SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews the log and determines that the system was under a brute force attack. However, the analyst notices that the attack stopped after 5 minutes, and the IP address was not blocked. Which of the following is the MOST likely reason the attack stopped?

Accepted Answer

The SSH server's MaxAuthTries limit was exceeded.. The SSH server's MaxAuthTries limit (default 6 in OpenSSH) causes the server to terminate the connection after a threshold of failed authentication attempts. This stops the attack on that specific TCP session, but does not block the IP address, which explains why the attack ceased after 5 minutes without any persistent block.

Answer

The system's account lockout policy prevented further attempts.

Answer

The attacker achieved successful login.

Answer

The system's firewall dropped the traffic.

Question 2

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Accepted Answer

The ACCEPT rule matches before the DROP rule.. C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.

Answer

The DROP rule does not apply to SSH.

Answer

The DROP rule is misconfigured with wrong source.

Answer

The default policy allows traffic, overriding the DROP rule.

Question 3

Refer to the exhibit. A security administrator notices repeated events with the same failure reason for the Administrator account. What is the MOST likely type of attack?

Accepted Answer

Brute force. Option A is correct because repeated failed logins for a single account indicate a brute force attack. Option B is wrong; password spraying uses many accounts with common passwords. Option C is wrong; phishing involves tricking users, not repeated login attempts. Option D is wrong; DoS aims to disrupt service, not gain access.

Answer

Spear phishing

Answer

Password spraying

Answer

Denial of service

Question 4

A system administrator needs to grant a temporary contractor access to a specific shared folder for two weeks. Which access control approach is most appropriate?

Accepted Answer

Create a temporary user account with an expiration date and grant NTFS permissions. Option B is correct because creating a temporary user account with an expiration date directly addresses the need for time-limited access. Granting NTFS permissions on the specific shared folder provides granular, least-privilege access control. This approach ensures the account is automatically disabled after two weeks, reducing administrative overhead and security risk.

Answer

Create a new role with access to the folder and assign the contractor to that role

Answer

Use mandatory access control (MAC) to enforce a security label for the contractor

Answer

Configure the folder with discretionary access control (DAC) and let the contractor request access

Question 5

An organization's help desk receives multiple reports of employees unable to access a critical internal application. The IT team confirms the application server is running. What is the FIRST step in the incident response process?

Accepted Answer

Verify the reports and confirm the scope of the issue. Option A is correct because the initial step in incident response is to identify and verify the incident. Option B is wrong because containment comes after identification. Option C is wrong because eradication follows containment. Option D is wrong because recovery is performed after eradication.

Answer

Restore the application from the latest backup

Answer

Remove any malicious software from the server

Answer

Isolate the affected systems from the network

Question 6

A security administrator is implementing change management for a critical financial system. Which of the following is the MOST important control to prevent unauthorized changes?

Accepted Answer

Enforce a formal approval process via a change advisory board. Option D is correct because a formal approval process ensures that changes are reviewed and authorized before implementation. Option A is wrong because testing in a staging environment, while important, does not prevent unauthorized changes. Option B is wrong because backout plans are for recovery, not prevention. Option C is wrong because notification to users is a communication step, not a preventive control.

Answer

Implement a staging environment to test all changes

Answer

Notify all users before the change window

Answer

Require a documented backout plan for every change

Question 7

An IT auditor reports that firewall logs are not being reviewed regularly. Which control should be implemented to address this finding?

Accepted Answer

Deploy a Security Information and Event Management (SIEM) system. Option B is correct because automated log analysis tools can alert on suspicious activity, reducing reliance on manual review. Option A is wrong because simply increasing log retention does not ensure review. Option C is wrong while archiving logs is good practice, it does not enforce review. Option D is wrong because disabling log generation is counterproductive.

Answer

Archive logs to a read-only medium

Answer

Disable logging for low-priority events

Answer

Increase the log retention period to 12 months

Question 8

A small business wants to protect its data from ransomware. Which backup strategy provides the BEST protection against an attack where the backup files are also encrypted?

Accepted Answer

Weekly backups to tape stored in a fireproof safe offline. Option D is correct because an offline (air-gapped) backup is not accessible from the network, preventing ransomware from encrypting it. Option A is wrong because cloud backups are reachable from the network. Option B is wrong because local external drives attached to the system can be encrypted. Option C is wrong because tape backups often remain online or on-site, but can still be vulnerable if connected.

