SSCP Security Operations and Administration — 10 Questions

Question 1

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

Accepted Answer

The service is using cached credentials that are out of sync with the domain controller.. Service accounts used for automated backups typically run as services that cache their credentials locally. When the password is changed on the domain controller, the cached credentials in the service's logon session become out of sync. The service repeatedly attempts to authenticate with the stale cached password, causing rapid lockout events within a short window.

Answer

The service account's certificate has expired.

Answer

A brute force attack is targeting the service account.

Answer

The account password has expired and needs to be reset.

Question 2

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

Accepted Answer

Implement a break-glass procedure for emergency access.. Option B is correct because a break-glass procedure provides a predefined, auditable method for granting emergency privileged access without requiring real-time manager approval. This balances security with operational continuity, allowing analysts to perform critical changes outside business hours while maintaining accountability through post-event review and logging.

Answer

Extend manager on-call hours to cover all times.

Answer

Remove the approval requirement for privileged access.

Answer

Require analysts to call a manager for approval each time.

Question 3

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

Accepted Answer

Application whitelisting. Application whitelisting is the correct control because it explicitly defines a list of approved software that is allowed to execute on workstations. This prevents unauthorized or malicious software from running, even if it bypasses other defenses, by enforcing a default-deny policy at the operating system level (e.g., via Windows AppLocker or Software Restriction Policies). Unlike antivirus, which relies on signatures to detect known threats, whitelisting blocks unknown or unapproved executables by default.

Answer

Antivirus software

Answer

Patch management

Answer

Host-based firewall

Question 4

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

Accepted Answer

Implement transparent data encryption (TDE) to minimize performance impact.. Transparent Data Encryption (TDE) encrypts data at rest at the storage layer, automatically encrypting data before it is written to disk and decrypting it when read into memory. This minimizes performance impact because encryption/decryption occurs outside the application logic and does not require schema changes, making it the best response to the DBA's concern while still meeting the policy requirement.

Answer

Remove the encryption requirement for databases.

Answer

Encrypt only the backup files, not the live database.

Answer

Use column-level encryption on sensitive columns only.

Question 5

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Accepted Answer

Remove the users from the security group that grants access to the drives.. The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Answer

Delete the user accounts of the affected employees.

Answer

Reconfigure the shared drive to deny access to all users except HR.

Answer

Manually remove each user's permissions on the shared drive.

Question 6

A company wants to ensure that employees use strong passwords. Which policy is most effective?

Accepted Answer

Require a minimum password length of 12 characters.. Option C is correct because password length is the single most important factor in resistance to brute-force and rainbow table attacks. NIST SP 800-63B and industry best practices now recommend a minimum of 12–16 characters, as each additional character exponentially increases the keyspace. While complexity adds some entropy, a long passphrase is far more effective against modern GPU-based cracking than a short, complex password.

Answer

Prohibit password reuse for the last 10 passwords.

Answer

Require password changes every 30 days.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols.

Question 7

A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?

Accepted Answer

Isolate the affected system from the network.. Option D is correct because the immediate priority in a suspected data exfiltration incident is to contain the threat and prevent further data loss. Isolating the affected system from the network stops ongoing communication with the external IP address, preserving the system state for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Notify senior management of the incident.

Answer

Block the external IP address at the firewall.

Answer

Analyze the data transfer logs to determine the scope.

Question 8

An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?

Accepted Answer

The user's new role inherits permissions from multiple roles that collectively grant access.. In RBAC, permissions are assigned to roles, not directly to users. When a user's role changes, the new role may have a different set of permissions. If the new role inherits permissions from multiple roles (e.g., through role hierarchy or composite roles), it can collectively grant access to resources that were previously denied under the old role. This is the most likely cause because the security administrator confirmed the role change, and RBAC systems typically enforce permissions based on the current role membership.

Answer

The user's previous role was not properly removed.

Answer

The RBAC implementation has a bug that grants excessive permissions.

Answer

The user was directly assigned permissions to the resource.

Question 9

Which of the following is the primary purpose of a security awareness program?

Accepted Answer

To teach employees about security best practices and reduce human error.. The primary purpose of a security awareness program is to educate employees on security best practices and reduce human error, which is the leading cause of security incidents. Unlike technical controls, awareness programs target the human element by teaching users to recognize phishing attempts, handle sensitive data properly, and follow secure behaviors. This aligns with the NIST SP 800-50 framework, which defines awareness as a foundational component of an organizational security posture.

Answer

To evaluate the effectiveness of security technologies.

Answer

To enforce security policies through penalties.

Answer

To train employees on advanced technical security skills.

Question 10

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Accepted Answer

To detect errors through independent verification.. Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.

Answer

To reduce the workload on individual employees.

Answer

To simplify training requirements.

Answer

To comply with regulatory requirements.