SSCP Security Operations and Administration Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing an incident where an attacker gained access to a server by exploiting a misconfigured service account that had domain administrator privileges. Which of the following is the MOST effective control to prevent this type of attack in the future?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement the principle of least privilege for all service accounts.. The principle of least privilege directly addresses the misconfiguration by ensuring service accounts have only the minimum permissions required, preventing them from having domain administrator rights. This reduces the impact of a compromise and is the most effective preventive measure. Other options are useful but do not eliminate the excessive privileges that enabled the attack.

Answer

Enable multi-factor authentication (MFA) for all interactive logons.

Answer

Conduct regular vulnerability scans on all servers.

Answer

Deploy a privileged access management (PAM) solution to vault service account credentials.

Question 2

A security administrator is implementing a separation of duties control for the accounts payable system. Which TWO practices best support this objective? (Choose two.)

Accepted Answer

Require that the employee who creates a vendor record cannot also approve payments to that vendor.. Separation of duties requires that no single person controls an entire sensitive transaction. Preventing the vendor creator from approving payments, and requiring independent dual authorization above a threshold, both split critical steps across different people. Full admin rights, self-reconciliation, and administrator payment approval all concentrate conflicting duties and undermine the control.

Answer

Assign the same employee to both enter invoices and reconcile the corresponding bank statements.

Answer

Allow the system administrator to approve payments when the normal approver is on leave.

Answer

Grant the accounts payable manager full administrative rights to the payment application to resolve issues quickly.

Question 3

A security administrator is reviewing audit logs and notices that a user account with administrative privileges was used to access a sensitive file outside of normal business hours. The administrator suspects the account may have been compromised. Which of the following should the administrator do FIRST?

Accepted Answer

Disable the user account immediately.. In incident response, containment is the immediate priority to stop further damage. Disabling the compromised account prevents the attacker from continuing to use it. Other actions like investigation, notification, or password resets are important but secondary to stopping the active threat.

Answer

Reset the user's password.

Answer

Notify law enforcement.

Answer

Review the file's contents to determine sensitivity.

Question 4

A security administrator is reviewing the organization's data classification policy. The policy must ensure that data is handled appropriately throughout its lifecycle. Which TWO of the following are primary objectives of data classification? (Choose two.)

Accepted Answer

To determine the appropriate level of protection based on sensitivity.. The primary objectives of data classification are to determine the appropriate level of protection based on sensitivity and to comply with legal and regulatory requirements. These drive the implementation of security controls and ensure that data is handled according to its value and mandated safeguards.

Answer

To provide a basis for access control decisions.

Answer

To enable faster backup and recovery operations.

Answer

To reduce storage costs by identifying redundant data.

Question 5

A security administrator is developing a disaster recovery plan and needs to ensure that critical systems can be restored within the required time frame. Which TWO of the following should be defined to meet this requirement? (Choose two.)

Accepted Answer

Recovery point objective (RPO). RTO and RPO are the two key objectives for disaster recovery planning. RTO specifies how quickly systems must be restored, and RPO specifies how much data loss is acceptable. Together, they define the recovery requirements and guide the design of backup and recovery solutions.

Answer

Mean time to failure (MTTF)

Answer

Service level agreement (SLA)

Answer

Maximum tolerable downtime (MTD)

Question 6

A security administrator is reviewing the organization's incident response plan and notes that it does not define who is authorized to communicate with the media during a breach. Which element of the incident response process does this omission primarily affect?

Accepted Answer

Post-incident activity and coordination, because unclear communication roles affect stakeholder and public messaging.. The incident response lifecycle includes preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Communication with media and stakeholders is a coordination responsibility that spans the response and post-incident phases. Because the plan does not identify who may speak publicly, the organization cannot ensure accurate, authorized messaging, which primarily affects post-incident activity and coordination.

Answer

Detection and analysis, because the team cannot identify the scope of the breach without media guidance.

Answer

Preparation, because the plan lacks a defined communication role before an incident occurs.

