SSCP Practice Test 7 — 10 Questions

Question 1

Which of the following hash algorithms is considered cryptographically broken and should be avoided due to collision attacks?

Accepted Answer

MD5. MD5 is known to have collision vulnerabilities and is no longer considered secure.

Answer

SHA-3

Answer

SHA-256

Answer

HMAC-SHA256

Question 2

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 3

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 4

A system administrator needs to implement a control that ensures users can only access files necessary for their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege ensures that users are granted only the permissions necessary to perform their job functions, minimizing the attack surface and potential damage from accidental or malicious actions. In this scenario, restricting file access to only what is needed for job duties directly implements least privilege, as it limits access rights to the minimum required. This is distinct from need-to-know, which focuses on information disclosure rather than access permissions.

Answer

Need-to-know

Answer

Separation of duties

Answer

Job rotation

Question 5

Refer to the exhibit. A user reports being unable to remote desktop (RDP) into a Windows server. Given the event log, what is the most likely cause?

Accepted Answer

The user does not have the 'Allow log on through Remote Desktop Services' user right. The event log shows an 'An account failed to log on' event (ID 4625) with a failure reason indicating 'The user has not been granted the requested logon type at this machine.' For Remote Desktop connections, the required logon type is 'Remote Interactive' (logon type 10). This specific error means the user lacks the 'Allow log on through Remote Desktop Services' user right, which is assigned via Local Security Policy or Group Policy. Without this right, the RDP session is denied at the authentication stage, even if the username and password are correct.

Answer

The user account is locked out

Answer

The server is not a member of the domain

Answer

The user's Kerberos ticket has expired

Question 6

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 7

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Accepted Answer

Clients will receive a certificate warning or be unable to connect.. When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.

Answer

The server will automatically obtain a new certificate.

Answer

Clients will connect but with reduced cipher strength.

Answer

Clients will be able to connect without any warning.

Question 8

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 9

A security analyst notices an increase in failed login attempts from a single IP address. What is the best immediate action?

Accepted Answer

Check the SIEM for correlated events.. Checking the SIEM for correlated events (Option D) is the best immediate action because it allows the analyst to gather context around the failed login attempts—such as whether they target multiple accounts, originate from a known malicious IP, or coincide with other suspicious activity—before taking a potentially disruptive or irreversible step. This aligns with the incident response principle of 'verify before you act,' ensuring the response is proportional and informed by correlated data from multiple sources.

Answer

Run an antivirus scan.

Answer

Disable the user accounts.

Answer

Block the IP at the firewall.

Question 10

A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?

Accepted Answer

Insecure Direct Object References (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.

Answer

Cross-Site Scripting (XSS)

Answer

Injection

Answer

Security Misconfiguration