SSCP Practice Exam 63 — 20 Questions

Question 1

A healthcare provider must ensure that stored patient records remain unreadable if an attacker steals the physical disk from a database server. The server runs a mainstream Linux distribution and the requirement applies to the entire volume, not just individual files. Which control best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Full disk encryption with LUKS on the data volume. Whole-volume encryption converts all data on the block device into ciphertext at rest and requires a key to mount it. When the disk is stolen, the ciphertext is useless without that key, which directly satisfies the requirement to keep records unreadable after physical theft.

Answer

Enforcing strict file permissions on the data directory

Answer

Enabling SELinux in enforcing mode on the server

Answer

Per-file encryption performed by the database engine

Question 2

A software vendor ships a Java-based payment service to a customer's data center. The customer's security team requires that the application run with only the minimum privileges necessary and cannot be trusted to restrict itself. Which mechanism should the security team use to enforce these restrictions on the JVM?

Accepted Answer

Java security policy files configured with a SecurityManager. Java's SecurityManager works with a policy file that enumerates granted permissions, so code is denied anything not explicitly allowed. This lets the security team enforce least privilege from outside the application, which matches the requirement that the application itself not be trusted to limit its own access.

Answer

Running the JVM as a Windows service under Local System

Answer

Enabling verbose garbage collection logging

Answer

Code signing the JAR with a trusted certificate

Question 3

A risk analyst is documenting threats for a new cloud-hosted application. The analyst must classify threat sources. Which of the following is an example of an environmental threat source rather than a human threat source?

Accepted Answer

A flood that damages the regional data center hosting the application.. Threat sources are grouped into human, technical, and environmental categories. A flood is a classic environmental source because it stems from natural conditions rather than from a person or a code defect. Correct classification guides the risk response: environmental threats call for geographic redundancy, resilient facilities, and continuity planning, while human and technical sources call for access controls, monitoring, and remediation of flaws.

Answer

A software bug in a third-party library used by the application.

Answer

A disgruntled administrator with privileged access to the application database.

Answer

An organized criminal group targeting the application for ransomware.

Question 4

A security administrator is reviewing a vulnerability scan report and notices a finding labeled as a false positive. What is the most appropriate immediate action?

Accepted Answer

Document the false positive and tune the scanner to reduce recurrence.. False positives in vulnerability scans should be verified, documented, and used to tune the scanner to reduce future occurrences. This ensures that the vulnerability management process remains efficient and credible. Applying patches unnecessarily, ignoring without documentation, or escalating to incident response are all incorrect because they either waste resources or fail to address the root cause of the false alert.

Answer

Apply the recommended patch immediately to resolve the finding.

Answer

Ignore the finding because it is not a real vulnerability.

Answer

Escalate the finding to the incident response team as a potential breach.

Question 5

A healthcare organization is deploying a containerized patient records application on Kubernetes. The security team wants to prevent a compromised container from accessing the underlying node's filesystem and from escalating privileges. Which Kubernetes control should be configured to restrict the container's capabilities and prevent privilege escalation?

Accepted Answer

Set the pod's securityContext to allowPrivilegeEscalation: false and drop all Linux capabilities.. Restricting a container's privileges requires configuring its securityContext to prevent privilege escalation and to drop unnecessary Linux capabilities. These settings directly limit what the container process can do on the host, including mounting filesystems or using privileged system calls. Network policies, privileged pod security profiles, and resource quotas address different concerns and do not prevent host filesystem access or privilege escalation.

Answer

Configure a resource quota that limits CPU and memory for the pod.

Answer

Enable PodSecurityPolicy with the privileged profile applied to the namespace.

Answer

Configure a NetworkPolicy that denies all ingress and egress traffic to the pod.

Question 6

A security administrator is tasked with implementing a defense-in-depth strategy for the organization's data center. The administrator wants to ensure that physical access to servers is restricted to authorized personnel only. Which of the following controls should be implemented to achieve this?

Accepted Answer

Deploy a mantrap at the entrance to the data center.. To restrict physical access to authorized personnel, a preventive physical control is needed. A mantrap enforces one-person-at-a-time entry and prevents tailgating, directly restricting access. Cameras are detective, biometric server logins are logical, and raised flooring is infrastructural. Therefore, the mantrap is the correct choice.

Answer

Install security cameras throughout the data center.

Answer

Use raised flooring to protect cabling and improve airflow.

Answer

Implement biometric authentication for server logins.

Question 7

A small business owner wants to implement access control for a shared file server. The owner wants each department manager to be able to decide which of their employees can access specific folders, without involving the IT department for every change. Which access control model is most appropriate for this requirement?

Accepted Answer

Discretionary access control (DAC). Discretionary access control (DAC) lets resource owners decide who can access their resources, which directly supports the requirement for department managers to control access to their folders without IT involvement. MAC, RBAC, and ABAC are more centralized or policy-driven and do not offer this level of delegated, owner-controlled discretion.