Answer

Containment, eradication, and recovery, because the team must isolate systems before speaking publicly.

Question 7

A systems administrator at a healthcare company is mapping data flows for a new patient portal. The administrator needs to classify the data element that combines a patient's name, medical record number, and diagnosis code because this combination could identify a specific individual. Which data classification label is most appropriate for this combined element?

Accepted Answer

Personally identifiable information (PII). The combined element uniquely identifies a patient and reveals health information, so it must be classified as personally identifiable information. That label drives the privacy and security controls required for the portal data flow. The other labels describe business information categories or unrestricted release, which do not accurately reflect the personal and regulated nature of the patient data.

Answer

Public

Answer

Confidential

Answer

Proprietary

Question 8

A company wants to ensure that employees understand the proper use of corporate email and internet. Which policy should they implement?

Accepted Answer

Acceptable Use Policy. An Acceptable Use Policy (AUP) defines the rules and guidelines for using corporate IT resources, including email and internet. It specifies permitted and prohibited activities, such as personal browsing, sending sensitive data, or accessing inappropriate content, ensuring employees understand their responsibilities. This policy directly addresses the company's goal of educating employees on proper usage, unlike other policies that focus on data classification, remote connectivity, or authentication.

Answer

Data Handling Policy

Answer

Remote Access Policy

Answer

Password Policy

Question 9

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

Accepted Answer

Clean Desk Policy. The Clean Desk Policy is violated because it requires employees to keep their workspaces free of sensitive information, including passwords, when not in use. Writing passwords on sticky notes and attaching them to monitors leaves credentials exposed, directly contravening this policy. The Clean Desk Policy aims to reduce the risk of unauthorized access to information.

Answer

Social Media Policy

Answer

Data Handling Policy

Answer

Password Policy

Question 10

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

Accepted Answer

Recognizing phishing attempts. Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

Answer

Proper use of social media

Answer

Physical security procedures

Answer

Data backup procedures

Question 11

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

Accepted Answer

Prioritize patching based on vulnerability criticality. When patch compliance is below target, the first step is to prioritize patching based on vulnerability criticality so that the most exploitable and highest-impact systems are remediated first. This maximizes risk reduction per unit of effort and directly addresses the gap between 85% and 95% by focusing resources where they matter most. Simply scanning more or excluding systems does not improve compliance meaningfully.

Answer

Increase the frequency of vulnerability scans

Answer

Disable automatic updates to prevent issues

Answer

Exclude non-critical systems from patching

Question 12

A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?

Accepted Answer

Report the issue to the CAB and request a revised change. Reporting the issue to the CAB and requesting a revised change is the best course because the change management process requires that any significant deviation from the approved change, such as a major compatibility issue, be re-evaluated by the CAB. This ensures proper risk assessment and approval before proceeding. It maintains the integrity of the change control process and prevents unintended outages.

Answer

Reject the change request and close it permanently

Answer

Implement the change but have a rollback plan ready

Answer

Proceed with the change and resolve the issue after implementation

Question 13

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Accepted Answer

SCAP scanner. SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

Answer

Vulnerability scanner

Answer

Asset management database

Answer

SIEM

Question 14

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Accepted Answer

CMDB. A Configuration Management Database (CMDB) is the authoritative repository for recording configuration items (CIs) such as hardware assets, their serial numbers, locations, owners, relationships, and lifecycle states. It underpins ITIL/ITSM processes like change, incident, and asset management. Tracking hardware serial numbers and physical locations is a canonical CMDB use case.

Answer

Patch management tool

Answer

Vulnerability database

Answer

SIEM

Question 15

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Accepted Answer

Use the intercom to contact security. In a mantrap (access control vestibule), if the second door fails to open after the first door closes, the employee should use the intercom to contact security. This ensures that security personnel can assess the situation, verify identity, and manually override the door if appropriate, while maintaining the security integrity of the mantrap.

Answer

Return through the first door

Answer

Force the second door open

Answer

Wait for someone to open from the other side