SSCP Security Operations and Administration Practice Test 5 — 15 Questions

Question 1

An analyst runs the netstat command on a web server. Based on the output, which connection is the MOST suspicious?

Accepted Answer

The connection from 203.0.113.5:8080. Option B is correct because the external IP 203.0.113.5 from the documentation range is connecting on an unusual source port (8080), which is often used for proxies or tunneling. Option A is wrong because 192.168.1.10 is a private IP with a high ephemeral port, typical. Option C is wrong because 10.0.2.50 is internal. Option D is wrong because the listening port is expected.

Answer

The connection from 192.168.1.10:54321

Answer

The connection from 10.0.2.50:44350

Answer

The listening on 0.0.0.0:80

Question 2

An analyst reviews a Windows security log. Given the event, what is the MOST likely cause of the lockout?

Accepted Answer

A remote attacker is attempting to brute-force the user's password via RDP. Option C is correct because Logon Type 10 (RemoteInteractive) indicates a Remote Desktop (RDP) session, and multiple failed attempts from the same source often cause lockouts due to brute-force attempts. Option A is wrong because bad password on local console would show Logon Type 2. Option B is wrong because credential caching is not directly related. Option D is wrong while incorrect password is a reason, the logon type points to RDP, so the attack vector is more specific.

Answer

The user's password was changed and they are using the old password

Answer

The user's cached credentials are expired

Answer

The user entered the wrong password at the physical console

Question 3

A network administrator implements the firewall rules above. What is the effect of this rulebase?

Accepted Answer

HTTP and HTTPS traffic from the 10.0.0.0/8 network is allowed. Option A is correct because the permit rules come before the deny rule; traffic from the 10.0.0.0/8 network is explicitly denied by Rule 3, but only after being permitted by Rules 1 and 2? Actually, firewall rules are processed top-down; first match applies. So for a web request from 10.0.1.1 to destination port 80, Rule 1 matches and permits it, so the deny rule is not evaluated. Therefore, traffic from the 10.0.0.0/8 network is allowed for HTTP and HTTPS because the permit rules are first. Option B is wrong because it ignores rule order. Option C is wrong because the rules are not redundant. Option D is wrong because traffic to other ports is implicitly denied (default deny), but the question asks about effect.

Answer

HTTP and HTTPS traffic from all networks is blocked

Answer

All traffic from the 10.0.0.0/8 network is blocked

Answer

The deny rule is redundant because permit rules exist

Question 4

A system administrator notices that a user's account has been locked out multiple times within an hour. The admin reviews the logs and finds repeated failed login attempts from an unusual IP address. What is the BEST immediate action to mitigate further risk?

Accepted Answer

Disable the user account. Disabling the account stops any further unauthorized access while the situation is investigated. Option A is a weak password after lockout; B removes logs needed for investigation; D misidentifies the issue as a DoS attack.

Answer

Delete the failed login log entries

Answer

Implement a firewall rule to block the IP address

Answer

Reset the user's password

Question 5

An organization is migrating from on-premises servers to a cloud IaaS model. The security team must ensure that virtual machine (VM) images are hardened before deployment. Which of the following is the MOST effective control to ensure consistency and compliance with security baselines?

Accepted Answer

Create a golden image that is hardened and approved for use, and deploy VMs from that image. Creating a golden image that is hardened and approved for use ensures that every VM deployed from it inherits a consistent, pre-configured security baseline. This approach eliminates configuration drift and manual errors by baking security controls into the image before deployment, making it the most effective control for consistency and compliance.

Answer

Perform vulnerability scans on each VM after deployment

Answer

Apply the latest OS patches to each VM immediately after deployment

Answer

Train administrators on hardening procedures and rely on manual configuration

Question 6

A security analyst is reviewing the access control policy and notices that some users have been granted 'write' access to a directory that contains sensitive financial reports. Which principle of information security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting 'write' access to a directory containing sensitive financial reports to users who do not require that level of access violates this principle, as it introduces unnecessary risk of unauthorized modification or data leakage.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 7

A company's security policy requires that employees must change their passwords every 60 days. However, help desk tickets show that many users are locked out after forgetting their new passwords. Which of the following would BEST balance security and usability?

Accepted Answer

Implement single sign-on (SSO) for all applications. Single sign-on (SSO) reduces the number of passwords users must remember to one set of credentials, which decreases the likelihood of forgotten passwords and lockouts. By centralizing authentication, SSO allows the organization to enforce a strong password policy (e.g., 60-day rotation) while improving usability, as users only need to manage a single password. This balances security (centralized control, stronger authentication) with usability (fewer password resets).

Answer

Require users to use a password manager

Answer

Extend the password change interval to 90 days

Answer

Disable account lockout after failed attempts

Question 8

Which TWO of the following are essential steps in a security incident response process according to the SSCP common body of knowledge? (Select the two best answers.)

Accepted Answer

Eradication

Answer

Vulnerability scanning

Answer

Penetration testing

Answer

Risk assessment

Question 9

Which THREE of the following are valid methods for enforcing separation of duties in an IT environment? (Select the three best answers.)

