SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Question 1

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

Accepted Answer

Key performance indicator (KPI). A Key Performance Indicator (KPI) is a measurable value that demonstrates how effectively an organization is achieving key business objectives. The percentage of systems with critical patches applied within 48 hours is a performance metric that tracks the efficiency of the patch management process, making it a KPI. It indicates how well the security team is performing against a defined target.

Answer

Service level agreement (SLA)

Answer

Control objective

Answer

Key risk indicator (KRI)

Question 2

Which of the following is the correct order of steps in the change management process?

Accepted Answer

Change request, impact assessment, CAB approval, testing, implementation, post-implementation review. The standard change management lifecycle begins with a formal change request, followed by an impact/risk assessment so the CAB has the information needed to evaluate the change. Only after that assessment does the CAB approve or reject, then testing occurs in a non-production environment, then implementation, and finally a post-implementation review to confirm success and capture lessons learned. This sequence ensures decisions are made with full information and that changes are validated before touching production.

Answer

Change request, CAB approval, impact assessment, testing, implementation, post-implementation review

Answer

Impact assessment, change request, CAB approval, testing, implementation, post-implementation review

Answer

Change request, testing, impact assessment, CAB approval, implementation, post-implementation review

Question 3

A security administrator needs to dispose of hard drives that contain sensitive data. Which method provides the highest assurance that data cannot be recovered?

Accepted Answer

Physically shredding the hard drives. Physically shredding the hard drives reduces them to small particles, making any recovery of magnetic or solid-state data physically impossible. This provides the highest level of assurance because the storage media itself is destroyed, not just the data on it. It is the recommended method for media containing highly sensitive data when reuse is not required.

Answer

Deleting all files and emptying the recycle bin

Answer

Performing a quick format of the drive

Answer

Using a degausser to erase magnetic data

Question 4

An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?

Accepted Answer

Administrative control. This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.

Answer

Detective control

Answer

Technical control

Answer

Physical control

Question 5

A company's backup strategy uses a full backup on Sundays and differential backups on other days. On Thursday, the storage system fails. How many backups are required to restore the data?

Accepted Answer

Two (the full backup and the Thursday differential). A differential backup copies all data changed since the last full backup. Therefore, to restore data on Thursday, you need the last full backup (Sunday) and the most recent differential backup (Thursday), which contains all changes from Sunday through Thursday. This totals two backups.

Answer

One (the full backup only)

Answer

Five (the full backup and all differentials from Monday to Thursday)

Answer

Six (all backups from Sunday to Thursday)

Question 6

A security administrator is implementing physical security for a data center. Which THREE of the following controls should be included to provide layered security?

Accepted Answer

Mantrap at the main entrance. A mantrap at the main entrance (A) is correct because it creates a physical buffer zone that allows only one person through at a time, preventing tailgating and piggybacking into the facility. CCTV monitoring of all entry points (C) is correct because it provides continuous surveillance and recording of access points, enabling detection, deterrence, and forensic review of security incidents. Biometric readers on server room doors (E) are correct because they enforce strong authentication based on unique physiological traits for the most sensitive area, adding a distinct layer beyond perimeter controls. Screen locks on workstations (B) and a clean desk policy (D) are administrative and logical controls for protecting information, not physical controls for securing a data center's entry points and rooms.

Answer

Screen locks on all workstations

Answer

Clean desk policy for employees

Question 7

Which THREE of the following are examples of security awareness training topics?

Accepted Answer

Recognizing phishing emails. Security awareness training targets the general workforce's day-to-day behavior rather than specialized technical administration. Option B (Recognizing phishing emails) is correct because teaching users to spot suspicious senders, spoofed links, and urgent lures is a core awareness objective that reduces credential theft and malware infections. Option D (Physical security best practices such as locking screens) is correct because awareness programs cover everyday physical controls like clean-desk policies, tailgating prevention, and screen locking to protect data from unauthorized access. Option E (Social engineering tactics) is correct because understanding pretexting, baiting, and impersonation helps employees resist manipulation attempts that bypass technical controls. Options A (applying server patches) and C (configuring firewall rules) are not awareness topics; they are hands-on technical administration tasks performed by IT/security staff, not general-user training content.

