SSCP Security Operations and Administration Practice Test 1 — 15 Questions

Question 1

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

Accepted Answer

Hourly incremental backups to disk. An RTO of 4 hours means the database must be restored and operational within 4 hours of a disruption. Hourly incremental backups to disk ensure that at most one hour of data is lost and that backups are readily available on disk for fast restoration, easily meeting the 4-hour RTO. Disk-based backups restore much faster than tape, and the hourly frequency minimizes recovery point and recovery time.

Answer

Daily full backups to disk

Answer

Weekly full backups to tape

Answer

Monthly full backups with daily differentials to tape

Question 2

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Accepted Answer

Document the findings and update processes. Option C (Roll back the change) is correct because reverting to the last known-good state is the fastest way to eliminate the newly introduced security vulnerability and restore the system to a secure baseline before any further remediation is planned. Option B (Document the findings and update processes) is correct because a post-implementation review requires capturing the root cause, the vulnerability details, and lessons learned, then feeding those back into change management and testing procedures to prevent recurrence. Option A is not selected because immediately applying a patch is not always feasible or safe without first assessing the vulnerability, testing the fix, and following change control; rollback is the more immediate containment step. Option D is not selected because blaming the implementer is unprofessional and does nothing to remediate the vulnerability or improve the process. Option E is not selected because accepting the risk without proper risk assessment, approval, and documentation violates security and change management best practices.

Answer

Immediately apply a patch

Answer

Blame the change implementer

Answer

Proceed and accept the risk

Question 3

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

Accepted Answer

Requirements for password complexity and multifactor authentication. An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

Answer

Procedures for data backup and recovery

Answer

Guidelines for responding to security incidents

Answer

A list of approved social media platforms

Question 4

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

Accepted Answer

SIEM with change detection rules. A SIEM aggregates and correlates logs from servers, network devices, and applications, and with change detection rules it can alert on unauthorized configuration changes in near real time. This makes it the most effective tool for detecting (not just documenting) unauthorized changes.

Answer

Configuration management database (CMDB)

Answer

Vulnerability scanner

Answer

Patch management tool

Question 5

A security analyst notices an alert indicating that a user's workstation has been connected to an unauthorized external device. Which physical security control would best help prevent such incidents?

Accepted Answer

Clean desk policy. A clean desk policy is a physical security control that requires employees to clear their workstations of sensitive documents, removable media, and devices at the end of each work session. By mandating that external devices like USB drives or peripherals be stored securely, it directly reduces the risk of unauthorized devices being connected to workstations. This policy complements technical controls like device control policies (e.g., Windows Group Policy for USB restrictions) by addressing the human factor.

Answer

Biometric readers on workstations

Answer

Mantrap at building entrance

Answer

CCTV monitoring

Question 6

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Accepted Answer

The email creates a sense of urgency or threatens negative consequences. A sense of urgency or threats of negative consequences is the most reliable psychological indicator of phishing because attackers use it to pressure victims into acting without verifying the sender or link. While other signs can appear in legitimate emails, manufactured urgency is a hallmark of social engineering and is consistently present in phishing attempts.

Answer

The email contains an attachment from an unknown sender

Answer

The email has grammatical errors or misspellings

Answer

The email address of the sender closely resembles a legitimate domain

Question 7

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

Accepted Answer

Weekly full backups and hourly incremental backups. Hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Answer

Weekly full backups and daily differential backups

Answer

Monthly full backups and weekly incremental backups

Answer

Daily full backups with no incremental backups

Question 8

Which TWO of the following are key components of the 3-2-1 backup rule?