Accepted Answer

Implementing a two-person rule for critical changes. Option C is correct because the two-person rule requires two authorized individuals to perform a critical change, ensuring that no single person has both the authority and the ability to execute a high-risk action. This directly enforces separation of duties by dividing the task into two distinct roles, such as one person approving and another implementing the change, which prevents fraud or errors from a single compromised account.

Answer

Sharing administrative passwords among team members

Answer

Having the same person approve and implement a change

Question 10

Which TWO of the following are key components of a data classification policy? (Select the two best answers.)

Accepted Answer

Classification labels

Answer

Encryption algorithm selection

Answer

Firewall rules

Answer

Backup schedules

Question 11

A small business has 50 employees and uses a cloud-based email service. The IT manager receives a report that several employees have been receiving phishing emails that appear to come from the company's CEO. The emails request that employees purchase gift cards and send the codes urgently. Two employees have already complied, losing $500 total. The manager wants to prevent this from recurring. The company has a limited budget and no dedicated security staff. Which of the following actions should the manager take FIRST?

Accepted Answer

Enable multi-factor authentication (MFA) on the CEO's email account. Implementing multi-factor authentication (MFA) on the CEO's account prevents attackers from using stolen credentials to send phishing emails. Option A is training, which is important but does not stop the current vector; B is a long-term policy; D is a technical control but does not prevent the initial account compromise.

Answer

Create a policy prohibiting gift card purchases

Answer

Conduct security awareness training for all employees

Answer

Set up email filtering rules to block emails with the CEO's name

Question 12

A hospital's IT department manages a network with hundreds of medical devices, including patient monitors and infusion pumps, all connected to a separate VLAN. The security team has identified that several devices are running outdated firmware with known vulnerabilities. The vendor has not released patches for these legacy devices. The hospital cannot replace them immediately due to budget constraints. The network team proposes moving the devices to a more restrictive firewall zone and implementing intrusion detection. Which of the following additional controls should be implemented to BEST reduce the risk of a breach exploiting these devices?

Accepted Answer

Implement strict network segmentation and access control lists (ACLs) to allow only necessary traffic. Segmenting the devices into a separate, highly restricted network segment limits the blast radius and prevents lateral movement. Option A is already proposed; B is best practice; C is acceptable but not sufficient; D is reactive.

Answer

Conduct daily vulnerability scans on the device VLAN

Answer

Deploy host-based intrusion prevention on each device

Answer

Use a web application firewall (WAF) in front of the devices

Question 13

A financial firm is implementing a new access control system for its critical trading application. The application currently uses local accounts and password authentication. The security team wants to enforce multi-factor authentication (MFA) and centralized user management. The firm has an existing Active Directory (AD) infrastructure and a certificate authority (CA). However, the trading application only supports smart card authentication via PKI and does not support integration with AD directly. The IT team must design a solution that meets security requirements while minimizing changes to the application. Which approach should the team take?

Accepted Answer

Deploy a RADIUS server that forwards authentication to AD and use smart card emulation for the application. Using AD to manage user accounts and deploying a RADIUS server that authenticates against AD and issues smart card credentials to the application provides centralized management and MFA. Option A is not MFA; B would require app changes; D leaves local accounts.

Answer

Modify the application code to support SAML-based federation

Answer

Continue using local accounts but require a strong password policy and regular changes

Answer

Set up a separate LDAP directory for the application and sync with AD

Question 14

A university's IT department manages a network used by students and faculty. The security team notices an unusual increase in outbound traffic from the student dormitory network during late hours. Upon investigation, they discover that several student laptops are infected with malware that is attempting to connect to external command-and-control (C2) servers. The team needs to contain the incident quickly while minimizing impact on legitimate users. Which of the following is the BEST immediate containment measure?

Accepted Answer

Disconnect the infected laptops from the network and take them offline for remediation. Isolating the infected devices from the network stops the C2 communication and prevents further spread, while allowing other users to continue working. Option A may block all students; C is disruptive to everyone; D does not stop communication.

Answer

Shut down the entire dormitory network

Answer

Block all outbound traffic from the dormitory subnet

Answer

Update the antivirus definitions on the infected laptops

Question 15

A government contractor is required to comply with the Federal Information Security Management Act (FISMA). The security officer must implement a continuous monitoring program for all information systems. The contractor uses a mix of on-premises servers and cloud services. The contractor has a SIEM tool that collects logs from all systems. However, the SIEM generates a high number of alerts, many of which are false positives, overwhelming the security team. The team wants to improve the effectiveness of the monitoring program without increasing staff. Which of the following actions would MOST effectively address the issue?

Accepted Answer

Tune the SIEM correlation rules and create custom filters to reduce false positive alerts. Tuning the SIEM correlation rules to reduce false positives will make alerts more actionable and allow the team to focus on real incidents. Option B increases noise; C is expensive and time-consuming; D reduces visibility.

Answer

Disable alerts for low-severity events

Answer

Hire additional security analysts to review all alerts

Answer

Increase the frequency of log collection to every minute

SSCP Security Operations and Administration Practice Test 5 — 15 Questions

Exhibit

SSCP Security Operations and Administration Practice Test 5 — 15 Questions

Exhibit