Answer

Mandatory access control (MAC)

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Question 8

A security administrator at a financial firm is configuring access control for a new document management system. The system must enforce access decisions based on the sensitivity labels of documents and the clearance levels of employees, and it must prevent users from delegating their access to others. Which access control model should the administrator implement?

Accepted Answer

Mandatory access control (MAC). Mandatory access control (MAC) is the only model that uses system-enforced labels for both subjects and objects, and it prohibits users from changing or delegating access. The scenario requires sensitivity labels, clearance levels, and no delegation, which are defining characteristics of MAC. DAC, RBAC, and ABAC do not provide these mandatory, non-delegable controls by default.

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Answer

Role-based access control (RBAC)

Question 9

A security administrator is deploying a new web application on a Linux server. The application must be isolated from the host and other applications, and it must only be able to read its own configuration files. The administrator decides to use a container. Which of the following should the administrator implement to meet these requirements?

Accepted Answer

Use a read-only root filesystem and mount only the required configuration files as a read-only volume.. The requirement is to isolate the application and restrict it to reading only its own configuration files. A read-only root filesystem combined with read-only volume mounts for specific configuration files enforces this least-privilege model. Other options either grant excessive privileges or break functionality by removing all capabilities.

Answer

Run the container as the root user to ensure it has permission to read the configuration files.

Answer

Run the container with the --privileged flag to ensure it has all necessary permissions.

Answer

Disable all Linux capabilities for the container to prevent any file access.

Question 10

A security administrator is reviewing audit logs and discovers that a user account with administrative privileges was used to access a file server outside of normal business hours. The administrator needs to determine whether this access was authorized. Which of the following should the administrator do FIRST?

Accepted Answer

Review the change management records and on-call schedule for that time period. The first step in investigating suspicious access is to gather context from non-intrusive sources such as change management and on-call schedules. This helps determine if the access was authorized without disrupting operations or alerting a potential insider. Disabling accounts, contacting users, or escalating externally should come after initial verification.

Answer

Escalate the incident to law enforcement as a potential breach

Answer

Contact the user to ask whether they performed the access

Answer

Disable the administrative account immediately to prevent further access

Question 11

An organization's security team is reviewing the results of a recent risk assessment. Management decides to accept a particular risk because the cost of the control exceeds the potential loss, and the risk falls within the stated risk appetite. Which term best describes this decision?

Accepted Answer

Risk acceptance. When management knowingly retains an exposure because controls cost more than the expected loss and the risk fits within tolerance, the decision is risk acceptance. It must be formally documented with the approving authority and a scheduled review so that changes in threat, cost, or business context trigger reconsideration.

Answer

Risk mitigation

Answer

Risk transference

Answer

Risk avoidance

Question 12

A security administrator is reviewing the organization's data retention policy. The policy states that customer financial records must be kept for seven years, but the IT team currently archives them indefinitely. Which action should the administrator take to align data handling with the policy while preserving records for legal discovery?

Accepted Answer

Configure the archival system to apply a retention period of seven years and automatically purge records after that period.. The correct action is to enforce the documented seven-year retention with automatic purge. That aligns operational data handling with policy, reduces long-term breach impact, and still preserves records during the required legal window. Indefinite retention, immediate deletion, or reclassification all fail to meet the policy's specific retention requirement.

Answer

Delete all archived financial records immediately to reduce the organization's data footprint.

Answer

Move the archived records to a lower-cost storage tier and continue retaining them indefinitely.

Answer

Reclassify financial records as public so they are exempt from retention requirements.

Question 13

A company is deploying a new wireless network and wants to ensure that only authorized devices can connect. The security team decides to use a method that requires a supplicant, authenticator, and authentication server. Which technology should be implemented?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise uses IEEE 802.1X, which defines the supplicant (client), authenticator (access point), and authentication server (RADIUS). This architecture enables strong, centralized authentication, ensuring that only devices with valid credentials can join the network. The other options either lack the three-party model or rely on weak security mechanisms.

Answer

WEP with 802.1X

Answer

WPA2-Personal

Answer

MAC address filtering

Question 14

An organization uses a risk register to track identified risks. A risk owner reports that a mitigation control was implemented six months ago, but the residual risk rating has not been updated and no post-implementation review was performed. Which activity is MOST important for maintaining the integrity of the risk management process?

Accepted Answer

Reassess the risk with the control in place, document the updated likelihood and impact, and adjust the residual risk rating accordingly.. A risk register is only useful if it reflects current exposure. When a control is deployed, the risk must be reassessed to measure how much likelihood or impact it actually reduced, and the residual rating updated with evidence. This validation step closes the treatment loop and supports accurate reporting to management.

Answer

Transfer the risk to a third party through cyber insurance and remove the original mitigation control.

Answer

Escalate the risk to the board as an accepted risk without further analysis because the owner has already acted.

Answer

Close the risk entry because the mitigation control has been implemented and the risk is therefore eliminated.

Question 15

A security administrator is reviewing the account lifecycle process for a large retail company. An employee in the accounting department has been promoted to a role in the same department that requires access to the payroll system, while the employee's previous duties no longer require access to the accounts payable system. Which action should the administrator take to ensure least privilege is maintained?