Accepted Answer

At least three copies of the data. The 3-2-1 backup rule is defined as: at least three copies of the data (the original plus two backups), stored on at least two different media types, with at least one copy kept offsite. Option D is correct because the '3' in 3-2-1 explicitly requires a minimum of three copies of the data to ensure redundancy against loss or corruption. Option E is correct because the '2' requires the copies to reside on at least two distinct media types (for example, local disk plus tape or cloud storage), reducing the risk that a single media failure destroys all backups. Option A is not one of the two marked answers because although offsite storage is part of the '1' in the rule, it is not among the options designated as correct here. Option B is incorrect because the rule does not mandate daily full backups; it concerns copy count, media diversity, and offsite placement, not a specific backup frequency or type. Option C is incorrect because encryption, while a good security practice, is not a defining component of the 3-2-1 rule.

Answer

One copy stored in a different geographic location

Answer

Daily full backups

Answer

All backups must be encrypted

Question 9

During a security awareness training session, an employee reports receiving an email that appears to be from the CEO requesting an urgent wire transfer. The email has a suspicious domain and poor grammar. Which type of attack is this an example of?

Accepted Answer

Phishing. This is a classic example of phishing, a broad category of social engineering attacks where attackers send deceptive emails to trick recipients into revealing sensitive information or performing actions like wire transfers. The email's suspicious domain and poor grammar are telltale signs of a generic phishing attempt, as it is not specifically tailored to the employee or the CEO's identity.

Answer

Smishing

Answer

Spear phishing

Answer

Whaling

Question 10

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

Accepted Answer

Incident count. The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Answer

Patch compliance

Answer

Training completion

Answer

Mean time to detect (MTTD)

Question 11

A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.

Answer

Perform post-implementation review

Answer

Develop a rollback plan

Answer

Implement the change in production

Question 12

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

Accepted Answer

Two different media types. The 3-2-1 backup rule is defined by three requirements: three copies of the data (option E) — the original plus two backups — which ensures redundancy if one copy is lost or corrupted; and two different media types (option D), so that a single media failure, such as a failed tape or disk, cannot destroy all backups at once. The remaining '1' in the rule refers to one copy stored offsite (often in the cloud), but option A is not one of the two components asked for here since the question targets the '3' and '2' elements. Option B is incorrect because the rule does not mandate daily full backups — backup frequency and type (full, incremental, differential) are separate from the 3-2-1 structure. Option C is incorrect because keeping all copies on the same media directly violates the '2' requirement of using two different media types.

Answer

One copy in the cloud

Answer

Daily full backups

Answer

All copies on the same media

Question 13

An organization's security policy prohibits employees from sharing passwords. What type of policy is this?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines the rules and guidelines for using an organization's IT resources, including prohibited behaviors like password sharing. This policy sets the overall acceptable behavior framework, whereas a Password Policy specifically governs password creation, complexity, and rotation rules, not the act of sharing. Therefore, a prohibition on sharing passwords falls under the AUP because it addresses user conduct rather than technical password parameters.

Answer

Data Handling Policy

Answer

Password Policy

Answer

Remote Access Policy

Question 14

During a change management process, the Change Advisory Board (CAB) approves a high-risk change. What is the NEXT step according to standard change management?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment to validate its functionality and identify potential issues before production deployment. This aligns with standard change management processes (e.g., ITIL) where testing follows approval to ensure the change does not disrupt operations. Immediate implementation without testing would bypass risk mitigation, making D the correct answer.

Answer

Implement the change immediately

Answer

Document the rollback plan

Answer

Perform a post-implementation review

Question 15

During a physical security audit, it is discovered that employees often prop open the mantrap door to allow easier access. What is the BEST control to address this?

Accepted Answer

Add a time-delay alarm that triggers if the door is open too long. A time-delay alarm is the best control because it directly addresses the root cause—employees propping the door open—by alerting security or triggering a response if the door remains open beyond a preset interval (e.g., 10–30 seconds). This maintains the integrity of the mantrap, which is designed to prevent tailgating and unauthorized access by ensuring only one person enters at a time. Unlike passive measures, the alarm provides immediate feedback and deterrence against the unsafe behavior.

Answer

Implement a clean desk policy

Answer

Install a CCTV camera to monitor the mantrap

Answer

Use biometric readers on both doors