SSCP Security Operations and Administration — Timed 15 Questions

Question 1

A security analyst receives an alert that a user account has been locked out multiple times within 10 minutes. The analyst checks the account and finds it is a service account used for automated backups. What is the most likely cause?

Accepted Answer

The service is using cached credentials that are out of sync with the domain controller.. Service accounts used for automated backups typically run as services that cache their credentials locally. When the password is changed on the domain controller, the cached credentials in the service's logon session become out of sync. The service repeatedly attempts to authenticate with the stale cached password, causing rapid lockout events within a short window.

Answer

The service account's certificate has expired.

Answer

A brute force attack is targeting the service account.

Answer

The account password has expired and needs to be reset.

Question 2

A company implements a new policy requiring all privileged access requests to be approved by a manager. However, after deployment, analysts report that they cannot perform emergency changes outside business hours. What is the best solution?

Accepted Answer

Implement a break-glass procedure for emergency access.. Option B is correct because a break-glass procedure provides a predefined, auditable method for granting emergency privileged access without requiring real-time manager approval. This balances security with operational continuity, allowing analysts to perform critical changes outside business hours while maintaining accountability through post-event review and logging.

Answer

Extend manager on-call hours to cover all times.

Answer

Remove the approval requirement for privileged access.

Answer

Require analysts to call a manager for approval each time.

Question 3

A security administrator is tasked with ensuring that only authorized software can run on company workstations. Which security control should be implemented?

Accepted Answer

Application whitelisting. Application whitelisting is the correct control because it explicitly defines a list of approved software that is allowed to execute on workstations. This prevents unauthorized or malicious software from running, even if it bypasses other defenses, by enforcing a default-deny policy at the operating system level (e.g., via Windows AppLocker or Software Restriction Policies). Unlike antivirus, which relies on signatures to detect known threats, whitelisting blocks unknown or unapproved executables by default.

Answer

Antivirus software

Answer

Patch management

Answer

Host-based firewall

Question 4

An organization's security policy requires that all data at rest be encrypted. A database administrator objects, stating that encryption will degrade performance. What is the best response?

Accepted Answer

Implement transparent data encryption (TDE) to minimize performance impact.. Transparent Data Encryption (TDE) encrypts data at rest at the storage layer, automatically encrypting data before it is written to disk and decrypting it when read into memory. This minimizes performance impact because encryption/decryption occurs outside the application logic and does not require schema changes, making it the best response to the DBA's concern while still meeting the policy requirement.

Answer

Remove the encryption requirement for databases.

Answer

Encrypt only the backup files, not the live database.

Answer

Use column-level encryption on sensitive columns only.

Question 5

During a security audit, it is discovered that several employees have access to shared network drives containing sensitive HR data. The HR manager states that these employees no longer need access. What is the most efficient way to revoke access?

Accepted Answer

Remove the users from the security group that grants access to the drives.. The most efficient way to revoke access is to remove the users from the security group that grants access to the drives. In Windows environments, shared drive permissions are typically assigned to Active Directory security groups rather than individual users. By removing the users from the group, their permissions are revoked immediately across all resources that group has access to, without needing to touch each resource individually.

Answer

Delete the user accounts of the affected employees.

Answer

Reconfigure the shared drive to deny access to all users except HR.

Answer

Manually remove each user's permissions on the shared drive.

Question 6

A company wants to ensure that employees use strong passwords. Which policy is most effective?

Accepted Answer

Require a minimum password length of 12 characters.. Option C is correct because password length is the single most important factor in resistance to brute-force and rainbow table attacks. NIST SP 800-63B and industry best practices now recommend a minimum of 12–16 characters, as each additional character exponentially increases the keyspace. While complexity adds some entropy, a long passphrase is far more effective against modern GPU-based cracking than a short, complex password.

Answer

Prohibit password reuse for the last 10 passwords.

Answer

Require password changes every 30 days.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols.

Question 7

A security team is investigating a potential data exfiltration incident. They notice that a large amount of data was transferred to an external IP address during off-hours. What should be the first step?

Accepted Answer

Isolate the affected system from the network.. Option D is correct because the immediate priority in a suspected data exfiltration incident is to contain the threat and prevent further data loss. Isolating the affected system from the network stops ongoing communication with the external IP address, preserving the system state for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Notify senior management of the incident.

Answer

Block the external IP address at the firewall.

Answer

Analyze the data transfer logs to determine the scope.

Question 8

An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?

