SSCP Security Operations and Administration Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. What does this event indicate?

Accepted Answer

A failed logon attempt for the Administrator account from the network.. The event shows a logon failure with a status code indicating the account is disabled or locked, but the exhibit specifically references a network logon (logon type 3) for the Administrator account. Option D is correct because the failure is from the network, not interactive or locked out, and the event ID 4625 with logon type 3 indicates a failed network logon attempt.

Answer

A successful logon for the Administrator account.

Answer

An interactive logon failure for the Administrator account.

Answer

The Administrator account is locked out.

Question 2

Refer to the exhibit. An administrator implements this firewall rule. What is the intended effect?

Accepted Answer

It prevents this computer from initiating SMB connections to other computers.. The firewall rule shown is an outbound rule that blocks TCP port 445, which is used by SMB (Server Message Block). By blocking outbound traffic on this port, the computer is prevented from initiating SMB connections to other computers, while still allowing inbound SMB connections. This is a common security measure to prevent a compromised machine from spreading malware or accessing file shares on other systems.

Answer

It blocks all inbound and outbound traffic on port 445.

Answer

It prevents inbound SMB connections from other domain computers.

Answer

It applies to all network profiles (Domain, Private, Public).

Question 3

Refer to the exhibit. A systems administrator configures this Group Policy setting. What is the direct consequence?

Accepted Answer

Members of Backup Operators cannot connect to the server using Remote Desktop.. Option C is correct because the 'Deny log on through Remote Desktop Services' policy explicitly prevents the specified group from using RDP. Option A is wrong because the policy denies, not allows. Option B is wrong because it affects only Remote Desktop, not console. Option D is wrong because it does not affect other remote access methods like SSH unless specifically configured.

Answer

Members of Backup Operators are prohibited from local console logon.

Answer

Members of Backup Operators can connect via Remote Desktop.

Answer

Members of Backup Operators are prevented from using any remote access method.

Question 4

A security administrator notices that a critical server's event log shows repeated failed login attempts from an internal IP address that normally does not generate any traffic. The administrator immediately blocks the IP at the firewall and resets the account password. However, the incident response team later determines that the attacker had already gained access to the server. What is the MOST likely reason the administrator's actions were insufficient?

Accepted Answer

The administrator did not isolate the server from the network.. Option B is correct because isolating the server would have prevented further access by the attacker and preserved evidence. Option A is wrong because preserving logs is important but not the primary reason the actions were insufficient. Option C is wrong because a full system scan is a later step after containment. Option D is wrong because notifying the data owner is an administrative step that does not directly address the security breach.

Answer

The administrator did not preserve the log evidence for forensic analysis.

Answer

The administrator neglected to perform a full system scan for malware.

Answer

The administrator failed to notify the data owner about the incident.

Question 5

A company implements a policy that requires all employees to change their passwords every 60 days. Which of the following is the PRIMARY security benefit of this requirement?

Accepted Answer

Limiting the window of opportunity for a compromised password.. Password expiration policies limit the exposure window for compromised credentials. If an attacker obtains a password, the 60-day rotation ensures that the stolen credential becomes invalid after that period, reducing the time an attacker can maintain unauthorized access. This is a fundamental security control to mitigate the risk of undetected credential theft.

Answer

Ensuring compliance with data privacy laws.

Answer

Reducing the risk of password reuse across multiple sites.

Answer

Simplifying the account lockout process.

Question 6

An organization uses role-based access control (RBAC). After a merger, a user account from the acquired company is migrated into the parent company's domain. The user is assigned to multiple roles, but is unable to access a critical application that requires a specific role. The administrator verified that the user's account is enabled and the application server is reachable. What is the MOST likely cause?

Accepted Answer

The user's account was not assigned the required role.. In RBAC, access is granted based on the roles explicitly assigned to a user account. Since the administrator confirmed the account is enabled and the application server is reachable, the most likely cause is that the required role was not assigned to the migrated user. Without that role assignment, the user lacks the necessary permissions to access the critical application, regardless of other roles held.

Answer

The user's group memberships are conflicting with the required role.

Answer

There is a firewall rule blocking traffic from the user's IP range.

Answer

The application's session timeout is set too low.

Question 7

A security administrator is reviewing backup procedures for a database server. The current backup policy mandates a full backup every Sunday and differential backups Tuesday through Friday. On Wednesday, a failure occurs, and the database is lost. The last successful full backup was completed on Sunday, and the last differential backup was completed on Tuesday. How many backup sets are needed to restore the database to its state as of Tuesday?

Accepted Answer

2. To restore the database to its state as of Tuesday, you need the last full backup (Sunday) and the last differential backup (Tuesday). A differential backup contains all changes since the last full backup, so applying the Tuesday differential to the Sunday full backup recovers all data up to Tuesday. The Wednesday failure does not affect the Tuesday state, and no other backups are required.

