SSCP Security Operations and Administration — 10 Questions

Question 1

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

Accepted Answer

Hourly incremental backups to disk. An RTO of 4 hours means the database must be restored and operational within 4 hours of a disruption. Hourly incremental backups to disk ensure that at most one hour of data is lost and that backups are readily available on disk for fast restoration, easily meeting the 4-hour RTO. Disk-based backups restore much faster than tape, and the hourly frequency minimizes recovery point and recovery time.

Answer

Daily full backups to disk

Answer

Weekly full backups to tape

Answer

Monthly full backups with daily differentials to tape

Question 2

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Accepted Answer

Document the findings and update processes. Option C (Roll back the change) is correct because reverting to the last known-good state is the fastest way to eliminate the newly introduced security vulnerability and restore the system to a secure baseline before any further remediation is planned. Option B (Document the findings and update processes) is correct because a post-implementation review requires capturing the root cause, the vulnerability details, and lessons learned, then feeding those back into change management and testing procedures to prevent recurrence. Option A is not selected because immediately applying a patch is not always feasible or safe without first assessing the vulnerability, testing the fix, and following change control; rollback is the more immediate containment step. Option D is not selected because blaming the implementer is unprofessional and does nothing to remediate the vulnerability or improve the process. Option E is not selected because accepting the risk without proper risk assessment, approval, and documentation violates security and change management best practices.

Answer

Immediately apply a patch

Answer

Blame the change implementer

Answer

Proceed and accept the risk

Question 3

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

Accepted Answer

Requirements for password complexity and multifactor authentication. An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

Answer

Procedures for data backup and recovery

Answer

Guidelines for responding to security incidents

Answer

A list of approved social media platforms

Question 4

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

Accepted Answer

SIEM with change detection rules. A SIEM aggregates and correlates logs from servers, network devices, and applications, and with change detection rules it can alert on unauthorized configuration changes in near real time. This makes it the most effective tool for detecting (not just documenting) unauthorized changes.

Answer

Configuration management database (CMDB)

Answer

Vulnerability scanner

Answer

Patch management tool

Question 5

A security analyst notices an alert indicating that a user's workstation has been connected to an unauthorized external device. Which physical security control would best help prevent such incidents?

Accepted Answer

Clean desk policy. A clean desk policy is a physical security control that requires employees to clear their workstations of sensitive documents, removable media, and devices at the end of each work session. By mandating that external devices like USB drives or peripherals be stored securely, it directly reduces the risk of unauthorized devices being connected to workstations. This policy complements technical controls like device control policies (e.g., Windows Group Policy for USB restrictions) by addressing the human factor.

Answer

Biometric readers on workstations

Answer

Mantrap at building entrance

Answer

CCTV monitoring

Question 6

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Accepted Answer

The email creates a sense of urgency or threatens negative consequences. A sense of urgency or threats of negative consequences is the most reliable psychological indicator of phishing because attackers use it to pressure victims into acting without verifying the sender or link. While other signs can appear in legitimate emails, manufactured urgency is a hallmark of social engineering and is consistently present in phishing attempts.

Answer

The email contains an attachment from an unknown sender

Answer

The email has grammatical errors or misspellings

Answer

The email address of the sender closely resembles a legitimate domain

Question 7

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

Accepted Answer

Weekly full backups and hourly incremental backups. Hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Answer

Weekly full backups and daily differential backups

Answer

Monthly full backups and weekly incremental backups

Answer

Daily full backups with no incremental backups

Question 8

Which TWO of the following are key components of the 3-2-1 backup rule?

Accepted Answer

At least three copies of the data. The 3-2-1 backup rule is defined as: at least three copies of the data (the original plus two backups), stored on at least two different media types, with at least one copy kept offsite. Option D is correct because the '3' in 3-2-1 explicitly requires a minimum of three copies of the data to ensure redundancy against loss or corruption. Option E is correct because the '2' requires the copies to reside on at least two distinct media types (for example, local disk plus tape or cloud storage), reducing the risk that a single media failure destroys all backups. Option A is not one of the two marked answers because although offsite storage is part of the '1' in the rule, it is not among the options designated as correct here. Option B is incorrect because the rule does not mandate daily full backups; it concerns copy count, media diversity, and offsite placement, not a specific backup frequency or type. Option C is incorrect because encryption, while a good security practice, is not a defining component of the 3-2-1 rule.

Answer

One copy stored in a different geographic location

Answer

Daily full backups

Answer

All backups must be encrypted

Question 9

During a security awareness training session, an employee reports receiving an email that appears to be from the CEO requesting an urgent wire transfer. The email has a suspicious domain and poor grammar. Which type of attack is this an example of?

Accepted Answer

Phishing. This is a classic example of phishing, a broad category of social engineering attacks where attackers send deceptive emails to trick recipients into revealing sensitive information or performing actions like wire transfers. The email's suspicious domain and poor grammar are telltale signs of a generic phishing attempt, as it is not specifically tailored to the employee or the CEO's identity.

Answer

Smishing

Answer

Spear phishing

Answer

Whaling

Question 10

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

Accepted Answer

Incident count. The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Answer

Patch compliance

Answer

Training completion

Answer

Mean time to detect (MTTD)