SSCP Hard Questions — 25 Difficult Questions

Question 1

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

Accepted Answer

RAM, network connections, running processes, hard drive image. Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Answer

Hard drive image, network connections, running processes, RAM

Answer

Running processes, RAM, hard drive image, network connections

Answer

Network connections, hard drive image, RAM, running processes

Question 2

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

Accepted Answer

Removing the backdoor executable and associated persistence mechanisms. In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging. Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Answer

Resetting all user passwords

Answer

Reimaging all affected systems from a known-good backup

Answer

Conducting security awareness training for all employees

Question 3

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Accepted Answer

A warm site has environmental controls (power, cooling) already in place.. Option B is correct because a warm site, unlike a cold site that may be an empty shell or unpowered space, already has environmental infrastructure such as power distribution, UPS, HVAC cooling, and raised flooring operational and ready to support equipment. Option C is correct because a warm site comes with servers, storage, and network gear already installed and configured (though often powered down or minimally configured), whereas a cold site typically has no hardware in place. Option E is correct because a defining trait of a warm site is that current data must be restored from backups onto the pre-installed systems before the site can take over, since it lacks live replication. Option A is not marked correct because a warm site usually takes hours to days to become operational, not "within hours" as a distinguishing guarantee, and that timing is more characteristic of a hot site. Option D is not marked correct because live data replication is a hallmark of a hot site, not a warm site, which relies on backup restoration.

Answer

A warm site is typically ready to operate within hours.

Answer

A warm site has live data replication from the primary site.

Question 4

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

Accepted Answer

Prioritize patching via the change management process. Even though the server is low criticality, a CVSS score of 9.8 with active exploitation represents an urgent risk that must be addressed. The administrator should prioritize patching through the change management process to ensure proper approval, testing, and documentation while still expediting the fix.

Answer

Apply the patch immediately without change management

Answer

Ignore the patch because the server is low criticality

Answer

Wait for the next scheduled patch cycle

Question 5

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 6

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. A patch management process must include testing patches in a staging environment before production deployment to validate compatibility and avoid breaking critical systems. Without staging validation, patches can introduce regressions, incompatibilities, or outages in production. This is a critical gap because it removes the safety net that catches patch-related issues before they impact live operations.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 7

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Accepted Answer

Document the deviation and accept the stronger configuration. Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

Answer

Report the non-compliance to management for remediation

Answer

Implement Level 2 benchmarks to be consistent

Answer

Immediately revert to Level 1 settings to ensure compliance

Question 8

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. CVSS score quantifies the technical severity of a vulnerability (base, temporal, and environmental metrics), while asset criticality reflects the business impact if that asset is compromised. Combining these two factors ensures patches that are both highly exploitable and protect the most valuable systems are applied first, which is the standard risk-based prioritization approach in patch management frameworks like those from NIST and CIS.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 9

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 10

An organization uses mandatory access control (MAC) with the Bell-LaPadula model. A subject has a clearance of 'Secret' and an object has a classification of 'Top Secret'. What is the result if the subject attempts to read the object?

Accepted Answer

Read denied. In the Bell-LaPadula model, the Simple Security Property (no read up) prohibits a subject from reading an object with a higher classification. Since the subject has a clearance of 'Secret' and the object is classified as 'Top Secret', the read attempt is denied. This enforces mandatory access control (MAC) by preventing information flow from higher to lower security levels.

Answer

Write denied

Answer

Write allowed

Answer

Read allowed

Question 11

A security administrator is reviewing audit logs and notices that a user account with administrative privileges was used to access a sensitive file outside of normal business hours. The administrator suspects the account may have been compromised. Which of the following should the administrator do FIRST?

Accepted Answer

Disable the user account immediately.. In incident response, containment is the immediate priority to stop further damage. Disabling the compromised account prevents the attacker from continuing to use it. Other actions like investigation, notification, or password resets are important but secondary to stopping the active threat.

Answer

Reset the user's password.

Answer

Notify law enforcement.

Answer

Review the file's contents to determine sensitivity.

Question 12

During a physical security audit, it is discovered that employees often prop open the mantrap door to allow easier access. What is the BEST control to address this?

Accepted Answer

Add a time-delay alarm that triggers if the door is open too long. A time-delay alarm is the best control because it directly addresses the root cause—employees propping the door open—by alerting security or triggering a response if the door remains open beyond a preset interval (e.g., 10–30 seconds). This maintains the integrity of the mantrap, which is designed to prevent tailgating and unauthorized access by ensuring only one person enters at a time. Unlike passive measures, the alarm provides immediate feedback and deterrence against the unsafe behavior.