Answer

4

Answer

3

Answer

1

Question 8

During a security audit, it is discovered that a system administrator shared their personal credentials with a colleague to troubleshoot an issue after hours. This violates the company's policy regarding password sharing. Which control would BEST prevent this type of incident in the future?

Accepted Answer

Deploy a privileged access management (PAM) solution.. Option D is correct because a Privileged Access Management (PAM) solution provides temporary, audited access without sharing permanent credentials. Option A is wrong because a two-person rule is for dual control, not sharing prevention. Option B is wrong while MFA adds a layer, it does not prevent sharing of the first factor. Option C is wrong because password complexity does not deter sharing. Option E is wrong because training is important but less effective than a technical control.

Answer

Implement a two-person rule for administrative actions.

Answer

Enforce a stricter password complexity policy.

Answer

Require multifactor authentication for all systems.

Question 9

An organization wants to ensure that only authorized devices can connect to its internal network. Which of the following should be implemented?

Accepted Answer

Network access control (NAC). Network Access Control (NAC) is the correct choice because it enforces security policy by evaluating the identity, posture, and compliance of devices before granting network access. NAC solutions (e.g., Cisco ISE, Aruba ClearPass) can authenticate devices via 802.1X, check for antivirus updates or patch levels, and quarantine non-compliant endpoints, ensuring only authorized and healthy devices connect to the internal network.

Answer

Intrusion detection system

Answer

Port security on switches

Answer

Virtual private network

Question 10

A security analyst notices that an employee's account has been sending large amounts of data to an external IP address during non-business hours. The analyst suspects the employee's credentials have been compromised. What is the FIRST step the analyst should take according to incident response procedures?

Accepted Answer

Disable the employee's user account.. Option A is correct because disabling the account immediately stops the malicious activity. Option B is wrong; blocking the IP may not stop the attacker if they have other methods. Option C is wrong; informing the manager is important but not the first action. Option D is wrong; contacting law enforcement is premature.

Answer

Block the external IP address at the firewall.

Answer

Contact law enforcement.

Answer

Inform the employee's manager.

Question 11

A company's VPN logs show that a user's account authenticated from two different geographic locations within a span of 10 minutes. The distances between locations make physical travel impossible. The security team investigates and finds that the user's password is complex and not shared. What is the MOST likely explanation?

Accepted Answer

The user's session token was stolen and used by an attacker.. Option D is correct because the session token was likely stolen and reused from a different location. Option A is wrong; if the user used a VPN, their VPN connection would show one IP. Option B is wrong; a configuration error would affect multiple users. Option C is wrong; multiple people using the account would imply password sharing, which is denied.

Answer

The VPN server has a configuration error causing incorrect location logging.

Answer

The user's account is being used by multiple people with permission.

Answer

The user is using a VPN service to mask their true location.

Question 12

A security administrator needs to set file permissions on a shared folder so that only members of the 'Finance' group can read and write to it. All existing permissions should be removed. Which command should the administrator use?

Accepted Answer

icacls shared_folder /grant Finance:(M) /inheritance:r. Option A is correct because 'icacls shared_folder /grant Finance:(M) /inheritance:r' grants Modify (read+write) and removes inheritance. Option B is wrong because 'cacls' is deprecated and the syntax is incorrect. Option C is wrong because Full Control (F) grants more than read/write. Option D is wrong because (RW) is not a valid icacls permission mask.

Answer

cacls shared_folder /E /P Finance:RW

Answer

icacls shared_folder /grant Finance:(F) /inheritance:r

Answer

icacls shared_folder /grant Finance:(RW)

Question 13

A security administrator is implementing a change management process. Which TWO of the following are essential components of a change management policy? (Choose two.)

Accepted Answer

A rollback plan. Options C and D are correct because CAB approval ensures proper review and a rollback plan provides a safety net. Option A is not essential for all changes; emergency procedures are a subset. Option B is a specific implementation, not a policy component. Option E is part of vulnerability management, not change management.

Answer

Vulnerability scanning results

Answer

Emergency change procedures

Answer

Automated patch deployment schedule

Question 14

A security operations team is developing an incident response plan. Which TWO steps are part of the 'containment, eradication, and recovery' phase? (Choose two.)

Accepted Answer

Restoring systems from known good backups. Options A and B are correct because isolation is containment and restoration is recovery. Option C is post-incident. Option D is part of identification/analysis. Option E is part of preparation and identification.

Answer

Conducting a lessons learned meeting

Answer

Identifying the root cause of the incident

Answer

Preserving forensic evidence

Question 15

A security administrator is tasked with managing user access. Which THREE of the following are principles of least privilege? (Choose three.)

Accepted Answer

Grant users the minimum rights needed to perform their job.. Option C is correct because the principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. It is a foundational access control concept enforced through role-based access control (RBAC) or attribute-based access control (ABAC) policies.

Answer

Implement mandatory access control.

Answer

Require manager approval for privilege escalation.

SSCP Security Operations and Administration Practice Test 3 — 15 Questions

Exhibit

SSCP Security Operations and Administration Practice Test 3 — 15 Questions

Exhibit