SSCP Security Operations and Administration Practice Test 2 — 15 Questions

Question 1

A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)

Accepted Answer

Average time to patch critical vulnerabilities. Average time to patch critical vulnerabilities (Mean Time to Patch, MTTP) directly measures the speed of remediation, which is a key indicator of patching effectiveness. Patch compliance rate quantifies the percentage of systems that have the required patches installed, reflecting coverage and adherence to policy. Both metrics provide actionable data on the patching process's efficiency and completeness.

Answer

Help desk ticket volume

Answer

Number of security incidents

Answer

Number of users trained

Question 2

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

Accepted Answer

Description of the change. A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Answer

Employee performance review

Answer

Budget approval

Question 3

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

Accepted Answer

At least two different media types. Option A is correct because the 3-2-1 rule requires at least two different media types (e.g., tape and disk, or disk and cloud) to mitigate the risk of a single media failure or vulnerability. This ensures that if one media type becomes corrupted or obsolete, the other remains viable for recovery.

Answer

Daily full backups

Answer

Encryption of all backups

Question 4

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

Accepted Answer

Biometric reader. Biometric readers and mantraps provide strong authentication and access control.

Answer

Visitor log

Answer

Clean desk policy

Answer

Screen locks

Question 5

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Accepted Answer

Document the findings and update processes. Option B is correct because documenting findings and updating processes is a fundamental part of the change management lifecycle. It ensures that the security vulnerability is formally recorded, root causes are analyzed, and preventive measures are incorporated into future changes. This aligns with the post-implementation review (PIR) phase, where lessons learned are captured to improve security operations and administration.

Answer

Immediately apply a patch

Answer

Blame the change implementer

Answer

Proceed and accept the risk

Question 6

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

Accepted Answer

Requirements for password complexity and multifactor authentication. An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

Answer

Procedures for data backup and recovery

Answer

Guidelines for responding to security incidents

Answer

A list of approved social media platforms

Question 7

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. Option A is correct because the change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 8

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

Accepted Answer

SIEM with change detection rules. SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.

Answer

Configuration management database (CMDB)

Answer

Vulnerability scanner

Answer

Patch management tool

Question 9

A security analyst notices an alert indicating that a user's workstation has been connected to an unauthorized external device. Which physical security control would best help prevent such incidents?

Accepted Answer

Clean desk policy. A clean desk policy is a physical security control that requires employees to clear their workstations of sensitive documents, removable media, and devices at the end of each work session. By mandating that external devices like USB drives or peripherals be stored securely, it directly reduces the risk of unauthorized devices being connected to workstations. This policy complements technical controls like device control policies (e.g., Windows Group Policy for USB restrictions) by addressing the human factor.

Answer

Biometric readers on workstations

Answer

Mantrap at building entrance

Answer

CCTV monitoring

Question 10

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Full backup

Answer

Incremental backup

Answer

Snapshot backup

Question 11

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Accepted Answer

The email creates a sense of urgency or threatens negative consequences. Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

Answer

The email contains an attachment from an unknown sender

Answer

The email has grammatical errors or misspellings

Answer

The email address of the sender closely resembles a legitimate domain

Question 12

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 13

Which of the following is the primary purpose of a configuration management database (CMDB)?

Accepted Answer

To provide a centralized repository of configuration items and their relationships. A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.

Answer

To track changes to network devices in real time

Answer

To automate the deployment of patches

Answer

To store backup copies of configuration files

Question 14

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

Accepted Answer

Weekly full backups and hourly incremental backups. Option B is correct because hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Answer

Weekly full backups and daily differential backups

Answer

Monthly full backups and weekly incremental backups

Answer

Daily full backups with no incremental backups

Question 15

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Option B is correct because using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers