SSCP Security Operations and Administration Practice Test 2 — 15 Questions

Question 1

You work for a hospital that has recently transitioned to an electronic health record (EHR) system. The system stores protected health information (PHI) and must comply with HIPAA. The hospital's security policy requires that all access to PHI be logged and that any unauthorized access be detected promptly. The IT department has implemented logging on the EHR system, but the security team is overwhelmed by the volume of logs and cannot review them in a timely manner. Additionally, there have been incidents where employees accessed patient records without a legitimate need, but these were only discovered months later during random audits. The hospital needs to improve its detection capabilities. Which of the following is the most effective solution?

Accepted Answer

Deploy a Security Information and Event Management (SIEM) system with automated alerting.. A SIEM system aggregates logs from the EHR system and applies correlation rules to detect patterns indicative of unauthorized access, such as an employee viewing records outside their department or during off-hours. It generates real-time alerts, enabling the security team to respond promptly rather than relying on manual log review. This directly addresses the problem of being overwhelmed by log volume and delayed detection.

Answer

Retain logs for a longer period to allow more thorough audits.

Answer

Assign additional staff to manually review logs on a daily basis.

Answer

Increase the verbosity of logging to capture more details.

Question 2

Drag and drop the steps for establishing a VPN using IPsec in tunnel mode into the correct order.

Question 3

Match each network security device to its function.

Question 4

A security administrator needs to ensure that only authorized personnel can reset user passwords in Active Directory. Which of the following is the BEST method to delegate this responsibility without granting unnecessary privileges?

Accepted Answer

Use Delegation of Control wizard to assign the 'Reset user passwords and force password change at next logon' permission.. The Delegation of Control wizard allows granular assignment of specific Active Directory permissions, such as 'Reset user passwords and force password change at next logon', without granting broader administrative rights. This follows the principle of least privilege by limiting the delegated personnel to only the necessary task. Option C is correct because it directly addresses the requirement with a built-in, secure delegation mechanism.

Answer

Place the personnel in the Account Operators group.

Answer

Add the personnel to the Domain Admins group.

Answer

Give the personnel physical access to the domain controller.

Question 5

An organization implements a new security policy requiring all portable storage devices to be encrypted. Which of the following is the MOST effective control to enforce this policy?

Accepted Answer

Configure Group Policy to require BitLocker encryption on removable drives.. Configuring Group Policy to require BitLocker encryption on removable drives is the most effective control because it enforces the encryption policy automatically and centrally across all domain-joined systems, preventing users from bypassing the requirement. Unlike a memo or auditing, Group Policy provides a technical enforcement mechanism that blocks unencrypted removable media from being used, ensuring compliance without relying on user discretion.

Answer

Distribute a memo to all employees about the policy.

Answer

Enable auditing for removable drive usage.

Answer

Enable BitLocker on all laptops.

Question 6

A security analyst is investigating a potential data exfiltration incident. The logs show a large number of outbound DNS queries to a domain that resolves to an IP address in a foreign country. The queries contain encoded strings in the subdomain. Which type of attack is MOST likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses to bypass network security controls. The large volume of outbound queries to a foreign IP, combined with encoded subdomain strings, is the classic signature of data exfiltration via DNS tunneling, as the protocol is often allowed through firewalls.

Answer

DNS poisoning

Answer

DNS amplification attack

Answer

DNS rebinding

Question 7

A system administrator receives a report that a critical server is running low on disk space. After investigation, it is determined that the log files are not being rotated properly. Which of the following is the BEST solution to prevent this issue in the future?

Accepted Answer

Configure log rotation based on size and age.. Option A is correct because implementing log rotation policies ensures logs are archived and space is managed. Option B only adjusts size limit but doesn't rotate. Option C is for applications, not system logs. Option D does not reduce space usage.

Answer

Increase the maximum log file size.

Answer

Redirect logs to a different partition.

Answer

Enable compression on the log folder.

Question 8

An employee reports that they cannot access a shared folder on the network. The security administrator checks the permission and finds that the user is in the correct group, but the 'Deny' entry for a different group is blocking access. What is the MOST likely cause?

Accepted Answer

A Deny ACE is explicitly applied to the user's group.. In Windows NTFS permissions, a Deny Access Control Entry (ACE) explicitly overrides any Allow ACE, regardless of group membership order. Since the user is in the correct group but a Deny entry on a different group blocks access, the most likely cause is that a Deny ACE is explicitly applied to the user's group (or a group the user belongs to), which takes precedence over Allow permissions. This is a core principle of the Windows discretionary access control model.

