SSCP Practice Test 9 — 10 Questions

Question 1

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

Accepted Answer

To maintain log integrity. WORM (write-once, read-many) storage prevents any modification or deletion of log data after it is written, directly preserving the integrity of the logs. This ensures that log entries remain an accurate and unaltered record of events, which is critical for forensic investigations, compliance audits, and legal admissibility. The primary security objective is therefore to maintain log integrity, not availability, speed, or cost.

Answer

To ensure log availability

Answer

To improve log review speed

Answer

To reduce storage costs

Question 2

When implementing a digital signature, which key is used to create the signature?

Accepted Answer

Sender's private key. In a digital signature scheme, the sender uses their own private key to create the signature. This ensures non-repudiation because only the sender possesses that private key, and the corresponding public key can verify the signature. The process involves encrypting a hash of the message with the sender's private key, as specified in standards like PKCS#1 and RFC 8017.

Answer

Receiver's private key

Answer

Sender's public key

Answer

Receiver's public key

Question 3

Which THREE of the following are common types of malware?

Accepted Answer

Trojan horse. A Trojan horse (A) is a correct answer because it is a classic malware category: it disguises itself as legitimate software to trick a user into executing it, then performs malicious actions such as backdoor installation or data theft. A virus (B) is correct because it is self-replicating malicious code that attaches itself to a host file or boot sector and spreads when the infected host is executed. A worm (C) is correct because it is standalone self-replicating malware that spreads across networks (e.g., via SMB or email) without needing a host file or user action. By contrast, a firewall (D) is a network security control that filters traffic based on rules, and a patch (E) is a software update that remediates vulnerabilities — neither is malware, so they are not correct.

Answer

Firewall

Answer

Patch

Question 4

A small accounting firm wants to ensure that if a laptop is lost, the data on its full-disk-encrypted drive cannot be recovered by an attacker who removes the drive and mounts it elsewhere. Which additional control is MOST important to meet this goal?

Accepted Answer

Configure a strong pre-boot authentication password or PIN that is not stored on the disk.. Encryption at rest only protects a lost device when the key is protected by a secret the attacker does not possess. Requiring pre-boot authentication with a PIN or password ensures the volume master key cannot be unwrapped offline, whereas screen locks, EDR, and backups operate on different threat models and cannot prevent offline decryption of a removed drive.

Answer

Install endpoint detection and response software on the laptop.

Answer

Enable a screen saver that locks the console after ten minutes of inactivity.

Answer

Enforce automatic backup of user documents to a cloud file-sharing service.

Question 5

A security analyst is evaluating encryption modes for a new system that requires authenticated encryption to ensure both confidentiality and integrity of data in transit. Which AES mode should the analyst recommend?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides authenticated encryption, combining the confidentiality of CTR mode with integrity verification via a Galois field authentication tag. This makes it ideal for securing data in transit, as it ensures both privacy and tamper detection in a single, efficient operation.

Answer

ECB

Answer

CBC

Answer

CTR

Question 6

After an incident, the team identifies that the incident was caused by a missing security patch. Which of the following is the MOST effective way to prevent recurrence?

Accepted Answer

Implement a patch management policy. A missing security patch indicates a failure in the vulnerability management lifecycle. Implementing a patch management policy ensures that patches are systematically identified, tested, and deployed, directly addressing the root cause. This is the most effective preventive measure because it establishes a recurring process to close known vulnerabilities before they can be exploited.

Answer

Conduct phishing simulations

Answer

Increase network monitoring

Answer

Update the incident response plan

Question 7

A security administrator is implementing an access control system that uses sensitivity labels on subjects and objects. The policy dictates that a subject can only read objects with a label equal to or lower than the subject's clearance, and can only write to objects with a label equal to or higher than the subject's clearance. Which access control model and principle is being enforced?

Accepted Answer

MAC with Bell-LaPadula model. The Bell-LaPadula model is a mandatory access control (MAC) model focused on confidentiality. Its two core rules are the Simple Security Property (no read up: a subject can only read objects at or below its clearance) and the Star Property (no write down: a subject can only write to objects at or above its clearance). The scenario describes exactly these two rules, so MAC with Bell-LaPadula is the correct answer.

Answer

MAC with Biba model

Answer

DAC with owner-based permissions

Answer

RBAC with role hierarchy

Question 8

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

Accepted Answer

Group policy to disable USB ports or restrict autorun. The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Answer

Block the malware's command-and-control IP at the firewall

Answer

Disable the user's account and force a password reset

Answer

Reimage the infected system immediately

Question 9

An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?

Accepted Answer

Network Access Control (NAC) with 802.1X. Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Firewall rules

Question 10

A system administrator receives a report that a critical server is running low on disk space. After investigation, it is determined that the log files are not being rotated properly. Which of the following is the BEST solution to prevent this issue in the future?

Accepted Answer

Configure log rotation based on size and age.. Configuring log rotation based on both size and age is the best solution because it directly addresses the root cause — logs growing unbounded — by automatically archiving, compressing, or deleting old logs once they hit a size threshold or age limit. Tools like logrotate on Linux support directives such as 'size 100M', 'daily', 'rotate 7', and 'compress', giving deterministic control over disk consumption. This is a preventive, repeatable control rather than a one-time workaround.

Answer

Increase the maximum log file size.

Answer

Redirect logs to a different partition.

Answer

Enable compression on the log folder.