Accepted Answer

The user's new role inherits permissions from multiple roles that collectively grant access.. In RBAC, permissions are assigned to roles, not directly to users. When a user's role changes, the new role may have a different set of permissions. If the new role inherits permissions from multiple roles (e.g., through role hierarchy or composite roles), it can collectively grant access to resources that were previously denied under the old role. This is the most likely cause because the security administrator confirmed the role change, and RBAC systems typically enforce permissions based on the current role membership.

Answer

The user's previous role was not properly removed.

Answer

The RBAC implementation has a bug that grants excessive permissions.

Answer

The user was directly assigned permissions to the resource.

Question 9

Which of the following is the primary purpose of a security awareness program?

Accepted Answer

To teach employees about security best practices and reduce human error.. The primary purpose of a security awareness program is to educate employees on security best practices and reduce human error, which is the leading cause of security incidents. Unlike technical controls, awareness programs target the human element by teaching users to recognize phishing attempts, handle sensitive data properly, and follow secure behaviors. This aligns with the NIST SP 800-50 framework, which defines awareness as a foundational component of an organizational security posture.

Answer

To evaluate the effectiveness of security technologies.

Answer

To enforce security policies through penalties.

Answer

To train employees on advanced technical security skills.

Question 10

Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)

Accepted Answer

To detect errors through independent verification.. Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.

Answer

To reduce the workload on individual employees.

Answer

To simplify training requirements.

Answer

To comply with regulatory requirements.

Question 11

Which THREE of the following are essential elements of an effective incident response plan? (Choose three.)

Accepted Answer

Containment, eradication, and recovery. The incident response plan lifecycle, as defined by NIST SP 800-61, includes four core phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Options A, B, and E directly map to these essential phases, ensuring the organization can detect an incident, contain it to prevent spread, eradicate the root cause, recover normal operations, and continuously improve through training and preparation.

Answer

Public relations and media notification

Answer

Cyber insurance purchasing

Question 12

Which TWO of the following are examples of administrative controls? (Choose two.)

Accepted Answer

Access control policies. Access control policies (B) are administrative controls because they define the rules, procedures, and responsibilities for managing access to resources, forming the governance framework that guides technical and physical implementations. Security awareness training (C) is also an administrative control as it educates users on security policies and procedures, reducing human error and reinforcing organizational security culture.

Answer

Firewall rules

Answer

Security guards

Answer

Encryption of data at rest

Question 13

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack is most likely occurring because the exhibit shows repeated login attempts with different passwords for the same username, which is the hallmark of an automated password guessing attack. The rapid succession of failed authentication events indicates a systematic trial of credentials, not a single intercepted session or resource exhaustion.

Answer

Man-in-the-middle attack

Answer

Denial of service attack

Answer

Social engineering attack

Question 14

Based on the exhibit, which of the following best describes the firewall configuration?

Accepted Answer

The firewall allows SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic.. The exhibit shows an access control list (ACL) that explicitly permits TCP traffic on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) from the internal subnet (e.g., 192.168.1.0/24) to any destination, followed by an implicit deny all rule. This configuration allows only SSH, HTTP, and HTTPS from the internal subnet and drops all other traffic, matching option C.

Answer

The firewall allows only loopback traffic.

Answer

The firewall allows all traffic from the internal subnet.

Answer

The firewall allows all traffic from external sources.

Question 15

You are the security administrator for a mid-sized financial company that processes credit card transactions. The company has a mix of on-premises servers and cloud-based services. Recently, the company experienced a data breach where an attacker exfiltrated customer data from a database server. The investigation reveals that the attacker used compromised credentials of a database administrator (DBA) account. The DBA account had been used by multiple administrators without proper auditing. The company wants to implement a solution to prevent such incidents in the future. The solution must: 1) ensure that each administrator has a unique account for database access, 2) require approval for privileged actions, 3) provide a full audit trail of all privileged activities, and 4) be cost-effective. Which of the following is the best course of action?

Accepted Answer

Implement a privileged access management (PAM) solution that provides just-in-time access and session recording.. A privileged access management (PAM) solution provides just-in-time access, approval workflows, and session recording, meeting all requirements. Shared accounts violate uniqueness; MFA alone doesn't provide approval or audit; database auditing software logs activities but does not enforce approval.

Answer

Enforce the use of a shared DBA account with a complex password that is changed monthly.

Answer

Require multi-factor authentication for all database access without any additional controls.

Answer

Install a database activity monitoring (DAM) solution that logs all SQL queries.