Accepted Answer

Modify the existing account to grant payroll access and remove the accounts payable access.. Because the employee remains with the organization but changed job duties, the account should be modified to add the payroll entitlement and remove the accounts payable entitlement. This maintains least privilege, preserves the identity history, and avoids both account sprawl and lingering unnecessary access. The other choices either retain excessive rights, create redundant identities, or disrupt a current employee's access.

Answer

Disable the existing account and require the employee to request a new account through the help desk.

Answer

Create a new account for the payroll role and disable the old accounts payable account after 30 days.

Answer

Leave both sets of access in place so the employee can assist the accounting team during the transition.

Question 16

A security analyst is investigating a potential attack on a network. The analyst observes a large number of ICMP echo request packets with spoofed source IP addresses being sent to a subnet's broadcast address. Many hosts on the subnet are replying, causing network congestion. Which type of attack is this?

Accepted Answer

Smurf attack. The Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP. All hosts on the subnet reply to the spoofed victim, amplifying traffic and causing a denial of service. The scenario describes exactly this: ICMP echo requests to a broadcast address with spoofed source, causing many replies and congestion.

Answer

Ping of death

Answer

Fraggle attack

Answer

SYN flood

Question 17

A healthcare organization's incident response team has just contained a ransomware outbreak that encrypted several file servers. Before restoring from backups, the incident response manager wants to ensure that the team can determine exactly how the attacker initially gained access and what data was exfiltrated. The organization does not have a dedicated forensic imaging solution, but the servers are still powered on and running. Which of the following actions BEST supports the investigation while preserving evidence?

Accepted Answer

Capture a memory image and relevant logs from the running servers, then isolate them from the network before restoration.. The best action is to capture volatile evidence such as memory and logs from the running servers before isolating them. This preserves critical artifacts that reveal the attacker's methods and data exfiltration while preventing further damage. Restoring from backup or powering off the servers would destroy evidence, and antivirus scanning could alter the compromised state, undermining the investigation's goals.

Answer

Run a full antivirus scan on each server and quarantine any detected malware, then review the scan reports.

Answer

Immediately power off the servers to prevent further encryption, then remove the hard drives for later analysis.

Answer

Restore the servers from the most recent backup immediately, then review backup logs to identify the initial compromise.

Question 18

A company is deploying a VPN that uses IPsec in tunnel mode. The security engineer must choose a key exchange method that provides perfect forward secrecy (PFS) so that compromise of a long-term key does not expose past session keys. Which configuration should the engineer select?

Accepted Answer

Use IKEv2 with a Diffie-Hellman group for the IKE SA and a separate Diffie-Hellman group for the CHILD_SA.. Perfect forward secrecy requires that each IPsec session key be derived from a fresh, ephemeral Diffie-Hellman exchange. In IKEv2, configuring separate DH groups for the IKE SA and the CHILD_SA ensures that even if the IKE SA key is compromised, past and future child session keys remain protected. Static keys and configurations without a child DH exchange do not provide this property.

Answer

Use static keying with manually configured security associations and AES-256.

Answer

Use IKEv2 with RSA signatures for authentication and no additional Diffie-Hellman exchange after the initial IKE SA.

Answer

Use IKEv1 in main mode with pre-shared keys and no DH group for the quick mode.

Question 19

A security engineer is hardening a data center network against VLAN hopping attacks. The core switches currently use 802.1Q trunking on all inter-switch links, and unused access ports are left in the default VLAN. Which configuration change best mitigates VLAN hopping while preserving legitimate trunk operation?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports and place unused ports in an unused VLAN.. VLAN hopping typically relies on DTP negotiation on an access port or on double tagging through the native VLAN. Disabling DTP on access ports stops an attacker from forming a trunk, and moving unused ports to an unused VLAN removes an easy double-tagging target. Legitimate trunks remain functional on trusted inter-switch links, so segmentation is preserved while the attack surface is reduced.

Answer

Change all access ports to trunk ports and enable Dynamic Trunking Protocol (DTP) negotiation.

Answer

Enable BPDU Guard and Root Guard on all trunk ports to block VLAN hopping frames.

Answer

Configure all inter-switch links as access ports in VLAN 1 to simplify the topology.

Question 20

A security analyst is reviewing authentication logs and notices that a user account was used to log in from two different geographic locations within a five-minute window. The organization uses a centralized RADIUS server for authentication. Which of the following should the analyst investigate FIRST to determine if this is a legitimate concurrent session or a compromise?

Accepted Answer

Check the RADIUS server's accounting logs for session start and stop records.. RADIUS accounting logs provide session start and stop records, including the network access server and assigned IP address. These details allow the analyst to verify whether two sessions were truly concurrent and from which locations. Other options relate to policy or authorization and do not provide session-specific evidence needed to investigate the suspicious logins.

Answer

Examine the firewall rules governing RADIUS traffic.

Answer

Check the user's group membership in Active Directory.

Answer

Review the user's password complexity policy.