SSCP Practice Test 8 — 10 Questions

Question 1

A security engineer is reviewing the configuration of a web application that uses JSON Web Tokens (JWT) for session management. The engineer notices that the application accepts tokens signed with the 'none' algorithm. Which of the following is the most critical security risk associated with this configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attackers can forge tokens with arbitrary claims, leading to privilege escalation.. Accepting the 'none' algorithm means the application does not verify the token's signature. An attacker can craft a token with any claims and set the algorithm to 'none', bypassing authentication and authorization. This is a critical vulnerability that can lead to full account takeover and privilege escalation.

Answer

Tokens will be transmitted in plaintext, exposing sensitive information.

Answer

Tokens will expire prematurely, causing denial of service for legitimate users.

Answer

The application will experience performance degradation due to lack of signature verification.

Question 2

A security administrator is evaluating encryption protocols for email communication. Which of the following protocols can secure email in transit? (Select TWO)

Accepted Answer

IMAPS. IMAPS (Option A) is correct because it wraps the IMAP mail-retrieval protocol inside TLS (typically on TCP port 993), encrypting the client-to-server session so credentials and message contents are protected in transit. SMTPS (Option D) is correct because it applies TLS to SMTP (commonly on TCP port 465, or via STARTTLS on 587/25), securing the transport of outgoing email between mail clients and servers or between mail relays. HTTPS (Option B) secures web traffic via TLS but is not an email transport protocol, so it does not directly secure email in transit. SSH (Option C) provides an encrypted remote-shell/tunneling channel and is not an email protocol, and SFTP (Option E) is a file-transfer protocol over SSH, unrelated to securing email delivery.

Answer

HTTPS

Answer

SSH

Answer

SFTP

Question 3

Which THREE of the following are common indicators of a cross-site scripting (XSS) attack? (Choose three.)

Accepted Answer

JavaScript execution in the browser's developer console that was not initiated by the user. XSS attacks often inject malicious JavaScript that executes in the victim's browser without user initiation. Observing unexpected script execution in the developer console indicates that an attacker's payload has run, which is a direct sign of a successful XSS exploit.

Answer

Unusual cookie values or multiple cookies

Answer

Unusual network traffic to external IP addresses

Question 4

A security analyst is reviewing firewall logs and notices a high rate of TCP SYN packets to multiple ports on a server, but no corresponding ACK or RST packets. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed source addresses, so the server allocates half-open connection state and replies with SYN-ACK but never receives the final ACK. The absence of ACK or RST responses in the logs is the signature of this half-open connection exhaustion attack.

Answer

UDP flood

Answer

Smurf attack

Answer

Ping of death

Question 5

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Accepted Answer

Write-once storage to prevent modification. Option A (write-once storage to prevent modification) is correct because WORM (Write Once Read Many) media or immutable storage ensures that once log data is written it cannot be altered or deleted, preserving evidentiary integrity for forensics. Option B (digital signing of logs to verify authenticity) is correct because cryptographic signatures or hashes let investigators prove logs were not tampered with and confirm their origin, supporting non-repudiation and chain-of-custody requirements. Option D (ensuring logs are retained for a period consistent with legal and regulatory requirements) is correct because forensic usefulness depends on having the relevant logs still available when an investigation occurs, and retention periods are often mandated by laws such as HIPAA, PCI DSS, or GDPR. Option C is not correct because minimizing retention to cut storage costs directly undermines forensic and compliance needs by destroying potentially critical evidence prematurely. Option E is not correct because centralizing logs improves correlation and management but does not by itself guarantee integrity or forensic usefulness, and it can even concentrate risk if the repository is not protected.

Answer

Minimizing log retention to reduce storage costs

Answer

Aggregating logs from all sources into one centralized repository

Question 6

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 7

An analyst runs the netstat command on a web server. Based on the output, which connection is the MOST suspicious?

Accepted Answer

The connection from 203.0.113.5:8080. 203.0.113.5 is from the documentation IP range (RFC 5737), which should not appear in real network traffic. This indicates potential spoofing or malicious activity. Options B and C are internal private IPs, which are expected. Option D is the normal HTTP listening service.

Answer

The connection from 192.168.1.10:54321

Answer

The connection from 10.0.2.50:44350

Answer

The listening on 0.0.0.0:80

Question 8

A security analyst is hardening a new Windows server. Which configuration would MOST effectively reduce the attack surface by limiting the software that can execute?

Accepted Answer

Configure AppLocker rules. AppLocker is a Windows application control feature that lets administrators define allow/deny rules based on publisher, path, or file hash, thereby restricting which executables, scripts, and installers can run. This directly limits the software that can execute, which is the most effective way to reduce attack surface against unauthorized or malicious code. Antivirus, AutoPlay, and UAC address other threats but do not control what software is permitted to run.

Answer

Enable Windows Defender Antivirus

Answer

Disable AutoPlay

Answer

Enable User Account Control (UAC)

Question 9

A cloud security team is deploying a new web application on an IaaS platform. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system and web server software. Patching the guest operating system and web server software is correct because in the IaaS shared responsibility model, the customer controls and is responsible for everything from the guest OS upward — including OS patches, middleware, runtime, and application code. The provider secures the physical hosts, hypervisor, and network fabric beneath the virtualization layer.

Answer

Network infrastructure security such as DDoS protection at the provider edge

Answer

Hypervisor security and vulnerability management

Answer

Physical security of the data center hosting the servers

Question 10

A security analyst discovers that an internal DNS server is returning incorrect IP addresses for legitimate domains. The analyst suspects that an attacker has compromised the DNS resolver's cache. Which type of attack has likely occurred?

Accepted Answer

DNS poisoning. DNS poisoning (also called DNS cache poisoning or spoofing) occurs when an attacker injects forged DNS records into a resolver's cache, causing it to return incorrect IP addresses for legitimate domain names. The symptom described — a compromised resolver cache returning wrong IPs — is the textbook definition of this attack.

Answer

DNS amplification attack

Answer

SYN flood

Answer

DNS tunneling