Answer

Daily backups to a network attached storage (NAS) device

Answer

Daily cloud backups with versioning

Answer

Weekly backups to an external hard drive connected via USB

Question 9

A company has a policy requiring segregation of duties (SoD) for financial transactions. Which scenario represents a violation of this principle?

Accepted Answer

The finance officer approves invoices and also reconciles the bank statements. Option C is correct because the same person both approves invoices and reconciles bank statements, combining authorization and review functions. Option A is wrong because separate individuals handle procurement and accounting. Option B is wrong because the separation is maintained. Option D is wrong because two-level approval still involves separate individuals.

Answer

The system administrator performs backups, and the security officer reviews audit logs

Answer

Two managers must each approve any expenditure over $10,000

Answer

The purchasing manager creates purchase orders, and the accounts payable clerk processes payments

Question 10

A new employee needs access to the CRM, email, and file servers. The security policy requires that access privileges are granted based on job function. Which process should be used?

Accepted Answer

The identity management team assigns the employee to a role that includes the necessary permissions. Option C is correct because role-based access control (RBAC) assigns permissions based on job functions, not individual requests or ad-hoc approvals. By placing the employee into a predefined role (e.g., 'Sales Rep'), the identity management team ensures that the CRM, email, and file server permissions are granted consistently and in compliance with the security policy. This process enforces the principle of least privilege and simplifies auditing.

Answer

The employee completes a request form detailing the access they need

Answer

The IT department grants full access to all systems and later reviews

Answer

The employee's supervisor decides which access is appropriate and informs IT

Question 11

An organization wants to prevent unauthorized persons from entering a secure server room. Which control is the MOST effective?

Accepted Answer

Require biometric authentication (fingerprint or retina scan) to unlock the door. Biometric authentication (fingerprint or retina scan) is the most effective control because it verifies the unique physiological characteristics of an individual, making it extremely difficult to bypass, share, or forge. Unlike knowledge-based (keypad code) or possession-based (key card) factors, biometrics provide strong, non-repudiable proof of identity, which is critical for high-security areas like a server room.

Answer

Install a CCTV camera at the entrance

Answer

Post a security guard at the entrance during business hours

Answer

Use a keypad with a unique code for each employee

Question 12

A security awareness program is being developed. Which topic is MOST critical for all employees to understand to reduce the risk of social engineering?

Accepted Answer

How to recognize and report phishing attempts and other suspicious communications. Social engineering attacks, such as phishing, vishing, and smishing, exploit human psychology rather than technical vulnerabilities. The most critical defense for all employees is the ability to recognize indicators of these attacks (e.g., spoofed sender addresses, urgent language, mismatched URLs) and follow the proper reporting procedure to enable rapid incident response. Without this skill, even the strongest technical controls can be bypassed by a single successful click.

Answer

The risks of posting on social media

Answer

The proper use of mobile devices

Answer

How to create strong passwords

Question 13

Which TWO of the following are types of intrusion detection systems (IDS) based on the detection method?

Accepted Answer

Anomaly-based IDS. Options B and D are correct. Signature-based detection matches known patterns, and anomaly-based detection identifies deviations from normal behavior. Option A is wrong because network-based refers to placement, not detection method. Option C is wrong because host-based is also placement. Option E is wrong because rule-based is a subset of signature-based.

Answer

Host-based IDS

Answer

Rule-based IDS

Answer

Network-based IDS

Question 14

Which THREE of the following are key objectives of data classification?

Accepted Answer

Identify and protect sensitive information. Data classification is a foundational security control that directly supports the identification and protection of sensitive information. By categorizing data based on its sensitivity and criticality, organizations can apply appropriate security controls, such as access controls and encryption, to safeguard confidential data from unauthorized disclosure or modification.

Answer

Reduce storage costs by identifying duplicate data

Answer

Determine the encryption algorithm to use

Question 15

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Recovery Time Objective (RTO). Options A and D are correct. Recovery Time Objective (RTO) defines the maximum acceptable downtime, and Recovery Point Objective (RPO) defines the maximum acceptable data loss. Option B is wrong while a business continuity plan (BCP) is related, it is broader and not specific to DRP. Option C is wrong the RACI matrix is for responsibility assignment, not a core DRP component. Option E is wrong a penetration test is a security assessment, not a DRP component.

Answer

Business Continuity Plan (BCP)

Answer

A RACI matrix for incident response

Answer

Results of a penetration test

SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Exhibit

SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Exhibit