies to a host, attempting to associate the attacker's MAC address with the IP address of the default gateway. Which security feature should be implemented on the switch to prevent this attack?

Accepted Answer

Dynamic ARP Inspection (DAI). Dynamic ARP Inspection (DAI) is the switch feature designed to prevent ARP spoofing by validating ARP packets against a trusted binding table. It drops ARP packets that contain invalid IP-to-MAC mappings, thereby blocking the attacker's attempt to associate their MAC with the gateway's IP. Other features like port security, DHCP snooping, or 802.1X do not provide this specific ARP validation.

Answer

Port security

Answer

DHCP snooping

Answer

802.1X authentication