Answer

How to apply patches to servers

Answer

Configuring firewall rules

Question 8

An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?

Accepted Answer

License type and number of licenses. Option A (License type and number of licenses) is correct because software inventory management must track licensing entitlements—such as perpetual, subscription, or concurrent-user licenses and the quantity purchased—to ensure license compliance, avoid over-deployment penalties, and support audits. Option C (Version and patch level) is correct because knowing the exact version and patch level of each installed application is essential for vulnerability management, patch remediation, and confirming supportability. Option B is not a standard inventory attribute for software assets; physical location is typically tracked for hardware assets, not installed software. Option D is unnecessary because installation media serial numbers are not meaningful inventory data for deployed software. Option E is not required for inventory purposes; the installing user does not determine licensing, versioning, or compliance status.

Answer

Physical location of the installed software

Answer

Serial number of the installation media

Answer

Name of the user who installed it

Question 9

Which TWO of the following are valid reasons to deny a change request during the CAB approval process?

Accepted Answer

The change request lacks a rollback plan. Option B is correct because a change request without a rollback plan presents an unacceptable risk: if the change fails in production, the organization has no defined, tested way to revert to the prior known-good state, so the CAB should deny it until a rollback (backout) plan is documented. Option D is correct because untested changes have unverified behavior and unknown failure modes; the CAB should deny approval until the change has been validated in a staging environment that mirrors production, satisfying change validation and testing requirements. Option A is not a valid denial reason in itself, since budget is a financial approval matter handled separately from CAB risk assessment, and a change can still be technically sound. Option C is not valid because low priority affects scheduling and sequencing, not approval; a low-priority change can still be approved and deferred. Option E is not valid because the requester's seniority is irrelevant — the CAB evaluates the change's risk, impact, and readiness, not who submitted it.

Answer

The change is outside the approved budget

Answer

The change has a low priority

Answer

The change was requested by a junior staff member

Question 10

A security administrator is implementing a policy that requires all employees to use a password manager and enable multi-factor authentication. This policy is BEST described as a:

Accepted Answer

Password policy. The policy requires all employees to use a password manager and enable multi-factor authentication, which directly governs the creation, storage, and authentication strength of user credentials. This is the core function of a password policy, as defined in security frameworks like NIST SP 800-53 (IA-5) and ISO 27001 (A.9.2.1). It specifically addresses password complexity, rotation, and MFA enforcement, not data classification or access methods.

Answer

Data handling policy

Answer

Social media policy

Answer

Remote access policy

Question 11

A company has a backup policy that performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server fails. How many backup sets are needed to restore the server to its state on Tuesday night?

Accepted Answer

Three. To restore the server to its state on Tuesday night, you need the full backup from Sunday and the incremental backups from Monday and Tuesday. Incremental backups only capture changes since the last backup (full or incremental), so you must restore them in sequence: full backup first, then Monday's incremental, then Tuesday's incremental. This requires three backup sets total, making option D correct.

Answer

One

Answer

Two

Answer

Four

Question 12

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

Accepted Answer

To reduce the risk of data breaches. A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

Answer

To lower office cleaning costs

Answer

To comply with fire safety regulations

Answer

To improve employee productivity

Question 13

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 14

Which of the following physical security controls is designed to prevent tailgating by requiring two doors to be interlocked?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, preventing an unauthorized person from following an authorized person through a single entry point (tailgating). This design forces each individual to be authenticated before the second door unlocks, ensuring only one person passes per authentication event.

Answer

Security guard

Answer

Biometric reader

Answer

CCTV

Question 15

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

Accepted Answer

Differential backup. The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Answer

Full backup

Answer

Copy backup

Answer

Incremental backup