SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Question 1

An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?

Accepted Answer

License type and number of licenses. License type and number of licenses are critical for ensuring compliance with software licensing agreements and avoiding legal or financial penalties. Tracking these allows the organization to verify that the number of installed copies does not exceed the purchased licenses, which is a core requirement of software asset management (SAM).

Answer

Physical location of the installed software

Answer

Serial number of the installation media

Answer

Name of the user who installed it

Question 2

During a security awareness training session, an employee reports receiving an email that appears to be from the CEO requesting an urgent wire transfer. The email has a suspicious domain and poor grammar. Which type of attack is this an example of?

Accepted Answer

Phishing. This is a classic example of phishing, a broad category of social engineering attacks where attackers send deceptive emails to trick recipients into revealing sensitive information or performing actions like wire transfers. The email's suspicious domain and poor grammar are telltale signs of a generic phishing attempt, as it is not specifically tailored to the employee or the CEO's identity.

Answer

Smishing

Answer

Spear phishing

Answer

Whaling

Question 3

A company has a backup policy that performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server fails. How many backup sets are needed to restore the server to its state on Tuesday night?

Accepted Answer

Three. To restore the server to its state on Tuesday night, you need the full backup from Sunday and the incremental backups from Monday and Tuesday. Incremental backups only capture changes since the last backup (full or incremental), so you must restore them in sequence: full backup first, then Monday's incremental, then Tuesday's incremental. This requires three backup sets total, making option D correct.

Answer

One

Answer

Two

Answer

Four

Question 4

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

Accepted Answer

To reduce the risk of data breaches. A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

Answer

To lower office cleaning costs

Answer

To comply with fire safety regulations

Answer

To improve employee productivity

Question 5

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

Accepted Answer

Incident count. The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Answer

Patch compliance

Answer

Training completion

Answer

Mean time to detect (MTTD)

Question 6

A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.

Answer

Perform post-implementation review

Answer

Develop a rollback plan

Answer

Implement the change in production

Question 7

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 8

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

Accepted Answer

Differential backup. The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Answer

Full backup

Answer

Copy backup

Answer

Incremental backup

Question 9

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

Accepted Answer

Assess the risk and implement compensating controls if possible. The first step is to assess the risk and prioritise based on exploitability and asset criticality. A CVSS 9.8 vulnerability is critical, so immediate action is needed, but the administrator should evaluate compensating controls before applying the patch.

Answer

Schedule the patch for the next maintenance window without further analysis

Answer

Apply the patch immediately during business hours

Answer

Document the exception and ignore the vulnerability

Question 10

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

Accepted Answer

Sanitise the hard drive and then dispose or reassign. Media handling policies require that portable media be sanitised before disposal to prevent data leakage. Hard drives should be wiped or destroyed.

Answer

Keep the hardware in storage indefinitely

Answer

Recycle the hardware without any data removal

Answer

Reassign the hardware to a new employee without wiping

Question 11

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

Accepted Answer

Implement automated configuration scanning in the staging environment. Configuration management includes automated scanning (e.g., SCAP) to detect deviations. Implementing such scans in the staging environment would catch deviations before production.

Answer

Increase the number of testers

Answer

Require CAB approval for all future changes

Answer

Use a different change management process

Question 12

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Answer

Strong password policy

Answer

Asset tracking software

Answer

Remote wiping capability

Question 13

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

Accepted Answer

Two different media types. The 3-2-1 backup rule requires three copies of the data (one primary and two backups), stored on two different media types (e.g., disk and tape, or local disk and cloud storage), with one copy kept offsite. Option D is correct because using two different media types ensures that a failure or vulnerability affecting one medium (e.g., ransomware encrypting a disk array) does not compromise the other copy. This diversity is a core principle of the rule, reducing the risk of simultaneous data loss.

Answer

One copy in the cloud

Answer

Daily full backups

Answer

All copies on the same media

Question 14

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. A post-implementation review is a valid step in the change management process because it evaluates whether the change met its objectives, identifies any issues, and captures lessons learned. This review typically occurs after the change has been implemented and verified, ensuring that the change was successful and that any unintended consequences are documented.

Answer

Vulnerability scanning

Answer

Baseline configuration update

Question 15

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. CCTV (Closed-Circuit Television) is a physical security control because it involves cameras and recording equipment that monitor and deter physical access to facilities. It is a detective and deterrent control that operates in the physical domain, not the logical or network domain.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption