SSCP Security Operations and Administration Practice Test 3 — 15 Questions

Question 1

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

Accepted Answer

Requirements for password complexity and multifactor authentication. An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

Answer

Procedures for data backup and recovery

Answer

Guidelines for responding to security incidents

Answer

A list of approved social media platforms

Question 2

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Accepted Answer

Execute the rollback plan and schedule a post-implementation review. The change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

Answer

Leave the server in its current state and escalate to the CAB for a decision

Answer

Patch the server with the latest updates to resolve the performance issue

Answer

Submit a new change request for the rollback and await CAB approval

Question 3

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

Accepted Answer

SIEM with change detection rules. SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.

Answer

Configuration management database (CMDB)

Answer

Vulnerability scanner

Answer

Patch management tool

Question 4

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

Answer

Full backup

Answer

Incremental backup

Answer

Snapshot backup

Question 5

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Accepted Answer

The email creates a sense of urgency or threatens negative consequences. Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

Answer

The email contains an attachment from an unknown sender

Answer

The email has grammatical errors or misspellings

Answer

The email address of the sender closely resembles a legitimate domain

Question 6

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

Accepted Answer

CVSS score and asset criticality. Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.

Answer

Number of systems affected and patch size

Answer

Age of the patch and vendor reputation

Answer

Cost of the patch and availability of workarounds

Question 7

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

Accepted Answer

Weekly full backups and hourly incremental backups. Hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Answer

Weekly full backups and daily differential backups

Answer

Monthly full backups and weekly incremental backups

Answer

Daily full backups with no incremental backups

Question 8

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

Accepted Answer

Using a configuration management tool to deploy a hardened image automatically. Using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Answer

Requiring post-deployment security reviews for each server

Answer

Requiring administrators to manually apply CIS benchmarks after installation

Answer

Performing periodic vulnerability scans on all servers

Question 9

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

Accepted Answer

Key performance indicator (KPI). A key performance indicator (KPI) measures the performance of a process or activity. Patch compliance rates are common KPIs for patch management, indicating how well the organization is meeting patching objectives.

Answer

Service level agreement (SLA)

Answer

Control objective

Answer

Key risk indicator (KRI)

Question 10

Which of the following is the correct order of steps in the change management process?

Accepted Answer

Change request, impact assessment, CAB approval, testing, implementation, post-implementation review. The standard change management process begins with submitting a change request, followed by impact assessment, CAB approval, testing, implementation, and finally post-implementation review.

Answer

Change request, CAB approval, impact assessment, testing, implementation, post-implementation review

Answer

Impact assessment, change request, CAB approval, testing, implementation, post-implementation review

Answer

Change request, testing, impact assessment, CAB approval, implementation, post-implementation review

Question 11

A security administrator needs to dispose of hard drives that contain sensitive data. Which method provides the highest assurance that data cannot be recovered?

Accepted Answer

Physically shredding the hard drives. Physical destruction (e.g., shredding, crushing) ensures that the storage media is no longer usable and data recovery is virtually impossible. Degaussing may destroy magnetic media but is less effective on SSDs. Overwriting requires multiple passes and may not be effective on all media types.

Answer

Deleting all files and emptying the recycle bin

Answer

Performing a quick format of the drive

Answer

Using a degausser to erase magnetic data

Question 12

An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?

Accepted Answer

Administrative control. This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.

Answer

Detective control

Answer

Technical control

Answer

Physical control

Question 13

A company's backup strategy uses a full backup on Sundays and differential backups on other days. On Thursday, the storage system fails. How many backups are required to restore the data?

Accepted Answer

Two (the full backup and the Thursday differential). A differential backup copies all data changed since the last full backup. Therefore, to restore data on Thursday, you need the last full backup (Sunday) and the most recent differential backup (Thursday), which contains all changes from Sunday through Thursday. This totals two backups.

Answer

One (the full backup only)

Answer

Five (the full backup and all differentials from Monday to Thursday)

Answer

Six (all backups from Sunday to Thursday)

Question 14

Which TWO of the following are key components of the 3-2-1 backup rule?

Accepted Answer

At least three copies of the data. The 3-2-1 backup rule mandates at least three copies of the data (one primary and two backups) to ensure redundancy against failures. Option D directly states this requirement, which is the '3' in the rule.

Answer

One copy stored in a different geographic location

Answer

Daily full backups

Answer

All backups must be encrypted

Question 15

Which THREE of the following are examples of security awareness training topics?

Accepted Answer

Recognizing phishing emails. Recognizing phishing emails is a core security awareness training topic that teaches users to identify social engineering attempts, such as spoofed sender addresses, suspicious links, and urgent language. This training reduces the risk of credential theft and malware installation, which are common attack vectors in organizations.

Answer

How to apply patches to servers

Answer

Configuring firewall rules