SSCP Security Operations and Administration Practice Test 4 — 15 Questions

Question 1

A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?

Accepted Answer

Test the change in a staging environment. After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.

Answer

Perform post-implementation review

Answer

Develop a rollback plan

Answer

Implement the change in production

Question 2

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Accepted Answer

Configuration management. C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Answer

Change management

Answer

Asset management

Answer

Patch management

Question 3

Which of the following physical security controls is designed to prevent tailgating by requiring two doors to be interlocked?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, preventing an unauthorized person from following an authorized person through a single entry point (tailgating). This design forces each individual to be authenticated before the second door unlocks, ensuring only one person passes per authentication event.

Answer

Security guard

Answer

Biometric reader

Answer

CCTV

Question 4

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

Accepted Answer

Differential backup. The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Answer

Full backup

Answer

Copy backup

Answer

Incremental backup

Question 5

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

Accepted Answer

Assess the risk and implement compensating controls if possible. The first step is to assess the risk and prioritise based on exploitability and asset criticality. A CVSS 9.8 vulnerability is critical, so immediate action is needed, but the administrator should evaluate compensating controls before applying the patch.

Answer

Schedule the patch for the next maintenance window without further analysis

Answer

Apply the patch immediately during business hours

Answer

Document the exception and ignore the vulnerability

Question 6

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

Accepted Answer

Sanitise the hard drive and then dispose or reassign. Media handling policies require that portable media be sanitised before disposal to prevent data leakage. Hard drives should be wiped or destroyed.

Answer

Keep the hardware in storage indefinitely

Answer

Recycle the hardware without any data removal

Answer

Reassign the hardware to a new employee without wiping

Question 7

Which of the following is the BEST definition of Recovery Point Objective (RPO)?

Accepted Answer

The maximum acceptable data loss in terms of time. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Answer

The cost of data recovery

Answer

The time it takes to recover data after a disaster

Answer

The number of backup copies stored

Question 8

A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?

Accepted Answer

Remote access policy. The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

Answer

Data handling policy

Answer

Password policy

Answer

Acceptable use policy (AUP)

Question 9

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

Accepted Answer

Implement automated configuration scanning in the staging environment. Configuration management includes automated scanning (e.g., SCAP) to detect deviations. Implementing such scans in the staging environment would catch deviations before production.

Answer

Increase the number of testers

Answer

Require CAB approval for all future changes

Answer

Use a different change management process

Question 10

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

Answer

Strong password policy

Answer

Asset tracking software

Answer

Remote wiping capability

Question 11

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

Accepted Answer

Two different media types. The 3-2-1 backup rule requires three copies of the data (one primary and two backups), stored on two different media types (e.g., disk and tape, or local disk and cloud storage), with one copy kept offsite. Option D is correct because using two different media types ensures that a failure or vulnerability affecting one medium (e.g., ransomware encrypting a disk array) does not compromise the other copy. This diversity is a core principle of the rule, reducing the risk of simultaneous data loss.

Answer

One copy in the cloud

Answer

Daily full backups

Answer

All copies on the same media

Question 12

Which THREE of the following are valid steps in the change management process? (Select THREE)

Accepted Answer

Post-implementation review. A post-implementation review is a valid step in the change management process because it evaluates whether the change met its objectives, identifies any issues, and captures lessons learned. This review typically occurs after the change has been implemented and verified, ensuring that the change was successful and that any unintended consequences are documented.

Answer

Vulnerability scanning

Answer

Baseline configuration update

Question 13

Which TWO of the following are examples of physical security controls? (Select TWO)

Accepted Answer

CCTV. CCTV (Closed-Circuit Television) is a physical security control because it involves cameras and recording equipment that monitor and deter physical access to facilities. It is a detective and deterrent control that operates in the physical domain, not the logical or network domain.

Answer

Firewall

Answer

Intrusion detection system (IDS)

Answer

Encryption

Question 14

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

Accepted Answer

Patch prioritization based on CVSS score and asset criticality. Option A is correct because patch prioritization based on CVSS score and asset criticality ensures that resources are allocated to the most impactful vulnerabilities first. CVSS provides a standardized severity rating (0-10), while asset criticality accounts for the business value and exposure of the system, enabling risk-based decision-making rather than a one-size-fits-all approach.

Answer

Immediate deployment of all patches without testing

Answer

Annual review of patch status

Question 15

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

Accepted Answer

Relationships between configuration items. A CMDB is a repository that stores information about configuration items (CIs) and their relationships. Option C is correct because relationships between CIs are fundamental to understanding how changes affect the IT infrastructure. Option E is correct because hardware inventory details like serial numbers are typical attributes stored for each CI, enabling asset tracking and impact analysis.

Answer

Password hashes

Answer

Change request approvals

Answer

Incident tickets