SSCP Practice Test 8 — 10 Questions

Question 1

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Accepted Answer

DES. DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.

Answer

RSA-2048

Answer

AES-256

Question 2

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

Accepted Answer

Isolate the domain controller from the network.. The domain controller (DC) is showing signs of active compromise: unusual outbound traffic on port 443 (likely C2 communication) and a failed backup due to a volume shadow copy error (indicating attempted destruction of forensic evidence). Isolating the DC first stops the attacker's command-and-control channel and prevents lateral movement, which is the highest priority in incident response. Running a scan or restoring other systems before containment risks allowing the attacker to spread or destroy more data.

Answer

Run a full malware scan on the domain controller.

Answer

Restore the file server from last night's backup.

Answer

Disable the domain controller's antivirus to improve performance.

Question 3

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 4

A company is concerned about VM sprawl in its data center. Which of the following is the most effective mitigation strategy?

Accepted Answer

Implement a CMDB with lifecycle management policies. VM sprawl refers to unmanaged VMs accumulating. A Configuration Management Database (CMDB) with lifecycle management tracks VMs from creation to decommission. Hypervisor patching prevents escapes. Snapshots are for recovery. Host-based firewalls protect individual VMs but do not manage sprawl.

Answer

Enable host-based firewalls on each VM

Answer

Apply patches to the hypervisor regularly

Answer

Use a centralized snapshot management system

Question 5

A security analyst is evaluating encryption modes for a new system that requires authenticated encryption to ensure both confidentiality and integrity of data in transit. Which AES mode should the analyst recommend?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides authenticated encryption, combining the confidentiality of CTR mode with integrity verification via a Galois field authentication tag. This makes it ideal for securing data in transit, as it ensures both privacy and tamper detection in a single, efficient operation.

Answer

ECB

Answer

CBC

Answer

CTR

Question 6

Drag and drop the steps for setting up a certificate authority (CA) in Windows Server into the correct order.

Accepted Answer

Step 1: Install the Active Directory Certificate Services role. Step 2: Configure the CA type (e.g., Enterprise Root CA). Step 3: Set the storage locations for certificate database and log. Step 4: Install the CA services. Step 5: Test the CA by requesting a certificate.. Setting up a Certificate Authority on Windows Server involves installing the Active Directory Certificate Services role, then configuring the CA type (e.g., Enterprise Root CA), specifying storage locations for the certificate database and log files, completing the installation, and finally testing the CA by requesting a certificate. The steps must follow this order because each step depends on the previous one; for instance, you cannot configure the CA type before the role is installed, and storage settings are part of the configuration phase.

Answer

Step 1: Install the AD CS role. Step 2: Configure the CA type. Step 3: Install the CA services. Step 4: Set the storage locations. Step 5: Test the CA.

Answer

Step 1: Configure the CA type. Step 2: Install the AD CS role. Step 3: Set storage locations. Step 4: Install the CA services. Step 5: Test.

Answer

Step 1: Install the AD CS role. Step 2: Set storage locations. Step 3: Configure the CA type. Step 4: Install the CA services. Step 5: Test.

Question 7

A financial firm has deployed network-based IDS/IPS sensors at key points to detect and prevent intrusions. During a recent security audit, it was discovered that an attacker exfiltrated sensitive data using DNS over HTTPS (DoH) queries. The IDS/IPS did not generate any alerts. The firm's network policy allows all outbound HTTPS traffic to any destination. To prevent such exfiltration in the future, what is the most effective corrective action?

Accepted Answer

Deploy TLS termination at the network perimeter. Deploying TLS termination at the network perimeter allows the organization to decrypt inbound and outbound HTTPS traffic, inspect the plaintext content, and re-encrypt it before forwarding. This enables the IDS/IPS to detect malicious payloads, such as DNS over HTTPS (DoH) queries, that would otherwise be hidden inside encrypted tunnels. Since the firm's policy allows all outbound HTTPS, TLS termination is the most effective way to regain visibility into that traffic without blocking it outright.

Answer

Enable deep packet inspection on all encrypted traffic

Answer

Implement a DNS sinkhole and block non-corporate DNS servers

Answer

Configure the IDS/IPS to inspect DNS traffic on standard port 53 only

Question 8

A company is migrating to a PaaS cloud environment. According to the shared responsibility model, which THREE security responsibilities remain with the customer? (Select THREE.)

Accepted Answer

User access and identity management. In PaaS, the customer manages access policies, application-level security, and data protection, while the provider manages the runtime, OS, and infrastructure.

Answer

Patch management of the underlying OS

Answer

Physical security of the data center

Question 9

A company wants to secure wireless communication for guests. Which protocol provides the strongest encryption for a wireless network?

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) provides the strongest encryption for wireless networks, using 128-bit AES in CCMP mode for encryption and replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks. This makes it the most secure option among the choices, especially for guest networks where authentication security is critical.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with TKIP

Answer

WPA2-PSK with AES

Question 10

Which metric is used to measure the potential loss from a single occurrence of a risk?

Accepted Answer

Single Loss Expectancy (SLE). The Single Loss Expectancy (SLE) is the metric used to measure the potential loss from a single occurrence of a risk. It is calculated as Asset Value (AV) multiplied by the Exposure Factor (EF), providing a dollar value for one incident. This directly answers the question of loss per single event.

Answer

Exposure Factor (EF)

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)