SSCP Security Operations and Administration — 40 Questions

Question 1

A security analyst notices an alert indicating that a user's workstation has been connected to an unauthorized external device. Which physical security control would best help prevent such incidents?

Accepted Answer

Clean desk policy. A clean desk policy is a physical security control that requires employees to clear their workstations of sensitive documents, removable media, and devices at the end of each work session. By mandating that external devices like USB drives or peripherals be stored securely, it directly reduces the risk of unauthorized devices being connected to workstations. This policy complements technical controls like device control policies (e.g., Windows Group Policy for USB restrictions) by addressing the human factor.

Answer

Biometric readers on workstations

Answer

Mantrap at building entrance

Answer

CCTV monitoring

Question 2

Which of the following is the primary purpose of a configuration management database (CMDB)?

Accepted Answer

To provide a centralized repository of configuration items and their relationships. A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.

Answer

To track changes to network devices in real time

Answer

To automate the deployment of patches

Answer

To store backup copies of configuration files

Question 3

A security administrator is implementing physical security for a data center. Which THREE of the following controls should be included to provide layered security?

Accepted Answer

Mantrap at the main entrance. A mantrap is a physical security control that uses a small room with two interlocking doors to prevent tailgating and unauthorized entry. It ensures that only one authenticated person can pass through at a time, providing a critical layer of defense at the main entrance of a data center.

Answer

Screen locks on all workstations

Answer

Clean desk policy for employees

Question 4

Which TWO of the following are valid reasons to deny a change request during the CAB approval process?

Accepted Answer

The change request lacks a rollback plan. A change request must include a rollback plan to ensure that if the change fails or causes unexpected issues, the system can be safely restored to its previous state. Without a documented rollback procedure, the change introduces unacceptable operational risk, making it a valid reason for the CAB to deny approval.

Answer

The change is outside the approved budget

Answer

The change has a low priority

Answer

The change was requested by a junior staff member

Question 5

A security administrator is implementing a policy that requires all employees to use a password manager and enable multi-factor authentication. This policy is BEST described as a:

Accepted Answer

Password policy. The policy requires all employees to use a password manager and enable multi-factor authentication, which directly governs the creation, storage, and authentication strength of user credentials. This is the core function of a password policy, as defined in security frameworks like NIST SP 800-53 (IA-5) and ISO 27001 (A.9.2.1). It specifically addresses password complexity, rotation, and MFA enforcement, not data classification or access methods.

Answer

Data handling policy

Answer

Social media policy

Answer

Remote access policy

Question 6

Which of the following physical security controls is designed to prevent tailgating by requiring two doors to be interlocked?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, preventing an unauthorized person from following an authorized person through a single entry point (tailgating). This design forces each individual to be authenticated before the second door unlocks, ensuring only one person passes per authentication event.

Answer

Security guard

Answer

Biometric reader

Answer

CCTV

Question 7

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 8

A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?

Accepted Answer

Remote access policy. The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

Answer

Data handling policy

Answer

Password policy

Answer

Acceptable use policy (AUP)

Question 9

After a patch is deployed to a critical server, the system becomes unstable. The change management plan includes a rollback procedure. What should be done FIRST?

Accepted Answer

Execute the rollback procedure. When a patch deployment causes system instability, the immediate priority is to restore service stability by executing the pre-approved rollback procedure. The change management plan already includes this procedure, so no new approvals are needed; acting quickly minimizes downtime and risk.

Answer

Create a new change request for the rollback

Answer

Conduct a post-implementation review

Answer

Notify the Change Advisory Board

Question 10

Which TWO controls are examples of physical security controls that can help prevent unauthorized access to a data center? (Select TWO.)

Accepted Answer

Biometric readers. Biometric readers are a physical security control that authenticates individuals based on unique biological traits (e.g., fingerprints, iris patterns). They prevent unauthorized access by ensuring only enrolled personnel can enter the data center, directly controlling physical entry points.

Answer

Encryption of data at rest

Answer

Firewalls

Answer

Intrusion detection system (IDS)

Question 11

A company wants to ensure that employees understand the proper use of corporate email and internet. Which policy should they implement?

Accepted Answer

Acceptable Use Policy. An Acceptable Use Policy (AUP) defines the rules and guidelines for using corporate IT resources, including email and internet. It specifies permitted and prohibited activities, such as personal browsing, sending sensitive data, or accessing inappropriate content, ensuring employees understand their responsibilities. This policy directly addresses the company's goal of educating employees on proper usage, unlike other policies that focus on data classification, remote connectivity, or authentication.

Answer

Data Handling Policy

Answer

Remote Access Policy

Answer

Password Policy

Question 12

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. A clean desk policy requires that sensitive information, including passwords, be secured and not left visible.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 13

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

Accepted Answer

Recognizing phishing attempts. Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

Answer

Proper use of social media

Answer

Physical security procedures

Answer

Data backup procedures

Question 14

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

Accepted Answer

Prioritize patching based on vulnerability criticality. To improve patch compliance, prioritize patching based on vulnerability criticality to address highest risk first.

Answer

Increase the frequency of vulnerability scans

Answer

Disable automatic updates to prevent issues

Answer

Exclude non-critical systems from patching

Question 15

A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?

Accepted Answer

Report the issue to the CAB and request a revised change. The change should be halted and the CAB reconvened to reassess the change given the new information.

Answer

Reject the change request and close it permanently

Answer

Implement the change but have a rollback plan ready

Answer

Proceed with the change and resolve the issue after implementation

Question 16

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Accepted Answer

SCAP scanner. SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Answer

Vulnerability scanner

Answer

Asset management database

Answer

SIEM

Question 17

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Accepted Answer

CMDB. A Configuration Management Database (CMDB) stores details about hardware assets and their relationships.

Answer

Patch management tool

Answer

Vulnerability database

Answer

SIEM

Question 18

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Accepted Answer

Use the intercom to contact security. The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.

Answer

Return through the first door

Answer

Force the second door open

Answer

Wait for someone to open from the other side

Question 19

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Incremental backup

Answer

Snapshot backup

Answer

Full backup

Question 20

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

Accepted Answer

Hourly incremental backups to disk. To meet a short RTO, backup frequency should be high and restoration quick, so frequent backups to fast media are needed.

Answer

Daily full backups to disk

Answer

Weekly full backups to tape

Answer

Monthly full backups with daily differentials to tape