SSCP Hard Questions — 25 Difficult Questions

Question 1

During a security assessment, an analyst finds that multiple snapshots of a critical virtual machine are stored on the hypervisor host. Some snapshots are several months old. Which risk is MOST likely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reintroduction of unpatched vulnerabilities. Snapshots may contain outdated, unpatched software, reintroducing vulnerabilities when reverted.

Answer

VM escape via snapshot file corruption

Answer

Unauthorized access to snapshot data

Answer

Hypervisor memory exhaustion

Question 2

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Creating a cryptographic hash of the memory dump immediately after capture is the most important step to ensure evidence integrity, as it provides a unique fingerprint to verify that the data has not been altered. Write blockers are used for storage media, not memory captures. Storing the dump on the same server risks modification or loss. Running antivirus is irrelevant and could alter the dump.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 3

A company uses a SIEM to monitor security events. Recently, they are experiencing false positives from a new IDS rule. Which approach would best reduce false positives while maintaining detection?

Accepted Answer

Adjust the rule threshold.. Adjusting the rule threshold (Option D) is the best approach because it fine-tunes the sensitivity of the IDS rule to reduce false positives without completely disabling detection. By raising the threshold (e.g., increasing the number of matching packets or the time window), the SIEM will only generate an alert when the rule's criteria are met more persistently, filtering out noise while still capturing genuine threats. This maintains the rule's detection capability for actual attacks that exceed the adjusted threshold.

Answer

Disable the rule.

Answer

Increase the log review frequency.

Answer

Whitelist false positive sources.

Question 4

A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?

Accepted Answer

Role-Based Access Control (RBAC) with constraints. ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.

Answer

Discretionary Access Control (DAC)

Answer

Non-Discretionary Access Control

Answer

Mandatory Access Control (MAC)

Question 5

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. Failure to test patches in a staging environment can lead to instability when deployed to production.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 6

Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?

Accepted Answer

Only hosts in the 10.0.0.0/8 range. The firewall rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.

Answer

No hosts can connect to the database

Answer

Both internet hosts and internal hosts

Answer

Any host on the internet

Question 7

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer

Question 8

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 9

A security analyst is investigating an account compromise. The organization uses Kerberos for single sign-on. Which TWO of the following would help in tracking the source of the compromise?

Accepted Answer

Authentication service (AS) logs with timestamps and IP addresses. Kerberos logs ticket requests and TGT usage, which can trace authentication events. TGT expiration and session key details are part of the protocol but less directly useful for source identification.

Answer

Password hash history

Answer

Ticket-Granting Ticket (TGT) expiration time

Answer

Service ticket session keys

Question 10

A company uses Infrastructure as a Service (IaaS) for its production workloads. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In IaaS, the provider secures the physical infrastructure and hypervisor, while the customer secures the operating system, applications, and data. The customer is responsible for OS patch management. The provider handles physical security, hypervisor patching, and network infrastructure.

Answer

Patching the hypervisor

Answer

Physical security of data centers

Answer

Securing the network infrastructure

Question 11

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Accepted Answer

Perform memory forensics before disconnecting. Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Answer

Block the C2 IP at the perimeter

Answer

Shut down the host

Answer

Disconnect the host from the network immediately

Question 12

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 13

An organization is implementing a federated identity system to allow employees to access a partner's cloud application using their corporate credentials. The solution must support single sign-on and use XML-based assertions. Which technology should be used?

Accepted Answer

SAML. SAML uses XML-based assertions to exchange authentication and authorization data between an identity provider and a service provider.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 14

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 15

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Accepted Answer

Clients will receive a certificate warning or be unable to connect.. When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.

Answer

The server will automatically obtain a new certificate.

Answer

Clients will connect but with reduced cipher strength.

Answer

Clients will be able to connect without any warning.

Question 16

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 17

A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)

Accepted Answer

DES. DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.

Answer

RSA-2048

Answer

AES-256

Question 18

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

Accepted Answer

Isolate the domain controller from the network.. The domain controller (DC) is showing signs of active compromise: unusual outbound traffic on port 443 (likely C2 communication) and a failed backup due to a volume shadow copy error (indicating attempted destruction of forensic evidence). Isolating the DC first stops the attacker's command-and-control channel and prevents lateral movement, which is the highest priority in incident response. Running a scan or restoring other systems before containment risks allowing the attacker to spread or destroy more data.

Answer

Run a full malware scan on the domain controller.

Answer

Restore the file server from last night's backup.

Answer

Disable the domain controller's antivirus to improve performance.

Question 19

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 20

A financial firm has deployed network-based IDS/IPS sensors at key points to detect and prevent intrusions. During a recent security audit, it was discovered that an attacker exfiltrated sensitive data using DNS over HTTPS (DoH) queries. The IDS/IPS did not generate any alerts. The firm's network policy allows all outbound HTTPS traffic to any destination. To prevent such exfiltration in the future, what is the most effective corrective action?

Accepted Answer

Deploy TLS termination at the network perimeter. Deploying TLS termination at the network perimeter allows the organization to decrypt inbound and outbound HTTPS traffic, inspect the plaintext content, and re-encrypt it before forwarding. This enables the IDS/IPS to detect malicious payloads, such as DNS over HTTPS (DoH) queries, that would otherwise be hidden inside encrypted tunnels. Since the firm's policy allows all outbound HTTPS, TLS termination is the most effective way to regain visibility into that traffic without blocking it outright.

Answer

Enable deep packet inspection on all encrypted traffic

Answer

Implement a DNS sinkhole and block non-corporate DNS servers

Answer

Configure the IDS/IPS to inspect DNS traffic on standard port 53 only