SSCP Practice Test 9 — 10 Questions

Question 1

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Accepted Answer

IEEE 802.1X port-based authentication. IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Answer

Port security with sticky MAC

Answer

MAC address filtering

Answer

VLAN segmentation

Question 2

Which TWO of the following are examples of administrative controls? (Choose two.)

Accepted Answer

Access control policies. Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Answer

Firewall rules

Answer

Security guards

Answer

Encryption of data at rest

Question 3

Which of the following is a technical threat source that could lead to a security breach?

Accepted Answer

Software bug. A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.

Answer

Disgruntled employee

Answer

Configuration weakness

Answer

Flood

Question 4

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the asset criticality is low, the high CVSS score and active exploitation increase the risk. The patch should be prioritized and deployed through the change management process.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 5

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Accepted Answer

False positive. A false positive occurs when a vulnerability scanner reports a finding that, upon investigation, is determined not to be a real security risk. In this case, the vulnerability is not exploitable due to compensating controls, meaning the scanner's alert was incorrect in the context of the actual environment. Therefore, the finding should be classified as a false positive, not a true vulnerability.

Answer

True positive

Answer

Risk acceptance

Answer

False negative

Question 6

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

Accepted Answer

Modify correlation rules to require multiple events before alerting. Modifying correlation rules to require multiple events before alerting reduces false positives by ensuring that a single benign event does not trigger an alert. This technique, often called 'thresholding' or 'event correlation,' filters out noise while still detecting multi-step attack patterns, such as a brute-force login attempt that requires multiple failed logins within a time window.

Answer

Increase the severity of all alerts to high

Answer

Disable all anomaly-based detection rules

Answer

Create a whitelist for known benign IP addresses

Question 7

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Accepted Answer

Ensure all data transmissions use TLS 1.2 or higher.. TLS 1.2 or higher is the standard protocol for encrypting data in transit over public networks, ensuring confidentiality and integrity between client and server. It is the most critical control because it directly protects data as it moves across the internet to the cloud, which is the primary risk in a migration scenario.

Answer

Enable server-side encryption for cloud storage.

Answer

Implement data classification labels.

Answer

Use IPsec VPNs for all cloud connections.

Question 8

A small business needs basic protection against malware. Which solution is MOST cost-effective and provides real-time protection?

Accepted Answer

Deploy an endpoint protection platform (EPP). An endpoint protection platform (EPP) provides real-time antivirus, anti-malware, and often additional features like firewall and web protection, offering continuous protection against malware. Option A is wrong because scheduling weekly scans leaves gaps where new threats can infect the system before the next scan. Option C is wrong because a host-based firewall controls network traffic but does not detect or remove malware. Option D is wrong because email encryption only protects the confidentiality of email content and does not prevent malware from being delivered via other vectors such as web downloads or USB drives.

Answer

Schedule weekly antivirus scans

Answer

Install a host-based firewall on each computer

Answer

Use email encryption for all communications

Question 9

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 10

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity