SSCP Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. What security issue is present in this firewall policy?

Accepted Answer

The default deny rule is missing. The exhibit shows a firewall policy with explicit permit rules but no explicit deny all rule at the bottom. Without a default deny rule, any traffic not matching an explicit permit may be implicitly allowed or handled unpredictably depending on the firewall platform, violating the security principle of least privilege. A proper firewall policy must end with an explicit deny all to block all unauthorized traffic.

Answer

Web traffic is allowed from any source

Answer

The firewall is allowing all traffic on port 443

Answer

The destination network is too broad

Answer

SSH is blocked for a specific subnet

Question 2

Refer to the exhibit. Which of the following is most likely a web browsing session?

Accepted Answer

Both A and C. Option D is correct because both A and C represent typical web browsing sessions: A uses HTTP on port 80, and C uses DNS on port 53, which is essential for resolving domain names before a web request can be made. Web browsing inherently involves DNS queries to translate hostnames to IP addresses, making both sessions part of the browsing activity.

Answer

192.168.1.100:49152 to 203.0.113.10:80

Answer

192.168.1.100:49154 to 74.125.224.72:443

Answer

192.168.1.100:49153 to 192.168.1.1:53

Question 3

Which TWO of the following are key components of a risk assessment process?

Accepted Answer

Asset identification. Asset identification (B) is a key component because you cannot assess risk without knowing what assets need protection. Threat identification (E) is also essential because risk is defined as the likelihood of a threat exploiting a vulnerability to cause harm to an asset. Together, asset and threat identification form the foundational inputs for calculating risk.

Answer

Control testing

Answer

Vulnerability identification

Answer

Risk treatment selection

Question 4

A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?

Accepted Answer

Assess the exploitability and impact to determine remediation priority. Option B is correct because the first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.

Answer

Apply the patch immediately to reduce risk

Answer

Re-scan the server to confirm the vulnerability

Answer

Ignore the vulnerability because the patch is available

Question 5

During a vulnerability scan, a critical vulnerability is found on a publicly accessible web server. The server hosts a legacy application that cannot be patched immediately. What should the risk manager do first?

Accepted Answer

Implement compensating controls.. Option A is correct because when a critical vulnerability cannot be patched immediately, implementing compensating controls is the appropriate first step to reduce risk while maintaining business operations. Compensating controls, such as a web application firewall (WAF) with custom rules to block exploit attempts or network segmentation with strict access control lists (ACLs), provide a temporary mitigation layer. This aligns with the risk management principle of reducing risk to an acceptable level without disrupting critical services.

Answer

Remove the server from the network.

Answer

Notify the application owner.

Answer

Accept the risk.

Question 6

A security team uses a risk matrix with likelihood (Low, Medium, High) and impact (Low, Medium, High). A vulnerability scan finds a buffer overflow in a customer-facing web application. The application is not critical but has high availability requirements. The likelihood of exploitation is considered Medium due to internal network segmentation. What is the risk level?

Accepted Answer

High. The risk level is High because the likelihood is Medium (due to internal network segmentation reducing but not eliminating the chance of exploitation) and the impact is High (the application has high availability requirements, so a buffer overflow could cause a denial of service or code execution, severely affecting availability). In a standard 3x3 risk matrix, Medium likelihood combined with High impact yields a High risk rating.

Answer

Medium

Answer

Extreme

Answer

Low

Question 7

Which TWO of the following are key components of the risk identification process?

Accepted Answer

Identifying assets and their value. Option A is correct because identifying assets and their value is a foundational step in the risk identification process. Without knowing what assets exist and their relative importance, you cannot determine which threats and vulnerabilities pose the greatest risk. This step ensures that risk assessment efforts are focused on the most critical resources.

Answer

Prioritizing risks based on impact

Answer

Selecting risk treatment options

Answer

Calculating the annualized loss expectancy

Question 8

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Recovery Time Objective (RTO) is a key component of a Business Impact Analysis (BIA) because it defines the maximum acceptable downtime for a business process or system after a disruption. The BIA identifies critical functions and their dependencies, and RTO is derived from the financial and operational impact of downtime, directly informing recovery strategy and resource allocation.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

Question 9

A company implements a policy that requires all employees to change their passwords every 60 days. Which of the following is the PRIMARY security benefit of this requirement?

Accepted Answer

Limiting the window of opportunity for a compromised password.. Password expiration policies limit the exposure window for compromised credentials. If an attacker obtains a password, the 60-day rotation ensures that the stolen credential becomes invalid after that period, reducing the time an attacker can maintain unauthorized access. This is a fundamental security control to mitigate the risk of undetected credential theft.

Answer

Ensuring compliance with data privacy laws.

Answer

Reducing the risk of password reuse across multiple sites.

Answer

Simplifying the account lockout process.

Question 10

A security awareness program is being developed. Which topic is MOST critical for all employees to understand to reduce the risk of social engineering?

Accepted Answer

How to recognize and report phishing attempts and other suspicious communications. Social engineering attacks, such as phishing, vishing, and smishing, exploit human psychology rather than technical vulnerabilities. The most critical defense for all employees is the ability to recognize indicators of these attacks (e.g., spoofed sender addresses, urgent language, mismatched URLs) and follow the proper reporting procedure to enable rapid incident response. Without this skill, even the strongest technical controls can be bypassed by a single successful click.

Answer

The risks of posting on social media

Answer

The proper use of mobile devices

Answer

How to create strong passwords

SSCP Practice Test 9 — 10 Questions

Exhibit

SSCP Practice Test 9 — 10 Questions

Exhibit