Answer

The folder is encrypted with EFS.

Answer

The folder has inherited permissions from the parent.

Answer

The user is not a member of the correct group.

Question 9

A security engineer is configuring a firewall to block all inbound traffic except for specific services. Which of the following design principles is being applied?

Accepted Answer

Least privilege. The correct answer is D, Least Privilege, because the security engineer is configuring the firewall to block all inbound traffic except for specific services. This aligns with the principle of least privilege, which dictates that only the minimum necessary access should be granted—in this case, only allowing specific services through while denying everything else by default. The firewall rule set explicitly permits only required ports (e.g., TCP/443 for HTTPS) and implicitly denies all other traffic, ensuring that no unnecessary access is permitted.

Answer

Separation of duties

Answer

Default deny

Answer

Defense in depth

Question 10

A company experiences a security breach where an attacker gained access to the network through a compromised vendor account. Which of the following controls would have BEST prevented this attack?

Accepted Answer

Enable multi-factor authentication for vendor accounts.. Multi-factor authentication (MFA) for vendor accounts is the best preventive control because it adds an additional layer of security beyond just a password. Even if the attacker compromises the vendor's credentials, MFA requires a second factor (e.g., a one-time code from a token or biometric) to authenticate, effectively blocking unauthorized access. This directly addresses the attack vector of credential theft, which was the root cause of the breach.

Answer

Install a network-based intrusion detection system.

Answer

Require vendors to sign an NDA.

Answer

Create a separate VLAN for vendor access.

Question 11

A system administrator needs to securely transfer log files from a Linux server to a central log collector. Which protocol should be used to ensure confidentiality and integrity?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted tunnels for data transfer, ensuring both confidentiality and integrity of log files in transit. It uses strong cryptographic algorithms (e.g., AES, ChaCha20) and HMAC-based integrity checks, making it the correct choice for secure file transfer over untrusted networks.

Answer

SMTP

Answer

NFS

Answer

FTP

Question 12

During a security assessment, a penetration tester discovers that a web application allows users to upload files without proper validation. The tester successfully uploads a PHP web shell. Which control would have MOST effectively prevented this exploitation?

Accepted Answer

Validate file extension and content type on the server side.. Option D is correct because server-side validation of both file extension and content type (e.g., MIME type magic bytes) is the most effective control to prevent uploading executable files like a PHP web shell. Without this validation, an attacker can bypass client-side checks and upload a malicious script that the server will execute. Disabling PHP execution in the upload directory (Option A) is a compensating control but does not prevent the upload itself, and a WAF rule (Option B) can be evaded with obfuscation or encoding.

Answer

Disable PHP execution in the upload directory.

Answer

Implement a WAF rule to block common webshell patterns.

Answer

Enable audit logging for file uploads.

Question 13

Which TWO of the following are key components of an organization's security policy framework? (Choose two.)

Accepted Answer

Standard operating procedures. Standard operating procedures (SOPs) are a key component of an organization's security policy framework because they provide detailed, step-by-step instructions for implementing security controls and responding to incidents. SOPs operationalize high-level policies into actionable tasks, ensuring consistency and compliance across the organization. They are formal documents that define the 'how' of security operations, such as patch management or user account provisioning.

Answer

Intrusion detection system

Answer

Access control lists

Answer

Firewall rules

Question 14

Which THREE of the following are appropriate techniques for securely disposing of magnetic hard disk drives that contain sensitive data? (Choose three.)

Accepted Answer

Shredding. Shredding (B) physically destroys the platters, making data recovery impossible regardless of the magnetic state. This is a definitive disposal method for sensitive data on magnetic hard disk drives.

Answer

Low-level format

Answer

Quick format

Question 15

Which TWO of the following are examples of administrative controls in a security program? (Choose two.)

Accepted Answer

Security policies. Security policies (A) are administrative controls because they define the rules, responsibilities, and expected behaviors for users and administrators, forming the foundation of a security program. Employee background checks (D) are also administrative controls, as they are personnel vetting procedures that reduce insider risk and enforce trust before granting access. Both are non-technical, process-based measures that guide human actions rather than directly blocking or detecting threats.

Answer

Firewall rules

Answer

Locks on server room doors

Answer

Intrusion detection software