Answer

Implement a clean desk policy

Answer

Install a CCTV camera to monitor the mantrap

Answer

Use biometric readers on both doors

Question 13

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 14

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by removing static RSA and static Diffie-Hellman key exchange, requiring ephemeral key exchange (ECDHE) for every session. This means a compromised long-term private key cannot decrypt previously recorded sessions, which is a major security improvement over TLS 1.2 where static RSA was optional but allowed. This is codified in RFC 8446.

Answer

Reduced cipher suite options including CBC mode

Answer

Use of RC4 cipher

Answer

Support for static RSA key exchange

Question 15

A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?

Accepted Answer

Create an exception in the detection rule.. Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.

Answer

Quarantine the endpoint anyway.

Answer

Escalate to management.

Answer

Delete the alert from the SIEM.

Question 16

A company runs containerized applications in a Kubernetes cluster. They need to ensure that containers run with the least privilege and cannot escalate privileges. Which configuration change is MOST effective?

Accepted Answer

Drop all Linux capabilities from the container. Dropping all Linux capabilities is the most effective because capabilities are the granular privileges that allow a process to perform privileged operations (e.g., CAP_NET_ADMIN, CAP_SYS_ADMIN). Even a non-root user can escalate privileges if it retains capabilities. By dropping all capabilities, the container loses the ability to perform any privileged action, directly enforcing least privilege and preventing privilege escalation. This is a fundamental Kubernetes securityContext setting that aligns with the principle of least privilege.

Answer

Set the container to run as non-root user

Answer

Mount the container root filesystem as read-only

Answer

Enable SELinux enforcing mode on the host

Question 17

A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?

Accepted Answer

Preserve evidence for potential investigation. Option C is correct because immediately disabling the account is a mandatory first step in deprovisioning: it revokes the user's ability to authenticate and access resources right away, preventing any further unauthorized activity while the rest of the offboarding process is completed. Option A is correct because preserving evidence (such as mailbox contents, logs, and file access records) is required during offboarding so that any potential investigation, legal hold, or forensic review can proceed; destroying data prematurely could violate retention or e-discovery obligations. Option B is not appropriate because setting a default password leaves the account usable and creates a known credential that could be exploited; accounts should be disabled rather than given a predictable password. Option D is not mandatory because notification to the departing user is a courtesy/HR step, not a security control, and in hostile terminations notification may be deliberately withheld. Option E is not mandatory because immediately deleting the account and all associated data can destroy evidence and break retention requirements; disabling and later deleting after retention periods is the correct approach.

Answer

Change the user's password to a default

Answer

Notify the user that their account will be removed

Answer

Delete the account and all associated data

Question 18

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. Option E (Change request submission) is correct because the change management process formally begins when a Request for Change (RFC) is submitted and logged, often via a ticketing or ITSM system, so the change can be reviewed and authorized. Option D (Impact assessment) is correct because after the RFC is raised, the change advisory board or reviewers evaluate risk, scope, affected systems, and potential downtime to decide whether the change should be approved. Option A (Post-implementation review) is correct because after the change is deployed, the process includes verifying that it achieved its objective, did not cause unintended issues, and capturing lessons learned for future changes. Option B (Vulnerability scanning) is not a change management step; it is a security assessment activity typically performed under vulnerability management, even though its findings may trigger an RFC. Option C (Baseline configuration update) is not a step in the change management process itself; updating the configuration baseline is a configuration management activity that occurs after an approved change is implemented.

Answer

Vulnerability scanning

Answer

Baseline configuration update

Question 19

A helpdesk ticket reports that users can browse internal web servers but cannot access external websites. The IT team checks firewall logs and sees dropped packets with the DF flag set. What is the most likely cause?

Accepted Answer

A firewall is blocking ICMP 'fragmentation needed' messages, preventing Path MTU Discovery.. The DF (Don't Fragment) flag being set in dropped packets indicates that packets are too large to traverse a network path without fragmentation, but the firewall is blocking the ICMP 'fragmentation needed' (Type 3, Code 4) messages. Without these ICMP messages, Path MTU Discovery (PMTUD) fails, causing the sending host to believe the packet was delivered when it was actually dropped. This prevents external websites from loading while internal servers (likely on the same MTU-friendly network) remain accessible.

Answer

The firewall is blocking outbound TCP port 80 and 443.

Answer

The DNS server is not resolving external domain names.

Answer

The switch port connecting the firewall is set to the wrong VLAN.

Question 20

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the memory dump immediately after capture establishes a verifiable baseline for integrity. Any subsequent modification — accidental or intentional — will change the hash, allowing the analyst to prove the evidence was not tampered with. This chain-of-custody practice is fundamental to forensic admissibility.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file