SSCP Security Operations and Administration Practice Test 2 — 15 Questions

Question 1

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Accepted Answer

SCAP scanner. SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Answer

Vulnerability scanner

Answer

Asset management database

Answer

SIEM

Question 2

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Accepted Answer

CMDB. A Configuration Management Database (CMDB) stores details about hardware assets and their relationships.

Answer

Patch management tool

Answer

Vulnerability database

Answer

SIEM

Question 3

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Accepted Answer

Use the intercom to contact security. The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.

Answer

Return through the first door

Answer

Force the second door open

Answer

Wait for someone to open from the other side

Question 4

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Incremental backup

Answer

Snapshot backup

Answer

Full backup

Question 5

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

Accepted Answer

Hourly incremental backups to disk. To meet a short RTO, backup frequency should be high and restoration quick, so frequent backups to fast media are needed.

Answer

Daily full backups to disk

Answer

Weekly full backups to tape

Answer

Monthly full backups with daily differentials to tape

Question 6

A critical vulnerability with a CVSS score of 9.8 is discovered in a web server that cannot be patched due to vendor dependency. What is the best compensating control?

Accepted Answer

Apply a virtual patch via a WAF. A WAF can apply a virtual patch by inspecting HTTP/HTTPS traffic and blocking exploit attempts against the unpatched vulnerability. This provides a compensating control at the application layer without modifying the vulnerable server, allowing the server to remain operational while mitigating the risk.

Answer

Increase the frequency of vulnerability scans

Answer

Decommission the server immediately

Answer

Disable the server's network connectivity

Question 7

Which of the following is a key principle of the 3-2-1 backup rule?

Accepted Answer

Three copies on two different media types with one offsite. The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

Answer

Two copies on three different media types with one onsite

Answer

One copy on two different media types with three offsite

Answer

Three copies on three different media types with two offsite

Question 8

A security administrator receives an alert from the SIEM indicating a configuration change on a critical server. The change was not part of any approved change request. What should be the first step?

Accepted Answer

Investigate the change to determine its source and impact. The first step when an unauthorized configuration change is detected is to investigate the change to determine its source and impact. This aligns with the incident response process, where initial assessment (identification and scoping) precedes containment or remediation. Without investigation, reverting or disabling could destroy forensic evidence or disrupt legitimate services.

Answer

Notify the server owner

Answer

Revert the server to the last known good configuration

Answer

Disable the server's network access

Question 9

A company is implementing a new access control system for its data center. Which physical security control is best for preventing tailgating?

Accepted Answer

Mantrap. A mantrap is specifically designed to prevent tailgating by using a small vestibule with two interlocking doors. Only one door can open at a time, and the system typically requires authentication (e.g., badge or biometric) to proceed, ensuring that only one authorized person enters per cycle. This physical barrier directly blocks unauthorized individuals from following an authorized user through a single entry point.

Answer

Biometric reader

Answer

Security guard

Answer

CCTV cameras

Question 10

A patch management process is being audited. Which finding indicates a critical gap in the process?

Accepted Answer

Patches are not tested in a staging environment before production deployment. Failure to test patches in a staging environment can lead to instability when deployed to production.

Answer

Exception requests for unpatched systems are documented

Answer

Critical systems are patched monthly

Answer

Patches are deployed within 30 days of release

Question 11

A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)

Accepted Answer

Average time to patch critical vulnerabilities. Average time to patch critical vulnerabilities (Mean Time to Patch, MTTP) directly measures the speed of remediation, which is a key indicator of patching effectiveness. Patch compliance rate quantifies the percentage of systems that have the required patches installed, reflecting coverage and adherence to policy. Both metrics provide actionable data on the patching process's efficiency and completeness.

Answer

Help desk ticket volume

Answer

Number of security incidents

Answer

Number of users trained

Question 12

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 13

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

Accepted Answer

At least two different media types. The 3-2-1 rule requires at least two different media types (e.g., tape and disk, or disk and cloud) to mitigate the risk of a single media failure or vulnerability. This ensures that if one media type becomes corrupted or obsolete, the other remains viable for recovery.

Answer

Daily full backups

Answer

Encryption of all backups

Question 14

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

Accepted Answer

Biometric reader. Biometric readers and mantraps provide strong authentication and access control.

Answer

Visitor log

Answer

Clean desk policy

Answer

Screen locks

Question 15

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Accepted Answer

Document the findings and update processes. Documenting findings and updating processes is a fundamental part of the change management lifecycle. It ensures that the security vulnerability is formally recorded, root causes are analyzed, and preventive measures are incorporated into future changes. This aligns with the post-implementation review (PIR) phase, where lessons learned are captured to improve security operations and administration.

Answer

Immediately apply a patch

Answer

Blame the change implementer

Answer

Proceed and accept the risk